Edit tour

Windows Analysis Report
EspPrivStoreAtt116.exe

Overview

General Information

Sample name:	EspPrivStoreAtt116.exe
Analysis ID:	1590902
MD5:	3653a466ffb4ccb78a2898a781dea130
SHA1:	7c3a5e4267dfd27585a37b590543c4d9dec73ee2
SHA256:	8b09a8bf369165115ad04e9c7f7c0058b506b560ec0324657188592e66cbcd8a
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

EspPrivStoreAtt116.exe (PID: 5332 cmdline: "C:\Users\user\Desktop\EspPrivStoreAtt116.exe" MD5: 3653A466FFB4CCB78A2898A781DEA130)

conhost.exe (PID: 4392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1612 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6412 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3432 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6264 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3924 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5616 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2800 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4236 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3132 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5964 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1268 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 2496 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4784 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7064 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 964 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 380 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6504 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3700 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1596 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4620 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6912 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6992 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5796 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4788 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5768 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1824 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1776 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2132 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5696 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5432 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4156 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4160 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5504 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: EspPrivStoreAtt116.exe	Virustotal: Detection: 61%			Perma Link
Source: EspPrivStoreAtt116.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.6% probability

Machine Learning detection for sample

Source: EspPrivStoreAtt116.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169A84D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF76169A84D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616B63E0 CertOpenStore,GetLastError,CertCreateCertificateChainuser,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainuser,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF7616B63E0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616BF840 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7616BF840
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616BD750 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7616BD750
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169CAD0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF76169CAD0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616B6D00 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF7616B6D00
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761699B40 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF761699B40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169CB30 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF76169CB30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169CB20 CryptHashData,	0_2_00007FF76169CB20
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761699C10 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF761699C10

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF76167F9F0
Source: EspPrivStoreAtt116.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF7616A9410

Source: unknown

HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.6:49715 version: TLS 1.2

Source: EspPrivStoreAtt116.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe
Source:	Binary string: 2D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.1.5 104.26.1.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF761695370 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,

0_2_00007FF761695370

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe
Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcioffbronkzatualizadoh96.exeC:
Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcionattprivatestore655.exe
Source: EspPrivStoreAtt116.exe	String found in binary or memory: http://167.114.85.75/esphvcionattprivatestore655.exeC:
Source: EspPrivStoreAtt116.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: EspPrivStoreAtt116.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217552923.000001FC604CC000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217399075.000001FC604CC000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC604CC000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217552923.000001FC604C8000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC604C8000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217399075.000001FC604C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.cc/panel/bronkzware/Loader
Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/em
Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/pacez
Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/UsersH

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown

HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.6:49715 version: TLS 1.2

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF7616BD750 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7616BD750

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761689290	0_2_00007FF761689290
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761687290	0_2_00007FF761687290
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616885D0	0_2_00007FF7616885D0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169A84D	0_2_00007FF76169A84D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761671AA0	0_2_00007FF761671AA0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761671E40	0_2_00007FF761671E40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76168FEA0	0_2_00007FF76168FEA0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76166D310	0_2_00007FF76166D310
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616A5300	0_2_00007FF7616A5300
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616792A0	0_2_00007FF7616792A0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76168A150	0_2_00007FF76168A150
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616931A0	0_2_00007FF7616931A0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616B63E0	0_2_00007FF7616B63E0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76166956D	0_2_00007FF76166956D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616985D0	0_2_00007FF7616985D0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169A915	0_2_00007FF76169A915
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169A90C	0_2_00007FF76169A90C
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76166974B	0_2_00007FF76166974B
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616BD750	0_2_00007FF7616BD750
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761671750	0_2_00007FF761671750
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616BF7D0	0_2_00007FF7616BF7D0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761683C40	0_2_00007FF761683C40
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76166EC30	0_2_00007FF76166EC30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761695CF0	0_2_00007FF761695CF0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616ADB30	0_2_00007FF7616ADB30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76166AC0D	0_2_00007FF76166AC0D
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616B0E90	0_2_00007FF7616B0E90
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616A9E30	0_2_00007FF7616A9E30
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761680F10	0_2_00007FF761680F10
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76169CEE0	0_2_00007FF76169CEE0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616B1EC0	0_2_00007FF7616B1EC0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF76166DEA0	0_2_00007FF76166DEA0
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761661000	0_2_00007FF761661000

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF761673940 appears 49 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF76168ABB0 appears 37 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF76168AC40 appears 33 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF7616896C0 appears 46 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF761680B50 appears 70 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF761686400 appears 326 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF7616C0B6C appears 47 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF76168AD20 appears 34 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF761686280 appears 380 times
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: String function: 00007FF761689790 appears 36 times

Source: classification engine

Classification label: mal56.winEXE@68/18@1/2

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF761672620 GetLastError,_errno,FormatMessageA,strchr,strncpy,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF761672620

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4392:120:WilError_03

Source: EspPrivStoreAtt116.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EspPrivStoreAtt116.exe	Virustotal: Detection: 61%
Source: EspPrivStoreAtt116.exe	ReversingLabs: Detection: 63%

Source: EspPrivStoreAtt116.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\EspPrivStoreAtt116.exe "C:\Users\user\Desktop\EspPrivStoreAtt116.exe"
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: EspPrivStoreAtt116.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: EspPrivStoreAtt116.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: EspPrivStoreAtt116.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: EspPrivStoreAtt116.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe
Source:	Binary string: 2D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant ESP\x64\Release\EpicGames.pdb source: EspPrivStoreAtt116.exe

Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: EspPrivStoreAtt116.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF761689290 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF761689290

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Window / User API: threadDelayed 2703			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 2210			Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe TID: 1468

Thread sleep time: -135150s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF7616C067C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7616C067C

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF7616C0A18 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7616C0A18

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

0_2_00007FF761689290

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616C0384 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7616C0384
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616C067C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7616C067C
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616C0824 SetUnhandledExceptionFilter,	0_2_00007FF7616C0824

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Code function: 0_2_00007FF7616C0894 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7616C0894

Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761695370 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF761695370
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616A5300 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF7616A5300
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616ABE00 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7616ABE00
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF7616AC060 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7616AC060
Source: C:\Users\user\Desktop\EspPrivStoreAtt116.exe	Code function: 0_2_00007FF761687F40 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF761687F40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EspPrivStoreAtt116.exe	61%	Virustotal		Browse
EspPrivStoreAtt116.exe	63%	ReversingLabs	Win64.Trojan.Generic
EspPrivStoreAtt116.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exeC:	0%	Avira URL Cloud	safe
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe	0%	Avira URL Cloud	safe
https://keyauth.cc/panel/bronkzware/Loader	0%	Avira URL Cloud	safe
http://167.114.85.75/esphvcionattprivatestore655.exeC:	0%	Avira URL Cloud	safe
http://167.114.85.75/esphvcionattprivatestore655.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.1.5	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/esphvcionattprivatestore655.exeC:	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exeC:	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/esphvcionattprivatestore655.exe	EspPrivStoreAtt116.exe	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.1/em	EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://keyauth.win/api/1.2/UsersH	EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html	EspPrivStoreAtt116.exe	false		high
https://curl.haxx.se/docs/http-cookies.html#	EspPrivStoreAtt116.exe	false		high
https://keyauth.cc/panel/bronkzware/Loader	EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217552923.000001FC604CC000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217399075.000001FC604CC000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC604CC000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217552923.000001FC604C8000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC604C8000.00000004.00000020.00020000.00000000.sdmp, EspPrivStoreAtt116.exe, 00000000.00000003.2217399075.000001FC604C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.1/pacez	EspPrivStoreAtt116.exe, 00000000.00000002.4045525981.000001FC6046C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://keyauth.win/api/1.2/	EspPrivStoreAtt116.exe, 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.1.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590902
Start date and time:	2025-01-14 16:55:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EspPrivStoreAtt116.exe
Detection:	MAL
Classification:	mal56.winEXE@68/18@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 48 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.253.72, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.1.5	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse
	tpmbypassprivatestore.exe	Get hash	malicious	Unknown	Browse
	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse
	CCuITQzvd4.exe	Get hash	malicious	Unknown	Browse
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse
	Fa1QSXjTZD.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.6030.29502.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	tpmbypassprivatestore.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	http://loginmicrosoftonline.al-mutaheda.com/expiration/notice/nRrRc/receiving@accel-inc.com	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	tpmbypassprivatestore.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	email.eml	Get hash	malicious	unknown	Browse	172.64.41.3
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	104.26.1.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.1.5
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.26.1.5

Process:	C:\Users\user\Desktop\EspPrivStoreAtt116.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.6129496847513636
Encrypted:	false
SSDEEP:	3:rRRqmIEaGj3F/9Dqa+U4W42oJXV/12To3G3oJXV/1WXqowvxOwVGt:H041ls/1HJ/1wcV4
MD5:	C7F3DB7690DFC6AF6C4758A6E97F62F8
SHA1:	853E06686F94A41861B9379D7C4DF2345561A93C
SHA-256:	3F9AECCCCC7B4411BCD809C0093342741B094C43BF546060544E078D76B8C522
SHA-512:	F05B260B2A5CCDD4C15EB42DA458B476CC6DFC8F1318587CE690581AF1D2FB785C98C7B8CCABAEF62DDE528BBD4D25D8AEB54241978C4D2C1CCC1DD1876D9A2D
Malicious:	false
Preview:	....##########################################################..[ Selecione uma opcao: ]..##########################################################....[1] Iniciar Valorant ESP (HVCI DESLIGADO): ..[2] Iniciar Valorant ESP (HVCI HABILITADO): ....[+] Selecione a opcao:

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.420268214401962
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EspPrivStoreAtt116.exe
File size:	510'464 bytes
MD5:	3653a466ffb4ccb78a2898a781dea130
SHA1:	7c3a5e4267dfd27585a37b590543c4d9dec73ee2
SHA256:	8b09a8bf369165115ad04e9c7f7c0058b506b560ec0324657188592e66cbcd8a
SHA512:	a0a1f67e3df1224fd57baefe57df2438993422d29f1f8965118de636eca6f5eb39c76b210e6e4a703d41df6a7ee2cf9f6e81b2b1d8d365d9d2a5fa331bdde157
SSDEEP:	12288:GMPtninPfug6cNLjkEWBBu2cl71MzRUMk:ntninnugrNpWBU2S71AUMk
TLSH:	28B47D56A7A817E9D1A7C03CC547C603E7B6B4991311DBDB43A0CA791F237E26E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._...B...PHe.^...PH..v...PH..\...PH..R...PH..P.......A...V...x.......?...9H..T...9H..W...9Hg.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140060368
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x677DDF0D [Wed Jan 8 02:12:29 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	551e5f19de2baa264d46ee5c6718793c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F4AE0E62FB8h
dec eax
add esp, 28h
jmp 00007F4AE0E62907h
int3
int3
jmp 00007F4AE0E6326Eh
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00001D9Bh]
dec eax
mov ecx, ebx
call dword ptr [00001D8Ah]
call dword ptr [00001DE4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001DE0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001DD4h]
test eax, eax
je 00007F4AE0E62A99h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00019492h]
call 00007F4AE0E62C5Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00019579h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00019509h], eax
dec eax
mov eax, dword ptr [00019562h]
dec eax
mov dword ptr [000193D3h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000194D7h], eax
mov dword ptr [000193ADh], C0000409h
mov dword ptr [000193A7h], 00000001h
mov dword ptr [000000B1h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x77318	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7a000	0x405c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x4ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x71080	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x71100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x70f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x62000	0x858	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x606e8	0x60800	663f6c1b9737e67c2a6764e4ebff456e	False	0.5325529266515544	data	6.334586632421333	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x62000	0x16ec4	0x17000	ed19f2f03e8e4c95b88fa40516677ba6	False	0.3795219089673913	data	5.599387100824537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x79000	0xe08	0x400	52aed000567e6839374d043cd5841bf5	False	0.2138671875	data	2.4461568678801138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x7a000	0x405c	0x4200	1f44589aeb34f25d94952a45d7939e4f	False	0.47407670454545453	data	5.699721075250355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7f000	0x1e8	0x200	9682c2bd23621eded0bee00be928ba8f	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x4ec	0x600	43a6897ca7133ec62c7e8be294ec97b7	False	0.5162760416666666	data	4.831811206446416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7f060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	ReadFile, PeekNamedPipe, WaitForMultipleObjects, CreateFileA, GetFileSizeEx, WideCharToMultiByte, RtlCaptureContext, GetModuleHandleA, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FreeLibrary, GetSystemDirectoryA, QueryPerformanceFrequency, VerSetConditionMask, SleepEx, GetEnvironmentVariableA, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, DeleteCriticalSection, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileType, MultiByteToWideChar, WaitForSingleObjectEx, MoveFileExA, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, LeaveCriticalSection, GetSystemTimeAsFileTime, GetProcAddress, GetLastError, InitializeCriticalSectionEx, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, SetConsoleScreenBufferInfoEx, GetConsoleScreenBufferInfoEx, SetConsoleMode, GetConsoleMode, Sleep, RtlLookupFunctionEntry, GetStdHandle, OutputDebugStringW, InitializeSListHead
USER32.dll	MessageBoxA, MoveWindow, GetWindowRect, GetWindowLongA, SetWindowLongA
ADVAPI32.dll	CryptEncrypt, CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Xlength_error@std@@YAXPEBD@Z, _Thrd_detach, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?_Random_device@std@@YAIXZ, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore
WS2_32.dll	ntohl, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, listen
VCRUNTIME140.dll	__std_exception_destroy, __std_exception_copy, memcpy, memcmp, _CxxThrowException, __std_terminate, __C_specific_handler, strchr, __current_exception_context, strrchr, __current_exception, memchr, memset, strstr, memmove
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_errno, __sys_nerr, _invalid_parameter_noinfo_noreturn, strerror, exit, _getpid, system, _beginthreadex, _register_thread_local_exe_atexit_callback, terminate, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _c_exit, _get_initial_narrow_environment, _initterm, _initterm_e, _exit, __p___argv, __p___argc
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, calloc, realloc, malloc, _set_new_mode, free
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, fputc, ftell, _lseeki64, _read, _write, _close, _open, __acrt_iob_func, __stdio_common_vsscanf, fgets, fputs, fopen, fflush, __stdio_common_vsprintf, fread, fclose, _set_fmode, fwrite
api-ms-win-crt-convert-l1-1-0.dll	atoi, strtoul, strtoull, strtoll, strtol, strtod
api-ms-win-crt-locale-l1-1-0.dll	localeconv, _configthreadlocale
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strpbrk, strcspn, strcmp, strncmp, strncpy, strspn, isupper, tolower, _strdup
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _access, _unlink, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:56:50.144165039 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.144268036 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.144362926 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.175689936 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.175735950 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.653250933 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.653415918 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.654680014 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.654690981 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.654931068 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.657737017 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.703330994 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.826159000 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.826242924 CET	443	49715	104.26.1.5	192.168.2.6
Jan 14, 2025 16:56:50.826385975 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.841675043 CET	49715	443	192.168.2.6	104.26.1.5
Jan 14, 2025 16:56:50.841718912 CET	443	49715	104.26.1.5	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:56:50.114689112 CET	51570	53	192.168.2.6	1.1.1.1
Jan 14, 2025 16:56:50.121952057 CET	53	51570	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 16:56:50.114689112 CET	192.168.2.6	1.1.1.1	0xee40	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 16:56:50.121952057 CET	1.1.1.1	192.168.2.6	0xee40	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:56:50.121952057 CET	1.1.1.1	192.168.2.6	0xee40	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:56:50.121952057 CET	1.1.1.1	192.168.2.6	0xee40	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	104.26.1.5	443	5332	C:\Users\user\Desktop\EspPrivStoreAtt116.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 15:56:50 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 74 Content-Type: application/x-www-form-urlencoded
2025-01-14 15:56:50 UTC	74	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 32 2e 36 26 6e 61 6d 65 3d 4c 6f 61 64 65 72 20 50 72 69 6e 63 69 70 61 6c 20 7c 20 50 72 69 76 61 74 65 20 53 74 6f 72 65 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=2.6&name=Loader Principal \| Private Store&ownerid=9WIvTVJa9m
2025-01-14 15:56:50 UTC	1322	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 15:56:50 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 475 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bRIKiYnFrxRqhn8RnPPIGho621iAtCxT3YN5yqPtB0zsTrx60wSfdTJPElB0Ix2mWiSk9ymM1OZ%2FKaTsQ%2BY%2FxL2d9QBxRNz2KfmEBwuNEwkNNDbPMInDrio3fmSa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 901ed180fa0a728d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1988&min_rtt=1979&rtt_var=760&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2344&recv_bytes=862&delivery_rate=1422308&cwnd=234&unsent_bytes=0&cid=795d77640feb7203&ts=189&x=0"
2025-01-14 15:56:50 UTC	47	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 63 6f 64 65 22 3a 36 38 2c 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 69 74 69 61 6c 69 7a 65 Data Ascii: {"success":true,"code":68,"message":"Initialize
2025-01-14 15:56:50 UTC	428	IN	Data Raw: 64 22 2c 22 73 65 73 73 69 6f 6e 69 64 22 3a 22 38 38 66 33 31 34 34 32 22 2c 22 61 70 70 69 6e 66 6f 22 3a 7b 22 6e 75 6d 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4f 6e 6c 69 6e 65 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4b 65 79 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 36 22 2c 22 63 75 73 74 6f 6d 65 Data Ascii: d","sessionid":"88f31442","appinfo":{"numUsers":"N/A - Use fetchStats() function in latest example","numOnlineUsers":"N/A - Use fetchStats() function in latest example","numKeys":"N/A - Use fetchStats() function in latest example","version":"2.6","custome

Target ID:	0
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\EspPrivStoreAtt116.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EspPrivStoreAtt116.exe"
Imagebase:	0x7ff761660000
File size:	510'464 bytes
MD5 hash:	3653A466FFB4CCB78A2898A781DEA130
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:56:46
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff677fe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff677fe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 4784, Parent PID: 2496

General

Target ID:	15
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:56:47
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 964, Parent PID: 7064

General

Target ID:	17
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6504, Parent PID: 380

General

Target ID:	19
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 1596, Parent PID: 3700

General

Target ID:	21
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff677fe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6912, Parent PID: 4620

General

Target ID:	23
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff677fe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:56:48
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 5796, Parent PID: 5332

General

Target ID:	25
Start time:	10:56:49
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 4788, Parent PID: 5796

General

Target ID:	26
Start time:	10:56:49
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:56:49
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:56:49
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:56:49
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:56:49
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff606eb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:56:50
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:56:50
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff677fe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:56:50
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:56:50
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff677fe0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:56:50
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a5ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	100

Executed Functions

Function 00007FF76168FEA0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168FF78
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168FF85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690058
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616900DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690183
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169021A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616902E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169031D
strchr.VCRUNTIME140 ref: 00007FF761690497
strchr.VCRUNTIME140 ref: 00007FF7616904AA
strchr.VCRUNTIME140 ref: 00007FF7616904BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616905C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690633
memcpy.VCRUNTIME140 ref: 00007FF76169065A
strchr.VCRUNTIME140 ref: 00007FF76169066E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690682
strstr.VCRUNTIME140 ref: 00007FF7616908B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616909F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690B69

Part of subcall function 00007FF7616896C0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761689733

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690CA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690EFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690F10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761690F1F

Part of subcall function 00007FF761692270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922CA

strchr.VCRUNTIME140 ref: 00007FF7616914D7
strchr.VCRUNTIME140 ref: 00007FF7616914EA
strchr.VCRUNTIME140 ref: 00007FF7616914FC

Part of subcall function 00007FF761692270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922EA
Part of subcall function 00007FF761692270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922F3

strchr.VCRUNTIME140 ref: 00007FF76169174F
strchr.VCRUNTIME140 ref: 00007FF761691762
strchr.VCRUNTIME140 ref: 00007FF761691774

Part of subcall function 00007FF7616948A0: strchr.VCRUNTIME140 ref: 00007FF761694986
Part of subcall function 00007FF7616948A0: strchr.VCRUNTIME140 ref: 00007FF761694999
Part of subcall function 00007FF7616948A0: strchr.VCRUNTIME140 ref: 00007FF7616949AB

Strings

Cookie: , xrefs: 00007FF76169100E, 00007FF761691084
%s , xrefs: 00007FF761690C33
PUT, xrefs: 00007FF761690018
100-continue, xrefs: 00007FF761691516, 00007FF761691796
chunked, xrefs: 00007FF7616904D6
POST, xrefs: 00007FF761690025
Content-Length: 0, xrefs: 00007FF761691370
Range: bytes=%s, xrefs: 00007FF7616909FE
;type=%c, xrefs: 00007FF761690921
1.0, xrefs: 00007FF761690C00
If-Unmodified-Since, xrefs: 00007FF761691164
1.1, xrefs: 00007FF761690C0E
%s?%s, xrefs: 00007FF761690075
Accept-Encoding, xrefs: 00007FF7616902C1
0, xrefs: 00007FF7616918C6, 00007FF7616919C5
Host: %s%s%s:%d, xrefs: 00007FF761690782
Content-Type, xrefs: 00007FF761690387, 00007FF7616916BD
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF7616911F4
Last-Modified, xrefs: 00007FF76169115B
File already completely uploaded, xrefs: 00007FF761690B09
Accept-Encoding: %s, xrefs: 00007FF7616902F2
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF76169059C
Proxy-Connection: Keep-Alive, xrefs: 00007FF761690D9F, 00007FF761690DB4
Referer, xrefs: 00007FF761690233
Invalid TIMEVALUE, xrefs: 00007FF761691123
Transfer-Encoding: chunked, xrefs: 00007FF76169058F
Proxy-Connection, xrefs: 00007FF761690D73
Accept: */*, xrefs: 00007FF761690985
Content-Length, xrefs: 00007FF7616912B4, 00007FF761691409, 00007FF76169168E
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF761691A7E
Referer: %s, xrefs: 00007FF76169024E
GET, xrefs: 00007FF761690032
Content-Length: %I64d, xrefs: 00007FF7616912CB, 00007FF761691420, 00007FF7616916A5
Host:, xrefs: 00007FF761690691
If-Modified-Since, xrefs: 00007FF76169116D
Failed sending POST request, xrefs: 00007FF7616913A9, 00007FF7616915ED
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF761690EDB
%s%s=%s, xrefs: 00007FF761691029
Failed sending PUT request, xrefs: 00007FF761691349
multipart/form-data, xrefs: 00007FF7616903CA
ftp, xrefs: 00007FF761690889
http, xrefs: 00007FF76169081B
;type=, xrefs: 00007FF7616908AE
OPTIONS, xrefs: 00007FF76169000B
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF761690B84
%s, xrefs: 00007FF761691453
User-Agent, xrefs: 00007FF76169003D
Failed sending HTTP request, xrefs: 00007FF761691646
Expect, xrefs: 00007FF761691474, 00007FF7616916E9
HEAD, xrefs: 00007FF76168FFE1
Transfer-Encoding, xrefs: 00007FF76169042D
Host:%s, xrefs: 00007FF7616906C6
%s%s, xrefs: 00007FF7616910B0
Failed sending HTTP POST request, xrefs: 00007FF76169197B
Cookie, xrefs: 00007FF7616902A2
Range, xrefs: 00007FF7616909D2
Transfer-Encoding:, xrefs: 00007FF76169044E
Expect:, xrefs: 00007FF761691495, 00007FF76169170A
Content-Range, xrefs: 00007FF761690B4E
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF761690BA8
Host, xrefs: 00007FF7616905C9
Could not seek stream, xrefs: 00007FF761690A68
%x, xrefs: 00007FF761691875
?%s, xrefs: 00007FF761690D0B
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF7616916D1
Content-Range: bytes %s/%I64d, xrefs: 00007FF761690BB6
ftp://%s:%s@%s, xrefs: 00007FF761690CCB
Host: %s%s%s, xrefs: 00007FF76169073D
Could only read %I64d bytes from the input, xrefs: 00007FF761690B25
Accept, xrefs: 00007FF761690973

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 7e8127e7a02895129b677bbc6e0c7dd064ef2c4a8580cb0e4b3f39011db1f550
Instruction ID: d843f00b621e634b67af18595d11149e29e8ed71de342d2cc26c1f08be5aeced
Opcode Fuzzy Hash: 7e8127e7a02895129b677bbc6e0c7dd064ef2c4a8580cb0e4b3f39011db1f550
Instruction Fuzzy Hash: 1103D439A09683C2FB54AB2194083B9A7A7AF45F98FC444B5CE1D97795DFBCE841C320

Function 00007FF761671E40 Relevance: 124.5, APIs: 58, Strings: 13, Instructions: 288
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7616BFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7616643FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF7616BFB32

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761671EA4
_Thrd_detach.MSVCP140 ref: 00007FF761671ED3
GetStdHandle.KERNEL32 ref: 00007FF761671EEE
GetConsoleMode.KERNELBASE ref: 00007FF761671EFF
SetConsoleMode.KERNELBASE ref: 00007FF761671F12
GetStdHandle.KERNEL32 ref: 00007FF761671F1D
GetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF761671F34
SetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF761671F59
GetConsoleMode.KERNELBASE ref: 00007FF761671F67
SetConsoleMode.KERNELBASE ref: 00007FF761671F7B
GetConsoleWindow.KERNELBASE ref: 00007FF761671F81
GetWindowLongA.USER32 ref: 00007FF761671F92
SetWindowLongA.USER32 ref: 00007FF761671FA8
GetConsoleWindow.KERNELBASE ref: 00007FF761671FAE
GetWindowRect.USER32 ref: 00007FF761671FBF
MoveWindow.USER32 ref: 00007FF761671FE7
GetStdHandle.KERNEL32 ref: 00007FF761671FF2
SetConsoleTextAttribute.KERNELBASE ref: 00007FF761672000
GetStdHandle.KERNEL32 ref: 00007FF761672017
SetConsoleTextAttribute.KERNELBASE ref: 00007FF761672025
GetStdHandle.KERNEL32 ref: 00007FF761672048
SetConsoleTextAttribute.KERNELBASE ref: 00007FF761672056
GetStdHandle.KERNEL32 ref: 00007FF76167206D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF76167207B

Part of subcall function 00007FF761672380: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7616723A4
Part of subcall function 00007FF761672380: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7616723C5

GetStdHandle.KERNEL32 ref: 00007FF761672092
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7616720A0
GetStdHandle.KERNEL32 ref: 00007FF7616720B7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7616720C5
GetStdHandle.KERNEL32 ref: 00007FF7616720DC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7616720EA
GetStdHandle.KERNEL32 ref: 00007FF761672101
SetConsoleTextAttribute.KERNEL32 ref: 00007FF76167210F
GetStdHandle.KERNEL32 ref: 00007FF761672132
SetConsoleTextAttribute.KERNEL32 ref: 00007FF761672140
GetStdHandle.KERNEL32 ref: 00007FF761672157
SetConsoleTextAttribute.KERNEL32 ref: 00007FF761672165
GetStdHandle.KERNEL32 ref: 00007FF76167217C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF76167218A
GetStdHandle.KERNEL32 ref: 00007FF7616721AD
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7616721BB
GetStdHandle.KERNEL32 ref: 00007FF7616721D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7616721E0
GetStdHandle.KERNEL32 ref: 00007FF7616721F7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF761672205
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF761672223
URLDownloadToFileA.URLMON ref: 00007FF76167227A
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672286
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672293
Sleep.KERNEL32 ref: 00007FF76167229E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616722A6
URLDownloadToFileA.URLMON ref: 00007FF7616722FA
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672306
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672313
Sleep.KERNEL32 ref: 00007FF76167231E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672326
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672334
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF761672363
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF761672372

Strings

##########################################################, xrefs: 00007FF761672081
cd C:\, xrefs: 00007FF76167227F, 00007FF7616722FF
Selecione a opcao: , xrefs: 00007FF76167220B
C:\Windows\System32\config\SeieHuSttinstialog.exe, xrefs: 00007FF761672243
http://167.114.85.75/esphvcionattprivatestore655.exe, xrefs: 00007FF7616722B2
C:\Windows\System32\config\SeuetingsHostialog.exe, xrefs: 00007FF7616722C4
[ Selecione uma opcao: ], xrefs: 00007FF76167205C
Iniciar Valorant ESP (HVCI DESLIGADO): , xrefs: 00007FF761672115
http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe, xrefs: 00007FF761672232
start C:\Windows\System32\config\SeieHuSttinstialog.exe, xrefs: 00007FF76167228C
Iniciar Valorant ESP (HVCI HABILITADO): , xrefs: 00007FF761672190
start C:\Windows\System32\config\SeuetingsHostialog.exe, xrefs: 00007FF76167230C
##########################################################, xrefs: 00007FF761672037

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Console$Handle$AttributeText$Window$Modesystem$BufferCpp_error@std@@DownloadFileInfoLongScreenSleepThrow_exit$??5?$basic_istream@D@std@@@std@@MoveRectThrd_detachU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintf_beginthreadexmallocterminate
String ID: Iniciar Valorant ESP (HVCI DESLIGADO): $ Iniciar Valorant ESP (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$C:\Windows\System32\config\SeieHuSttinstialog.exe$C:\Windows\System32\config\SeuetingsHostialog.exe$[ Selecione uma opcao: ]$cd C:\$http://167.114.85.75/esphvcioffbronkzatualizadoh96.exe$http://167.114.85.75/esphvcionattprivatestore655.exe$start C:\Windows\System32\config\SeieHuSttinstialog.exe$start C:\Windows\System32\config\SeuetingsHostialog.exe
API String ID: 3379756739-2736027526
Opcode ID: 9abfdb24af27c364c05fce46bb45a461b28bc0d03db9979f1f9b716173312d08
Instruction ID: bc6779b6be51cd6e9f776d340b0ce282fe52e79c4a202a08c80c38e4c2aaf495
Opcode Fuzzy Hash: 9abfdb24af27c364c05fce46bb45a461b28bc0d03db9979f1f9b716173312d08
Instruction Fuzzy Hash: 8FD13C29A08A43C2EB04BB70E8581B9B363FF84F55F805239D91E476A5DFBCE545CB60

Function 00007FF76169A84D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF76169A9A8
strchr.VCRUNTIME140 ref: 00007FF76169A9D4
strchr.VCRUNTIME140 ref: 00007FF76169AA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169AA32
strchr.VCRUNTIME140 ref: 00007FF76169AB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169AB5A

Strings

LocalMachine, xrefs: 00007FF76169AA63
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF76169ADE9
LocalMachineGroupPolicy, xrefs: 00007FF76169AAFC
Users, xrefs: 00007FF76169AAC6
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF76169AA47
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF76169AFC5
LocalMachineEnterprise, xrefs: 00007FF76169AB1B
schannel: Failed to read cert file %s, xrefs: 00007FF76169AF09
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF76169AF32
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF76169ABC0
schannel: unable to allocate memory, xrefs: 00007FF76169AECC, 00007FF76169B157
CurrentUserGroupPolicy, xrefs: 00007FF76169AADD
http/1.1, xrefs: 00007FF76169B077
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF76169A8DB
CurrentUser, xrefs: 00007FF76169AA22
schannel: ALPN, offering %s, xrefs: 00007FF76169B085
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF76169AE5F
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF76169B043
CurrentService, xrefs: 00007FF76169AA85
Microsoft Unified Security Protocol Provider, xrefs: 00007FF76169AF4F
Services, xrefs: 00007FF76169AAA7
http/1.1, xrefs: 00007FF76169B063
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF76169AE14

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 09f11b705b111533f350ffdec44febe4a985be7e643573be8f285361bd15042f
Instruction ID: 9c50638306d46857d0268cb400b1d2407856257386ec343420010d8b2621f79f
Opcode Fuzzy Hash: 09f11b705b111533f350ffdec44febe4a985be7e643573be8f285361bd15042f
Instruction Fuzzy Hash: CD42B229A08743C2EB54AF25E8586B9A3A2FF44F98F805535CE4D477A4DFBCE944C720

Function 00007FF761689290 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF7616892B8
WSACleanup.WS2_32 ref: 00007FF7616892D3
GetModuleHandleA.KERNEL32 ref: 00007FF761689324
GetProcAddress.KERNEL32 ref: 00007FF761689350
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168936A
LoadLibraryA.KERNEL32 ref: 00007FF76168938D
GetProcAddress.KERNEL32 ref: 00007FF7616893AA
LoadLibraryExA.KERNELBASE ref: 00007FF7616893C0
GetSystemDirectoryA.KERNEL32 ref: 00007FF7616893D6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616893EE
GetSystemDirectoryA.KERNEL32 ref: 00007FF761689402
LoadLibraryA.KERNEL32 ref: 00007FF761689470
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168947C
GetProcAddress.KERNEL32 ref: 00007FF7616894A8
VerSetConditionMask.KERNEL32 ref: 00007FF761689531
VerSetConditionMask.KERNEL32 ref: 00007FF761689544
VerSetConditionMask.KERNEL32 ref: 00007FF761689553
VerSetConditionMask.KERNEL32 ref: 00007FF761689562
VerSetConditionMask.KERNEL32 ref: 00007FF761689572
VerifyVersionInfoA.KERNEL32 ref: 00007FF761689583
QueryPerformanceFrequency.KERNEL32 ref: 00007FF76168959F

Strings

if_nametoindex, xrefs: 00007FF76168949E
LoadLibraryExA, xrefs: 00007FF76168933E
kernel32, xrefs: 00007FF76168930B
AddDllDirectory, xrefs: 00007FF7616893A0
iphlpapi.dll, xrefs: 00007FF761689356

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: d5f8afb19f8e867eb35e557aec29fe9135a7589b51aca80395dda82625a2e322
Instruction ID: d6e52887fbac55937f54ddcf70cbec235c45a6864366db99e0ab2e6938c02c3a
Opcode Fuzzy Hash: d5f8afb19f8e867eb35e557aec29fe9135a7589b51aca80395dda82625a2e322
Instruction Fuzzy Hash: 62919529E09782C6E760AB25A4183B9B3A2FFC9F84F845135DD4E06B54DFBCE445C720

Function 00007FF7616885D0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF76168866C
socket.WS2_32 ref: 00007FF7616886B5
htons.WS2_32 ref: 00007FF761688741
setsockopt.WS2_32 ref: 00007FF7616887A3
WSAGetLastError.WS2_32 ref: 00007FF7616887AD
getsockopt.WS2_32 ref: 00007FF76168884F
setsockopt.WS2_32 ref: 00007FF76168887E
setsockopt.WS2_32 ref: 00007FF7616888BD
WSAIoctl.WS2_32 ref: 00007FF76168894A
WSAGetLastError.WS2_32 ref: 00007FF761688954

Part of subcall function 00007FF7616955A0: ioctlsocket.WS2_32 ref: 00007FF7616955B9

Part of subcall function 00007FF76168E0C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF76167613F), ref: 00007FF76168E0D7

connect.WS2_32 ref: 00007FF761688A7B
WSAGetLastError.WS2_32 ref: 00007FF761688A98

Part of subcall function 00007FF761672E10: GetLastError.KERNEL32 ref: 00007FF761672E32
Part of subcall function 00007FF761672E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672E3A

Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686525
Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686540

Part of subcall function 00007FF761686EE0: closesocket.WS2_32 ref: 00007FF761686F23

Strings

@, xrefs: 00007FF7616887E7
Could not set TCP_NODELAY: %s, xrefs: 00007FF7616887CA
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF7616888CA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF761688B3E
Immediate connect fail for %s: %s, xrefs: 00007FF761688AC8
Trying %s:%ld..., xrefs: 00007FF76168874F
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF76168895D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: de3b46a8bcf3fcc4f767d070f4b593ecd4b5ea27a084392ca60be2966fd7f509
Instruction ID: e83eb01eb975ef337939b8d125f592fb951a2d89219c7e225c3c8b174c2f75c1
Opcode Fuzzy Hash: de3b46a8bcf3fcc4f767d070f4b593ecd4b5ea27a084392ca60be2966fd7f509
Instruction Fuzzy Hash: E7F1E479A08282C6E790EB25D4582BDA3A6FB84F58FC04035DE4D47BA4DFBCE545DB20

Function 00007FF761695370 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF7616953B1
htonl.WS2_32 ref: 00007FF7616953DE
setsockopt.WS2_32 ref: 00007FF761695415
bind.WS2_32 ref: 00007FF761695430
getsockname.WS2_32 ref: 00007FF76169544C
listen.WS2_32 ref: 00007FF761695461
socket.WS2_32 ref: 00007FF761695478
connect.WS2_32 ref: 00007FF761695497
accept.WS2_32 ref: 00007FF7616954AE
send.WS2_32 ref: 00007FF7616954FC
recv.WS2_32 ref: 00007FF76169551A
memcmp.VCRUNTIME140 ref: 00007FF761695535
closesocket.WS2_32 ref: 00007FF761695541

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: bd23299a83aadd02f23714b29ccd78fc92ed2d7b1aeddd9ecbc35c72079cd919
Instruction ID: 888d1e9666edddaf82229d9f4a894102ee64fb5b4b2b60100f9a0df3d66633d7
Opcode Fuzzy Hash: bd23299a83aadd02f23714b29ccd78fc92ed2d7b1aeddd9ecbc35c72079cd919
Instruction Fuzzy Hash: E0518F35608A42C2DB10AF25E458169B362EB85FB4FD05735EA7A43AE4DFBCD849CB10

Function 00007FF761687290 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to connect to %s port %ld: %s, xrefs: 00007FF7616877BE
Connection failed, xrefs: 00007FF761687676
After %I64dms connect time, move on!, xrefs: 00007FF761687455
Connection time-out, xrefs: 00007FF761687379
connect to %s port %ld failed: %s, xrefs: 00007FF76168750D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: 6ca6dc91ff338b192881d778bbf1bc3204aefb4b879638f902b09656aff86762
Instruction ID: f57e240b79dc6263e1bd07bfdf97039424884bc1da09a08a7a73e104bbaab9c1
Opcode Fuzzy Hash: 6ca6dc91ff338b192881d778bbf1bc3204aefb4b879638f902b09656aff86762
Instruction Fuzzy Hash: 58E1E22AB086C2C2EB94AB2594482BDA762FB85F94F804235DF5D07BD5DFBCE541C720

Function 00007FF761671AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7616708F0: memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7616611FA), ref: 00007FF761670928

SleepEx.KERNELBASE ref: 00007FF761671C5F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761671CD3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761671D14
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761671D4C

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789, xrefs: 00007FF761671AF9
PRIVATE STORE - , xrefs: 00007FF761671C7B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Sleepmemcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$PRIVATE STORE -
API String ID: 18138616-2486835083
Opcode ID: 8aa7920c36d96e8ea77809a8d8df4f49feeafd954a798cd6ce7502069d1b875f
Instruction ID: c79d8872a67a2b173db9d697fa3e5f546769af52e260991d61ab861dc3373227
Opcode Fuzzy Hash: 8aa7920c36d96e8ea77809a8d8df4f49feeafd954a798cd6ce7502069d1b875f
Instruction Fuzzy Hash: EC81F636B28681C6EB10EB25E4542BDA363FB85B94F905336EA5D43AD5DFBCD081CB10

Function 00007FF761662AB0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616628B7
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662927
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662987
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616629D7
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662A27

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662C58

Part of subcall function 00007FF7616648D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761664990

Part of subcall function 00007FF7616BFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7616643FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF7616BFB32

Part of subcall function 00007FF761664320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662CA8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662CE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662D35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662D74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662E28
memcpy.VCRUNTIME140 ref: 00007FF761662E4D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662F23
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662F6A
ShellExecuteA.SHELL32 ref: 00007FF761663062
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166306A
MessageBoxA.USER32 ref: 00007FF7616630A0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616630B1
Sleep.KERNEL32 ref: 00007FF761663119
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761663121
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF761663128

Part of subcall function 00007FF761663170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166327F
Part of subcall function 00007FF761663170: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616632C0

Part of subcall function 00007FF761663C40: memcpy.VCRUNTIME140 ref: 00007FF761663C93

Part of subcall function 00007FF7616632E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616633C0

Part of subcall function 00007FF7616633E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616634C0

Strings

Failure, xrefs: 00007FF761663097
invalidver, xrefs: 00007FF761662FE9
sessionid, xrefs: 00007FF761662EAE
open, xrefs: 00007FF761663059
download, xrefs: 00007FF761663025
success, xrefs: 00007FF761662E86
message, xrefs: 00007FF761662FB3, 00007FF761663071

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 5f9bf25ff3b757e267bd3f1163830185a6916ff23d5462c6ab610eb15cca5687
Instruction ID: 223ff00c58558ad8dd1f96630579c680f0bb9cff31f785d3374434e40413ec90
Opcode Fuzzy Hash: 5f9bf25ff3b757e267bd3f1163830185a6916ff23d5462c6ab610eb15cca5687
Instruction Fuzzy Hash: 3E02E566A08782C5EB00EB34E4583ADB772FB45B94F805235DA5D13ADADFBCD484C391

Function 00007FF76169BED0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF76169C511
memcpy.VCRUNTIME140 ref: 00007FF76169C52D

Strings

schannel: failed to decrypt data, need more data, xrefs: 00007FF76169C43A
schannel: remote party requests renegotiation, xrefs: 00007FF76169C2F2
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF76169BF75
schannel: server indicated shutdown in a prior call, xrefs: 00007FF76169BF98
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF76169C4B2
schannel: can't renogotiate, an error is pending, xrefs: 00007FF76169C492
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF76169C328
schannel: failed to read data from server: %s, xrefs: 00007FF76169C462
schannel: enough decrypted data is already available, xrefs: 00007FF76169BF55
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF76169C36F
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF76169C4BE
schannel: unable to re-allocate memory, xrefs: 00007FF76169C00D, 00007FF76169C476
schannel: server closed the connection, xrefs: 00007FF76169C3A4
schannel: renegotiation failed, xrefs: 00007FF76169C49E
schannel: Curl_read_plain returned error %d, xrefs: 00007FF76169C271
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF76169C09D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 506055b4939d1d26318f95a523fa89b46b0c6926f7bc8d932d50e9497e368427
Instruction ID: 56fb50fe9b11d0d98674989a6d14e4a284e94a09ada37bbab652fae73d870c34
Opcode Fuzzy Hash: 506055b4939d1d26318f95a523fa89b46b0c6926f7bc8d932d50e9497e368427
Instruction Fuzzy Hash: 9B02F476A08A86C6EB50EB09D4483BDB7A6FB44F98F904576CE4E47790CFB8D841CB10

Function 00007FF76169B360 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169B450
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169B4A1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169B4E4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169B5C7
memcpy.VCRUNTIME140 ref: 00007FF76169B669
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169B6D2
memcpy.VCRUNTIME140 ref: 00007FF76169B7AA
memset.VCRUNTIME140 ref: 00007FF76169B977
CertFreeCertificateContext.CRYPT32 ref: 00007FF76169B9DA

Strings

schannel: unable to re-allocate memory, xrefs: 00007FF76169B4F2
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF76169BA1A
schannel: SNI or certificate check failed: %s, xrefs: 00007FF76169B83B
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF76169B86E, 00007FF76169BA82
SSL: public key does not match pinned public key!, xrefs: 00007FF76169B9BC, 00007FF76169B9E4
SSL: failed retrieving public key from server certificate, xrefs: 00007FF76169B9FA
schannel: unable to allocate memory, xrefs: 00007FF76169BACF
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF76169B884
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF76169B7D6

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 2c59ebb9b7ce04f204d0f2e7e6934fe0e351c55ed42fde726f7516aa0871ad94
Instruction ID: a277da9c358bcbbc401f40b9cf7e18f58b5c7d0404fe95f59c08abb048b66178
Opcode Fuzzy Hash: 2c59ebb9b7ce04f204d0f2e7e6934fe0e351c55ed42fde726f7516aa0871ad94
Instruction Fuzzy Hash: 3612713AA08A82C6EB60DF19D8587ADB3A2FB44F98F904536CA4D47794DFB8D845C710

Function 00007FF76169A580 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF76169A651
GetProcAddress.KERNEL32 ref: 00007FF76169A661

Strings

schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF76169B21C, 00007FF76169B263
wine_get_version, xrefs: 00007FF76169A65A
schannel: SNI or certificate check failed: %s, xrefs: 00007FF76169B23D
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF76169B2F9
schannel: unable to allocate memory, xrefs: 00007FF76169B157
http/1.1, xrefs: 00007FF76169B077
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF76169A6F2
schannel: ALPN, offering %s, xrefs: 00007FF76169B085
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF76169B043
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF76169A632
ntdll, xrefs: 00007FF76169A64A
http/1.1, xrefs: 00007FF76169B063
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF76169AFFF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 5cf0ed48395b8395c8a13ee8555a2877c0ae128489894efa4f1ca97764d42106
Instruction ID: 9ea2a50c2c1269c37429e3117f1d48a5aed2139470a14e23ced205cd349c8ab1
Opcode Fuzzy Hash: 5cf0ed48395b8395c8a13ee8555a2877c0ae128489894efa4f1ca97764d42106
Instruction Fuzzy Hash: AC02D23AA08B82C6EB50AF25D8582FEB7A6FB44B88F804535DA5D47790DFB8D944C710

Function 00007FF76167BBC0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BBF2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BC8D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF76167BCA6

Part of subcall function 00007FF761695370: socket.WS2_32 ref: 00007FF7616953B1

DeleteCriticalSection.KERNEL32 ref: 00007FF76167BCE0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BCEA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BCF4
closesocket.WS2_32 ref: 00007FF76167BD12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BD48
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76167BD4E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167BD7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BD97
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167BDA0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76167BDD5
EnterCriticalSection.KERNEL32 ref: 00007FF76167BDF6
LeaveCriticalSection.KERNEL32 ref: 00007FF76167BE0A
CloseHandle.KERNEL32 ref: 00007FF76167BE17
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BE42
closesocket.WS2_32 ref: 00007FF76167BE5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BE6F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 98ff7efcc35b3caf98631185ed50eeb00e79665cefe7d7535eea2b1d5459b9c6
Instruction ID: ceb67a2c9759efebc77e854bda16457e288ca99d15bc9ed411b726dd63f8afa2
Opcode Fuzzy Hash: 98ff7efcc35b3caf98631185ed50eeb00e79665cefe7d7535eea2b1d5459b9c6
Instruction Fuzzy Hash: 5D815C2AD05B81C6E724EF21E458269B361FB99B54F449235DF9E037A2DFB8E4E4C310

Function 00007FF761683230 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

No more connections allowed to host %s: %zu, xrefs: 00007FF7616839C2
host, xrefs: 00007FF761683900
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF761683AB0
proxy, xrefs: 00007FF7616838F2
No connections available., xrefs: 00007FF7616839D1
anonymous, xrefs: 00007FF7616833E8
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF761683A82
ftp@example.com, xrefs: 00007FF7616833EF
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF761683913
No connections available in cache, xrefs: 00007FF761683C2B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 333162b9d2a570b1709d695479fe2e93abb5950393d2aa8a7880023664a13f02
Instruction ID: a03c76c2aaa396ab059a4ded56d397d1c57ade1aacc75461c293472f9c5cbfd7
Opcode Fuzzy Hash: 333162b9d2a570b1709d695479fe2e93abb5950393d2aa8a7880023664a13f02
Instruction Fuzzy Hash: 9042C46AA09BC2D1EB99EB2595483B8A392FB45F84F844135CE5D47B85DFBCE060C330

Function 00007FF761688F70 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF7616B2DCA,?,?,?,?,00007FF7616892FB), ref: 00007FF761688F84
GetProcAddress.KERNEL32(?,?,00007FF7616B2DCA,?,?,?,?,00007FF7616892FB), ref: 00007FF761688FA9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF7616B2DCA,?,?,?,?,00007FF7616892FB), ref: 00007FF761688FBC

Strings

LoadLibraryExA, xrefs: 00007FF761688F9A
kernel32, xrefs: 00007FF761688F7D
AddDllDirectory, xrefs: 00007FF761689003

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: a3bf490c5095baffb162cfe67ac90165bb99800fd7677d2cde9ff42bc9170434
Instruction ID: f79fe7367ee19b5df4763aebaada426e6deab90397de02b4a4b94633f0f57fc0
Opcode Fuzzy Hash: a3bf490c5095baffb162cfe67ac90165bb99800fd7677d2cde9ff42bc9170434
Instruction Fuzzy Hash: 6C41E51AB09642C6FB55AF26A518138A792EF86FD5F888138CF0D07B90DE7DD486C730

Function 00007FF761687C10 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF761687C7C
WSAGetLastError.WS2_32 ref: 00007FF761687C86

Part of subcall function 00007FF761672E10: GetLastError.KERNEL32 ref: 00007FF761672E32
Part of subcall function 00007FF761672E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672E3A

getsockname.WS2_32 ref: 00007FF761687D06
WSAGetLastError.WS2_32 ref: 00007FF761687D10

Strings

ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF761687E2C
getpeername() failed with errno %d: %s, xrefs: 00007FF761687CA6
getsockname() failed with errno %d: %s, xrefs: 00007FF761687D30
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF761687D96

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 4e6bea4614707d1fdfe342ad5f7c7d8b18d1e85eb23cc2e6cd7b7f77dbf280fa
Instruction ID: 1515addb6a9f6107f23d339719a13d973a876c6789b1ad2ab62e581c02da527b
Opcode Fuzzy Hash: 4e6bea4614707d1fdfe342ad5f7c7d8b18d1e85eb23cc2e6cd7b7f77dbf280fa
Instruction Fuzzy Hash: AA919E2AA18BC1C2D750DF25D4582E9B3A1FB98F88F849236DE4C47755DF78E185CB20

Function 00007FF761698FE0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF761699002
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169906E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF7616990A8
memcpy.VCRUNTIME140(?,?,?,00007FF76167BB05), ref: 00007FF7616990C1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF7616990CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169910A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF761699113
freeaddrinfo.WS2_32(?,?,?,00007FF76167BB05), ref: 00007FF761699141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF761699155
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169915F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169916C
WSASetLastError.WS2_32(?,?,?,00007FF76167BB05), ref: 00007FF76169918D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 92f1dd02e77ef6866300f81a3e7edaadc0e4f6ac73d95d5bcc1c9b54f38ed787
Instruction ID: 85579d8d907b5168c903385f4e93a02ac8fc3973fa9721bf865088dd9b96d8a6
Opcode Fuzzy Hash: 92f1dd02e77ef6866300f81a3e7edaadc0e4f6ac73d95d5bcc1c9b54f38ed787
Instruction Fuzzy Hash: 5E516D79A09B42C7EB64AF11A518139E7A2FB48F98F844439CE9E13750CF7CE855C720

Function 00007FF7616968F0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF76169694D
Sleep.KERNEL32 ref: 00007FF76169695E
WSASetLastError.WS2_32 ref: 00007FF761696AC8
Sleep.KERNEL32 ref: 00007FF761696AD9
__WSAFDIsSet.WS2_32 ref: 00007FF761696B8C
__WSAFDIsSet.WS2_32 ref: 00007FF761696BA3
__WSAFDIsSet.WS2_32 ref: 00007FF761696BBE
__WSAFDIsSet.WS2_32 ref: 00007FF761696BD2
__WSAFDIsSet.WS2_32 ref: 00007FF761696BED
__WSAFDIsSet.WS2_32 ref: 00007FF761696C01

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 3eaa5cdda63adafe87d7bc7021b97494535538da4074dd7caebf54caf0cff9b4
Instruction ID: f1f10ac66bc207e584e2723e922f96e32f574cdbd2fa31c9b8d5b4d09c739ff9
Opcode Fuzzy Hash: 3eaa5cdda63adafe87d7bc7021b97494535538da4074dd7caebf54caf0cff9b4
Instruction Fuzzy Hash: C6911A69B0C7C3C7EB246E2998582B9E292FB44B54FD04535ED1E86BC8DFBCDD018650

Function 00007FF761685800 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168584F

Strings

Unix socket path too long: '%s', xrefs: 00007FF7616858A6
Couldn't resolve host '%s', xrefs: 00007FF761685981
Couldn't resolve proxy '%s', xrefs: 00007FF761685A2C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 94f586bf51bbcc24e5a36e66b485c0dbac251b6b1e579bd488a4af3d2ed01ea2
Instruction ID: 8098feaa23313b90b5698a207af2ecf6c62864be76518dac0ace6557a1db7d5d
Opcode Fuzzy Hash: 94f586bf51bbcc24e5a36e66b485c0dbac251b6b1e579bd488a4af3d2ed01ea2
Instruction Fuzzy Hash: 9251C42AA0CB82C2FB99AB259494379E692EB84B94F940035DF4E43B90DF7CE455C730

Function 00007FF761662850 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616628B7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662927
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662987
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616629D7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662A27
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662A98

Strings

.8, xrefs: 00007FF761662A75
h%49, xrefs: 00007FF761662A6E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 5e185ff44131f8ffb292aacd92914df2fb238af3a598180558577508194563da
Instruction ID: 683a6ece0f980bae4a78c92d2a372523a15b928ef5d16ef2a585747d07639118
Opcode Fuzzy Hash: 5e185ff44131f8ffb292aacd92914df2fb238af3a598180558577508194563da
Instruction Fuzzy Hash: 6A616D26E187D6C9F301DB78E8091BCB772BB99B48F805378CEC965A15EFB85148C364

Function 00007FF7616C01EC Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7616C0215
__scrt_release_startup_lock.LIBCMT ref: 00007FF7616C0283
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616C02D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616C02D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616C02DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616C02E6
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616C0308
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616C0362

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: de375b220b439a9c4fbc24da6c3cfafd4a664fed8df3b2246a19f881dec74204
Instruction ID: 39ef8531b7474a0d4be813eb34413aaa47f6c39abb9bd468e3cfea371415c1e2
Opcode Fuzzy Hash: de375b220b439a9c4fbc24da6c3cfafd4a664fed8df3b2246a19f881dec74204
Instruction Fuzzy Hash: 9A311D6DA0C243C2FB54BB65D45D3BAE293AF44F84FC45035E94D8B2D3DEADA444CA60

Function 00007FF76167BAB0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761698FE0: getaddrinfo.WS2_32 ref: 00007FF761699002
Part of subcall function 00007FF761698FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169906E
Part of subcall function 00007FF761698FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF7616990A8
Part of subcall function 00007FF761698FE0: memcpy.VCRUNTIME140(?,?,?,00007FF76167BB05), ref: 00007FF7616990C1
Part of subcall function 00007FF761698FE0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF7616990CF
Part of subcall function 00007FF761698FE0: freeaddrinfo.WS2_32(?,?,?,00007FF76167BB05), ref: 00007FF761699141
Part of subcall function 00007FF761698FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF761699155
Part of subcall function 00007FF761698FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169915F
Part of subcall function 00007FF761698FE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167BB05), ref: 00007FF76169916C

WSAGetLastError.WS2_32 ref: 00007FF76167BB0B
WSAGetLastError.WS2_32 ref: 00007FF76167BB15
EnterCriticalSection.KERNEL32 ref: 00007FF76167BB30
LeaveCriticalSection.KERNEL32 ref: 00007FF76167BB3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167BB50
send.WS2_32 ref: 00007FF76167BB73
WSAGetLastError.WS2_32 ref: 00007FF76167BB7D
LeaveCriticalSection.KERNEL32 ref: 00007FF76167BB90

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 42967842f68ceaa853a16063dead967f6bbf823a8214e1f46a4740f52b57b5c3
Instruction ID: 9ff24136a2c2d5fe376fa34484bdf6ee417e5fb246f968359f98c11eb1e52fd3
Opcode Fuzzy Hash: 42967842f68ceaa853a16063dead967f6bbf823a8214e1f46a4740f52b57b5c3
Instruction Fuzzy Hash: 26317636A08642C1E750EF35E45827AB3A1FF84F98F805135DA5E836A8DFBCD445C750

Function 00007FF761696550 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7616965B6
WSASetLastError.WS2_32 ref: 00007FF761696776
Sleep.KERNEL32 ref: 00007FF761696786
__WSAFDIsSet.WS2_32 ref: 00007FF76169689A
__WSAFDIsSet.WS2_32 ref: 00007FF7616968B2
Sleep.KERNEL32 ref: 00007FF7616968DD

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: cfc8ec446ff317ecc00fd428b9dae46fb424ecc2b66ae7b6bce6886c4fe073b3
Instruction ID: 1fd47aa5ffc9fdb58f4485c7f8db62f613e1f599ea05449f523bc468ee48d7a1
Opcode Fuzzy Hash: cfc8ec446ff317ecc00fd428b9dae46fb424ecc2b66ae7b6bce6886c4fe073b3
Instruction Fuzzy Hash: 3CA14B39B187D3C3EB696A249408279A296FF44FA4F804635ED1E4A7C4DFBCDC0087A0

Function 00007FF7616997C0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616999EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761699A2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761699A57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761699A99

Strings

schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF7616999B3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF76169983E
schannel: ApplyControlToken failure: %s, xrefs: 00007FF7616998C8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: fcdcb546c2ff38549d5665a737929d8b34cdd20e5421ad5796662c5f6d9b2a83
Instruction ID: be9edefcff60d18fe843b3933adbb8c7266c1628f926bbef6041549ee7abf8d3
Opcode Fuzzy Hash: fcdcb546c2ff38549d5665a737929d8b34cdd20e5421ad5796662c5f6d9b2a83
Instruction Fuzzy Hash: 1691583AA08F82C6EB109F26E8586ADB7A5FB84F88F840535CE4C47764DF78D455CB10

Function 00007FF76169C5A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169C63E
memcpy.VCRUNTIME140 ref: 00007FF76169C6D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169C80C

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF76169C7D4
select/poll on SSL socket, errno: %d, xrefs: 00007FF76169C7B4

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 15afd01cc10f0f667c3f5a3174878e9689908f63161baae8e2ae478f917debe8
Instruction ID: 16cfe9fd48550e41f4bb45d990886313c1d4c413bc21b3af2ed998160f15a71c
Opcode Fuzzy Hash: 15afd01cc10f0f667c3f5a3174878e9689908f63161baae8e2ae478f917debe8
Instruction Fuzzy Hash: 7171BD7AB08B42CAEB10DB65D4146AD73A2FB48BA8F404635DE2E477C4EF78E406C350

Function 00007FF761677610 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167765E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761677675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616777A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616777CE

Strings

%s, xrefs: 00007FF7616778D7
Connection #%ld to host %s left intact, xrefs: 00007FF76167788B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: e91a0139a46916ed625c7b167e581e5f61640a50a9e451340a2a8c6e17119c8f
Instruction ID: 6939cbd979abdaa072c135b3fd944d666c366229cf01369d4a9b679337f98d5b
Opcode Fuzzy Hash: e91a0139a46916ed625c7b167e581e5f61640a50a9e451340a2a8c6e17119c8f
Instruction Fuzzy Hash: 1F91703AB18682C2E758BB25D54C3B9A3A2FB45F84F844435DE5E07695CFB8E460C760

Function 00007FF761681AA0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761681ACB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761681AE1

Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616818FD
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168191A
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168192E
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168194A
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681967
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168198A
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168199E
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616819B2
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616819D8
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616819EC
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A00
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A4F
Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A5C

Part of subcall function 00007FF761681880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A85

memset.VCRUNTIME140 ref: 00007FF761681B15

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF761681CF1
User-Agent: %s, xrefs: 00007FF761681BAF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: cbfb84e7a1472e2dc6d1eeab6a04b2804bc59b0f2f042e7c9ebc47c7a51ee133
Instruction ID: 1f8f20b07f77147341fb80e47e01e27c0ea970dede5e69ecce233e9977904345
Opcode Fuzzy Hash: cbfb84e7a1472e2dc6d1eeab6a04b2804bc59b0f2f042e7c9ebc47c7a51ee133
Instruction Fuzzy Hash: 9871906AA0CAC2C5E791EF2590183BDA762EB81F94F884131DA6D4B685DFBCE551C330

Function 00007FF761692020 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616920B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616920C1
memcpy.VCRUNTIME140 ref: 00007FF7616920DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169223C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761692245

Strings

1.1, xrefs: 00007FF76169202F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 1c4f9d8f6cc8ea222318239ae0d0b33bff5049adf4c60fe77cde5224e2d48f34
Instruction ID: cc3ac096b4fac63bc3457d15a6714998966cb143ff1499db940cbd9b830eb7f8
Opcode Fuzzy Hash: 1c4f9d8f6cc8ea222318239ae0d0b33bff5049adf4c60fe77cde5224e2d48f34
Instruction Fuzzy Hash: BE519E7A608B82C6DB689F22E8443AAA3A1FB48F84F848475CF9E47754CF7CE455C310

Function 00007FF7616867E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616868A6
recv.WS2_32 ref: 00007FF7616868D0
send.WS2_32 ref: 00007FF7616868F3
WSAGetLastError.WS2_32 ref: 00007FF761686905

Strings

Send failure: %s, xrefs: 00007FF761686935

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: a5ce54b1df877b377e05a55ce1a3bd729fb743bbe0ebbe527092706ffc3e8082
Instruction ID: 3539dba6bd503b5edcdb128609daa410cfadfb268bd9715ebe411f3bfcf44cff
Opcode Fuzzy Hash: a5ce54b1df877b377e05a55ce1a3bd729fb743bbe0ebbe527092706ffc3e8082
Instruction Fuzzy Hash: 9141C4BAB15781C5EBA0AF25E818779A392BB08FA8F854135CE5D47784DF7CD454C320

Function 00007FF761678708 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761678858
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167889F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616788CA

Part of subcall function 00007FF761677610: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167765E
Part of subcall function 00007FF761677610: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761677675

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616788FF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF761677C46

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 10657737ca2f4763c17a4a63984ea63c382b0e81ced8098d2d3c6f5d42afd508
Instruction ID: 329433f9daeb63caba2f52a5207c15e8cd16bc39687e693d709305304e84e617
Opcode Fuzzy Hash: 10657737ca2f4763c17a4a63984ea63c382b0e81ced8098d2d3c6f5d42afd508
Instruction Fuzzy Hash: 13D1C469A08682C5FB64AF29901C3BCA3A6FF45F88F885431CE0D57695DFB8E840D360

Function 00007FF761663560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616628B7
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662927
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662987
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616629D7
Part of subcall function 00007FF761662850: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662A27

MessageBoxA.USER32 ref: 00007FF761663737

Part of subcall function 00007FF761664320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166379A

Strings

keyauth.win, xrefs: 00007FF7616636C3
null, xrefs: 00007FF7616635C2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 76f9a87719a452213c4479f1c826fb0046e9d8ca55bd5f92ce028bc9c21a3b28
Instruction ID: 937ec8179d8e627fcbb7ec2209aeb1e991ff720ea5278d470e394cb0bea3ed92
Opcode Fuzzy Hash: 76f9a87719a452213c4479f1c826fb0046e9d8ca55bd5f92ce028bc9c21a3b28
Instruction Fuzzy Hash: 6B51CD6AA1879185FB04EB75D4183AC6372AB04F88F804135DE4D27B8ACFBC9592C391

Function 00007FF7616B2D90 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761688F70: GetModuleHandleA.KERNEL32(?,?,?,00007FF7616B2DCA,?,?,?,?,00007FF7616892FB), ref: 00007FF761688F84

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF7616892FB), ref: 00007FF7616B2DE0

Strings

security.dll, xrefs: 00007FF7616B2DBA
secur32.dll, xrefs: 00007FF7616B2DB3
InitSecurityInterfaceA, xrefs: 00007FF7616B2DD6

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 8c00c9138cdfd17adfae597e72f02553676a85cbf6f4c48e13838bd5606a6a78
Instruction ID: c486bb3fe2580a3267503474eb6154632ad2b0dd40ed1f35a2c346ee7edbd38e
Opcode Fuzzy Hash: 8c00c9138cdfd17adfae597e72f02553676a85cbf6f4c48e13838bd5606a6a78
Instruction Fuzzy Hash: 5DF01D6DE09602C1FF84FB15A8997B193D2AF54B44FC44438C40C42290EEBCE5A5C760

Function 00007FF76167823B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF761677C46

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 0941e4454e05a29280e0911c3d610acfc878dd03c0a985a790bc3422c380df87
Instruction ID: 62f1158a8d1e4c285a82faf00ff0e018e4a354dfd3669beaf012062e8ad5a7de
Opcode Fuzzy Hash: 0941e4454e05a29280e0911c3d610acfc878dd03c0a985a790bc3422c380df87
Instruction Fuzzy Hash: DCB1A36AA08642C5FB64BE69905C27CA3A6EF41F48F985531CE1E472A5DFBCEC40D370

Function 00007FF761691BE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761691CE0

Part of subcall function 00007FF761692270: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922CA

Part of subcall function 00007FF761692020: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616920B8
Part of subcall function 00007FF761692020: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616920C1

Strings

TCP4, xrefs: 00007FF761691C7A
TCP6, xrefs: 00007FF761691C67
PROXY %s %s %s %li %li, xrefs: 00007FF761691CB4

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 9d4a322be4d87f538412dcdcd1c490b66af6a80acae25ef714a6566053d54fc5
Instruction ID: 427f6e5124829e11395a42e3cdb63b527a845f0c2157d9ee3f50aadf86e6ce06
Opcode Fuzzy Hash: 9d4a322be4d87f538412dcdcd1c490b66af6a80acae25ef714a6566053d54fc5
Instruction Fuzzy Hash: 8A41B62AA086C7C6E760FB25A4043B9B7A6EB85B94F944476DA4C47685DEBCD804CB20

Function 00007FF7616764D0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF761672506,?,?,?,?,00000000,?,00007FF76166371E), ref: 00007FF7616764ED
closesocket.WS2_32 ref: 00007FF7616765F9
closesocket.WS2_32 ref: 00007FF761676606

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 28d21d9544194ec4c8a92fbe0cca9a50be666e2dc753f7074a652fd99a0cf093
Instruction ID: 46bb6aaab449f6f8a294dcbe3fec44f7df3c0d4f7cfa0df03a9f42fd5c902aa8
Opcode Fuzzy Hash: 28d21d9544194ec4c8a92fbe0cca9a50be666e2dc753f7074a652fd99a0cf093
Instruction Fuzzy Hash: 96419039A08A82C1E740FF35D4582E9A362EF88F28FC44631DE5D866D6EFB8D5058330

Function 00007FF7616708F0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7616611FA), ref: 00007FF761670928
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7616611FA), ref: 00007FF7616709C9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7616709E7

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: 66997184731f703451c23791d2a627075896e7fda698d68a4c0cfe32fbc39a11
Instruction ID: 71d2054a76be9988d9b3a7435d42585afc553b1c72706f4729087a713536fbff
Opcode Fuzzy Hash: 66997184731f703451c23791d2a627075896e7fda698d68a4c0cfe32fbc39a11
Instruction Fuzzy Hash: 5331296AB09746C1FB14BB11A50837CA2529F05FE4F941630DE6D47BC2DFBDA492C320

Function 00007FF76169A390 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF76169A4D3
SSL/TLS connection timeout, xrefs: 00007FF76169A4EC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 76ab87318427c543c7d98e024c2e6d2fa0a766b8a8d724eff69a9d546786b0fd
Instruction ID: 1675d7918dda9223f29973019dd3207dee9a27b576f2349a8fd493cf1a2daaab
Opcode Fuzzy Hash: 76ab87318427c543c7d98e024c2e6d2fa0a766b8a8d724eff69a9d546786b0fd
Instruction Fuzzy Hash: 41519425F09643C7EB54EB159548279A3D2EB44FA8F948A71DE1D872E1DFBCE841C320

Function 00007FF761678E30 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616790FA
memcpy.VCRUNTIME140 ref: 00007FF76167922C
memcpy.VCRUNTIME140 ref: 00007FF761679248

Part of subcall function 00007FF76168E6E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761677003,?,?,00000000,00007FF7616818D2,?,?,00000000,00007FF761681F05), ref: 00007FF76168E71C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: 54aff36e5212d6146394b1c18812124a5a0137bacb8697812285b3b45e936068
Instruction ID: f27b297d95e9788a1e97effd32809ac4d626964bc4b6debf59b0a6157e326b78
Opcode Fuzzy Hash: 54aff36e5212d6146394b1c18812124a5a0137bacb8697812285b3b45e936068
Instruction Fuzzy Hash: 88C18F36B14A02C6EB54AB69D4083AC73B2BB45BA8F844639CE2D177D8DF78D445C760

Function 00007FF7616766D0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF761676AC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761676AE7

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c290df82bec0a9fbd1bba91402cfb6175d957c5f8f370d1a6f1b991630986998
Instruction ID: 8d63244deb1d518445674819adfeccb62133c3fc3bb0bb5cafba3a5c8ff0f191
Opcode Fuzzy Hash: c290df82bec0a9fbd1bba91402cfb6175d957c5f8f370d1a6f1b991630986998
Instruction Fuzzy Hash: 9BC1F97AA086C2C6FB65AB2590583B9A391FF44FA4F944235DE6E437C4EFBCD8418710

Function 00007FF7616827A0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761682805

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF761682944
User-Agent: %s, xrefs: 00007FF761682816

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: acf7e0c6a19e3e6413a3c3b3ac2091e70b7d1ead12cd6da52550afa0c6970e1d
Instruction ID: e8b872c2a9376dde132f77ed96efb097a9607158a5bed794bd850fb78ca18b6b
Opcode Fuzzy Hash: acf7e0c6a19e3e6413a3c3b3ac2091e70b7d1ead12cd6da52550afa0c6970e1d
Instruction Fuzzy Hash: E5518E66A08AC1C1EB919F35D0183EDA761EB85F98F884135DE9C0B79ACFB8D495C330

Function 00007FF761671D90 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761671AA0: SleepEx.KERNELBASE ref: 00007FF761671C5F

SetConsoleTitleA.KERNEL32 ref: 00007FF761671DD8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761671E32

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ConsoleSleepTitle_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4275364305-0
Opcode ID: 0482b1b62b6ae519898025941bbefb5542d9f6902fe729238a29048143dd3a8a
Instruction ID: 86a2391ae8ff6b8c1356db2fe227b37bb3e4c93c9ea96fa6098c8495c75b225b
Opcode Fuzzy Hash: 0482b1b62b6ae519898025941bbefb5542d9f6902fe729238a29048143dd3a8a
Instruction Fuzzy Hash: D4118669E18582C1EB10FB14E469369B372FF85F98FC04236D59D026E9DFACD454C710

Function 00007FF761686600 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF76168660C
WSAGetLastError.WS2_32 ref: 00007FF76168661B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 9297357e9789c547a433d17009090a850aba96bb81910332f5902cd5212cb4f3
Instruction ID: bcc718bbf4e5873cb4703b9faac14260c87be3811c74e79d5cb965906486ae1d
Opcode Fuzzy Hash: 9297357e9789c547a433d17009090a850aba96bb81910332f5902cd5212cb4f3
Instruction Fuzzy Hash: A1E0DF21F0460982FF286770A86933922959B58B31F845738CA3B867C0DEAC44D68B10

Function 00007FF761672380 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7616723A4
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7616723C5

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID:
API String ID: 2168557111-0
Opcode ID: 3d02d3eb83713d43c77fd4721ff7eee78d3dbed60bee5a5b721cc135446cce2f
Instruction ID: 2dd562416676dd8c5e2c92a89bde93184ccfdd1f9b805ea69af9c4b208513109
Opcode Fuzzy Hash: 3d02d3eb83713d43c77fd4721ff7eee78d3dbed60bee5a5b721cc135446cce2f
Instruction Fuzzy Hash: 27E01C32A08B81C2D7009B50F85846AA3A5FB98BC4F804139EE8C47A24CF7CC1A5CB50

Function 00007FF761686EE0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF761686F23

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: c66370dc830ad94e535e2ad815e95569a5c7930ebc6c8522cb5e8aded36d2ec2
Instruction ID: 1d83dc87e79fa51eca40d5586c39dd121af50163a0df92fb53270a63fed50edf
Opcode Fuzzy Hash: c66370dc830ad94e535e2ad815e95569a5c7930ebc6c8522cb5e8aded36d2ec2
Instruction Fuzzy Hash: 14019616B165C1C1FB54E73AD19C37DA392EF88F88F988031DB0D47695CF68D4A58720

Function 00007FF76168EA00 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF76168EA29

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: f0bb34100cf0a741a16ee44f1e954a57bc67ddd83bf44124ffd341ded78523cc
Instruction ID: 3cc2468ce646a4bb12018975cb698a31d11d36e25cfbae056c70d84c1c9e3241
Opcode Fuzzy Hash: f0bb34100cf0a741a16ee44f1e954a57bc67ddd83bf44124ffd341ded78523cc
Instruction Fuzzy Hash: 52E06D2AE06641C2DF48A726C8996A96362AB50F64FC44375CA3E02BD0CE6D96569B20

Function 00007FF761699660 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76169967B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6b00736407f2214d91860028af48249fbae4847a37a0940c787b6abd9db0cd9c
Instruction ID: 5e3b80dad44f0a04bbe5501c4c9cfeea91843faed5dc8be7071130ffab9cc333
Opcode Fuzzy Hash: 6b00736407f2214d91860028af48249fbae4847a37a0940c787b6abd9db0cd9c
Instruction Fuzzy Hash: 5BD02B63718A00839F10DF72A844029E252F788770B88473DEE7D837E0DF3CD1418A00

Function 00007FF7616955A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF7616955B9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: ad4c069ad0f4160e7c62cb6453504bdc4280a687206230678d7d671c433c8928
Instruction ID: edf8df851eee0852acecd80080920cd2e82b86c4607647d6f07bb2681e4839a7
Opcode Fuzzy Hash: ad4c069ad0f4160e7c62cb6453504bdc4280a687206230678d7d671c433c8928
Instruction Fuzzy Hash: B6C01256E15581C283446F619489086A672AB84605F956429D50642124DD3CC2A58A40

Function 00007FF76168E750 Relevance: 1.3, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000001,00007FF76167901F), ref: 00007FF76168E7A8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 2776bca9db8f599c86e0e75b1e27d899bf5cee7a17272ec46874e0d708622458
Instruction ID: 8a024900c0689ed82d722ad454637d39d6911e12baea1a47caa2fa7c905e5721
Opcode Fuzzy Hash: 2776bca9db8f599c86e0e75b1e27d899bf5cee7a17272ec46874e0d708622458
Instruction Fuzzy Hash: B811B476F15B41C2DBA0DF0AB144129A2A1FF48B84F995034DA9D47B48DF78D491C320

Non-executed Functions

Function 00007FF7616931A0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761694363

Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686525
Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686540

memchr.VCRUNTIME140 ref: 00007FF761694456
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169456E
strchr.VCRUNTIME140 ref: 00007FF761694582
strchr.VCRUNTIME140 ref: 00007FF7616945AA
strchr.VCRUNTIME140 ref: 00007FF7616945C0

Strings

Received 101, xrefs: 00007FF76169463B
Content-Length:, xrefs: 00007FF7616936AF
HTTP error before end of send, stop sending, xrefs: 00007FF7616943AD
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF761693F2C
Last-Modified:, xrefs: 00007FF761693DD7
Maximum file size exceeded, xrefs: 00007FF7616945FF
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF7616941AC, 00007FF7616941F8
Content-Type:, xrefs: 00007FF761693756
, xrefs: 00007FF761693542
close, xrefs: 00007FF761693933, 00007FF761693AB3
Mark bundle as not supporting multiuse, xrefs: 00007FF7616933DF
RTSP/%1d.%1d%c%3d, xrefs: 00007FF76169352D
Got 417 while waiting for a 100, xrefs: 00007FF761694343
Proxy-Connection:, xrefs: 00007FF7616937D3, 00007FF7616938AC
Set-Cookie:, xrefs: 00007FF761693D33
HTTP error before end of send, keep sending, xrefs: 00007FF761694389
HTTP, xrefs: 00007FF76169455E
Keep sending data to get tossed away!, xrefs: 00007FF7616943FC
The requested URL returned error: %d, xrefs: 00007FF761694733
The requested URL returned error: %s, xrefs: 00007FF7616945D7
Overflow Content-Length: value!, xrefs: 00007FF76169373B
Content-Encoding:, xrefs: 00007FF761693BA1
Received HTTP/0.9 when not allowed, xrefs: 00007FF7616944CB
HTTP %3d, xrefs: 00007FF761693408
keep-alive, xrefs: 00007FF761693866, 00007FF7616939F6
HTTP/%1[23] %d, xrefs: 00007FF761693364
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF761693B2C
, xrefs: 00007FF76169338C
Invalid Content-Length: value, xrefs: 00007FF761694618
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF761693B6B
RTSP/, xrefs: 00007FF761693294
Transfer-Encoding:, xrefs: 00007FF761693AEA
Retry-After:, xrefs: 00007FF761693BE3
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF761694156
Location:, xrefs: 00007FF761693F6E
Content-Range:, xrefs: 00007FF761693C6E
HTTP/1.1 proxy connection set close!, xrefs: 00007FF761693B4D
HTTP 1.0, assume close after body, xrefs: 00007FF761693607
Proxy-authenticate:, xrefs: 00007FF761693E61
HTTP/%1d.%1d%c%3d, xrefs: 00007FF761693339
Persistent-Auth, xrefs: 00007FF761693ED2
Unsupported HTTP version in response, xrefs: 00007FF761694541
Connection:, xrefs: 00007FF76169396B, 00007FF761693A20
Lying server, not serving HTTP/2, xrefs: 00007FF7616933BC
false, xrefs: 00007FF761693F10
HTTP/, xrefs: 00007FF7616934A9
WWW-Authenticate:, xrefs: 00007FF761693E36

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: a1538a2fe93912e992e6f2d42a2ea1633298ef863c6a51220481b0b8fab12c33
Instruction ID: e6cc66a6fd8d66544088b687c671c09b6fa98136b96b3bb64d0b7a2ce382d26e
Opcode Fuzzy Hash: a1538a2fe93912e992e6f2d42a2ea1633298ef863c6a51220481b0b8fab12c33
Instruction Fuzzy Hash: 1EC2AC79A08683C6EB60EF2595083F9A792EB41F88F884475CE5D4B685DFEDE841C730

Function 00007FF7616792A0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 730stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF76167AAF7), ref: 00007FF761679310
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167932B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761679364
strchr.VCRUNTIME140 ref: 00007FF761679377
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616794F7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679518
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167953B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616795E1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616795EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761679602
strchr.VCRUNTIME140 ref: 00007FF7616797EF
strchr.VCRUNTIME140 ref: 00007FF761679809
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616798FC
strchr.VCRUNTIME140 ref: 00007FF761679928
strrchr.VCRUNTIME140 ref: 00007FF76167993A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167995B
memcpy.VCRUNTIME140 ref: 00007FF761679974
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616799E8
strchr.VCRUNTIME140 ref: 00007FF761679A0B
strchr.VCRUNTIME140 ref: 00007FF761679A20

Strings

%4095[^;=] =%4095[^;], xrefs: 00007FF7616793B6
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF76167987F
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF76167970E
__Host-, xrefs: 00007FF761679511
path, xrefs: 00007FF7616795CD
Added, xrefs: 00007FF761679F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF761679F27
max-age, xrefs: 00007FF761679758
#HttpOnly_, xrefs: 00007FF7616799DE
FALSE, xrefs: 00007FF761679A5E, 00007FF761679C5B
expires, xrefs: 00007FF761679785
httponly, xrefs: 00007FF7616795A6
secure, xrefs: 00007FF76167956E
TRUE, xrefs: 00007FF761679A57
version, xrefs: 00007FF76167972B
domain, xrefs: 00007FF761679621
localhost, xrefs: 00007FF76167964F
__Secure-, xrefs: 00007FF7616794F0
Replaced, xrefs: 00007FF761679F11

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: aefc85c06da91ef1b4f678a21f8745f1fa9ed17bfba3c9c6ac9d2c0e2c9fcc93
Instruction ID: 022cb95eadebd8357458fb97afdc5d87e47940040e495fa500be5e021b4487c3
Opcode Fuzzy Hash: aefc85c06da91ef1b4f678a21f8745f1fa9ed17bfba3c9c6ac9d2c0e2c9fcc93
Instruction Fuzzy Hash: 08729229A09B86C5FB60AB25D4583B9E7E2EF45F6CF844535CA8E026D5DFBCE444C320

Function 00007FF7616ADB30 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686525
Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686540

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616ADBBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616ADBF2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616ADBFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616ADC19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616ADC2C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616ADC35
#22.WLDAP32 ref: 00007FF7616ADC46
#211.WLDAP32 ref: 00007FF7616ADCE0
#217.WLDAP32 ref: 00007FF7616ADCFC
#211.WLDAP32 ref: 00007FF7616ADD15
#211.WLDAP32 ref: 00007FF7616ADD27
#60.WLDAP32 ref: 00007FF7616ADD57
#211.WLDAP32 ref: 00007FF7616ADE72
#60.WLDAP32 ref: 00007FF7616ADE97
#22.WLDAP32 ref: 00007FF7616ADF3A
#41.WLDAP32 ref: 00007FF7616AE356
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE37E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE388
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE3A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE3BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE3C4
#46.WLDAP32 ref: 00007FF7616AE3D6

Strings

;binary, xrefs: 00007FF7616AE1C0
LDAP local: %s, xrefs: 00007FF7616ADC4C
LDAP local: %s, xrefs: 00007FF7616ADBA7
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF7616ADB64
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF7616ADD7B
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF7616ADF44
encrypted, xrefs: 00007FF7616ADC8E
LDAP remote: %s, xrefs: 00007FF7616ADFB7
Microsoft Corporation., xrefs: 00007FF7616ADB50
LDAP local: trying to establish %s connection, xrefs: 00007FF7616ADC79
cleartext, xrefs: 00007FF7616ADC6F
There are more than %d entries, xrefs: 00007FF7616AE366
DN: , xrefs: 00007FF7616AE032

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: a497366483bd6b5936b9a45555906512a1da7f8d15384eb5b45bda77f332d582
Instruction ID: 193f43f40db2e789c42ba9999acbaa47a3f78a8317be401c4713c349d48d40c5
Opcode Fuzzy Hash: a497366483bd6b5936b9a45555906512a1da7f8d15384eb5b45bda77f332d582
Instruction Fuzzy Hash: 6E428E79B09A42C6FB10EB62D4582BDA3A2FB44F88F805435CE4E57B94DEBCE405C760

Function 00007FF76166956D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF761669F6D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF761669F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A0CB

Strings

object, xrefs: 00007FF76166A319
object separator, xrefs: 00007FF761669C73, 00007FF76166A4AA
array, xrefs: 00007FF76166A18A
object key, xrefs: 00007FF761669DFF, 00007FF76166A639
number overflow parsing ', xrefs: 00007FF761669F90

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 57745755b259e84db2332ad81b64edb5a67cb0af63b873a31d00d3511d4f9ebf
Instruction ID: dacb373c17a74c09ec7986ce1c0fd65ad408a9a4f42dd7a449686cce34d4aeb0
Opcode Fuzzy Hash: 57745755b259e84db2332ad81b64edb5a67cb0af63b873a31d00d3511d4f9ebf
Instruction Fuzzy Hash: 3AA2E876A18B86C6EB00EB79D4483ADA372FB41B94F801235DA5D13AE9DFBCD085C351

Function 00007FF76166AC0D Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 925COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166B5A4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166B5D2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166B5E0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166B61A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166B677
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166B730
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166B75E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166B76C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166B7A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166B803

Part of subcall function 00007FF76166F1C0: memcmp.VCRUNTIME140 ref: 00007FF76166F24D
Part of subcall function 00007FF76166F1C0: memcmp.VCRUNTIME140 ref: 00007FF76166F2D1

Strings

object, xrefs: 00007FF76166BBA8
object separator, xrefs: 00007FF76166B510, 00007FF76166BD39
array, xrefs: 00007FF76166BA19
object key, xrefs: 00007FF76166B69C, 00007FF76166BEC8
number overflow parsing ', xrefs: 00007FF76166B81F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: 6a2c001b71bb5fe8af0eb5e9b9917663cb907f74e938879a36589b2774ab7813
Instruction ID: f8cae52e2e1656407ad4b1309fd5df12c1426022547d44d9d0af96a5d18fade2
Opcode Fuzzy Hash: 6a2c001b71bb5fe8af0eb5e9b9917663cb907f74e938879a36589b2774ab7813
Instruction Fuzzy Hash: 4B92E666B18B85C2EB10DB78E4483ADA372FB45BA4F805231DA5D27AD9DFBCD084C351

Function 00007FF7616B63E0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF7616B654F
GetLastError.KERNEL32 ref: 00007FF7616B6562
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF7616B6614
GetLastError.KERNEL32 ref: 00007FF7616B661E
CertGetCertificateChain.CRYPT32 ref: 00007FF7616B66AB
GetLastError.KERNEL32 ref: 00007FF7616B66B5
CertGetNameStringA.CRYPT32 ref: 00007FF7616B6823
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF7616B6C9B
CertCloseStore.CRYPT32 ref: 00007FF7616B6CB0
CertFreeCertificateChain.CRYPT32 ref: 00007FF7616B6CC0
CertFreeCertificateContext.CRYPT32 ref: 00007FF7616B6CD0

Strings

schannel: failed to create certificate store: %s, xrefs: 00007FF7616B657C
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF7616B6BC9
2.5.29.17, xrefs: 00007FF7616B6883, 00007FF7616B68B4, 00007FF7616B6A1F, 00007FF7616B6A5B
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7616B6C4D
schannel: Empty DNS name., xrefs: 00007FF7616B692A, 00007FF7616B6AD8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF7616B674C
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF7616B6779
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF7616B6C26
schannel: CertFindExtension() returned no extension., xrefs: 00007FF7616B689B, 00007FF7616B6A37
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF7616B696D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF7616B6735
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF7616B678A
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF7616B6762
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF7616B6B63
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF7616B66CF
schannel: Null certificate info., xrefs: 00007FF7616B6873, 00007FF7616B6A04
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF7616B68EE, 00007FF7616B6A95
schannel: server certificate name verification failed, xrefs: 00007FF7616B6C0E
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7616B6521
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF7616B671D
schannel: Null certificate context., xrefs: 00007FF7616B6838, 00007FF7616B69E7
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF7616B6BD9
schannel: Not enough memory to list all host names., xrefs: 00007FF7616B6B4C
schannel: failed to create certificate chain user: %s, xrefs: 00007FF7616B6638

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$userStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain user: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: cd7eead237edb2df29b0f3e516ee76bf61877b4d14e84d580c823e5bfa7684d5
Instruction ID: bba9780c4db911c782d62c1be95d3d4f43b9410ac5f1b67ebc551ce1bf8d0f9a
Opcode Fuzzy Hash: cd7eead237edb2df29b0f3e516ee76bf61877b4d14e84d580c823e5bfa7684d5
Instruction Fuzzy Hash: 1042C07AA08B82C1EB60EB25E4482B9B7A2FB44F94F804135DE5D07794DFBCE555CB20

Function 00007FF7616A5300 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A53E1
getsockname.WS2_32 ref: 00007FF7616A55DA
WSAGetLastError.WS2_32 ref: 00007FF7616A55E4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A5B1B

Strings

%s |%d|%s|%hu|, xrefs: 00007FF7616A5AA9
%s %s, xrefs: 00007FF7616A5A29
Failure sending PORT command: %s, xrefs: 00007FF7616A5A4C
PORT, xrefs: 00007FF7616A5A22
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF7616A5774
Failure sending EPRT command: %s, xrefs: 00007FF7616A5ACF
bind() failed, we ran out of ports!, xrefs: 00007FF7616A57D6
,%d,%d, xrefs: 00007FF7616A59F9
getsockname() failed: %s, xrefs: 00007FF7616A55FE, 00007FF7616A580E
bind(port=%hu) failed: %s, xrefs: 00007FF7616A5845
failed to resolve the address provided to PORT: %s, xrefs: 00007FF7616A5B09
socket failure: %s, xrefs: 00007FF7616A56DF, 00007FF7616A58E6
EPRT, xrefs: 00007FF7616A5A92

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: 63061f5b76a2deed0df9e591f082b43592a29dbb5e6961dc9413e779db65148c
Instruction ID: e268e37bc1b163cd133e4cc499fe045bfa3b0432aa84dae19634df7f88b78e05
Opcode Fuzzy Hash: 63061f5b76a2deed0df9e591f082b43592a29dbb5e6961dc9413e779db65148c
Instruction Fuzzy Hash: 5C22C669A0C782C1EB50EB21E4582BEA7A3FB45F84FC05036DA4E47A95DFBCE544C720

Function 00007FF76167F9F0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167FA56
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167FA7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167FAD8

Strings

;sha256//, xrefs: 00007FF76167FB50
public key hash: sha256//%s, xrefs: 00007FF76167FAEE
-----END PUBLIC KEY-----, xrefs: 00007FF76167FCDE
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF76167FCAA
sha256//, xrefs: 00007FF76167FA4C, 00007FF76167FB9E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 5445a359841f54012be177e1d28c1cb122a8af7dff79599376bd044fc9e4994f
Instruction ID: c8801b0e3cc54c2cfb6692d2227b8f40871474634a553b986616a42dab2482da
Opcode Fuzzy Hash: 5445a359841f54012be177e1d28c1cb122a8af7dff79599376bd044fc9e4994f
Instruction Fuzzy Hash: 70A19F2AB09642C1FB50AF22A82C6B9A692AF44FD4FC44475DD6E47794EFBCE401C720

Function 00007FF7616B6D00 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7616B6D46

Part of subcall function 00007FF761672F50: GetLastError.KERNEL32 ref: 00007FF761672F6C
Part of subcall function 00007FF761672F50: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672F74

CreateFileA.KERNEL32 ref: 00007FF7616B6DA0
GetLastError.KERNEL32 ref: 00007FF7616B6DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B70ED

Strings

schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF7616B6E12
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7616B7075
-----END CERTIFICATE-----, xrefs: 00007FF7616B6F19
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7616B6D60
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7616B70B2
schannel: failed to open CA file '%s': %s, xrefs: 00007FF7616B6DCB
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF7616B7026
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7616B7091
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF7616B7045
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF7616B6E49
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7616B6EEE
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF7616B6FF0
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF7616B70C3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: ae19b7c693a3376d514824ed8022f99d215922fa346540a39cf7b5fbf14a00b1
Instruction ID: 813f5ba1b98664a0adeada1e5d995f19cdade94c2a7df70e48c08f4f5f015326
Opcode Fuzzy Hash: ae19b7c693a3376d514824ed8022f99d215922fa346540a39cf7b5fbf14a00b1
Instruction Fuzzy Hash: DCB19279B18752C2E710AB66E4086A9A6A3BF44F84FC05036DE4D47B94DFBCE505CB60

Function 00007FF761683C40 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF761683C9A
memset.VCRUNTIME140 ref: 00007FF761683CAF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761683CCB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761683CF2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761683D69
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761683D9C
strchr.VCRUNTIME140 ref: 00007FF761683E86
strchr.VCRUNTIME140 ref: 00007FF761683ECB
strchr.VCRUNTIME140 ref: 00007FF761683EFB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761683FA3

Part of subcall function 00007FF76169C850: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C878
Part of subcall function 00007FF76169C850: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C89E
Part of subcall function 00007FF76169C850: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C8BF
Part of subcall function 00007FF76169C850: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C8D0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684076
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616840A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616840CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616840F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684105
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684117
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616842BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616842C3

Strings

Uses proxy env variable %s == '%s', xrefs: 00007FF761683DFC, 00007FF76168405A
_proxy, xrefs: 00007FF761683FB9
ALL_PROXY, xrefs: 00007FF761684040
http_proxy, xrefs: 00007FF761683FED
no_proxy, xrefs: 00007FF761683DC1
memory shortage, xrefs: 00007FF761683D77
all_proxy, xrefs: 00007FF761684029
NO_PROXY, xrefs: 00007FF761683DDD

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: d49dbb8062e0f3f83e2c35fdfaf63a3a002192681677a66c2cb64c26a65ca173
Instruction ID: e77654e7aa1e50105bbdd7dd037ee8c4fb7c2e4a26e228e47653dfd153512434
Opcode Fuzzy Hash: d49dbb8062e0f3f83e2c35fdfaf63a3a002192681677a66c2cb64c26a65ca173
Instruction Fuzzy Hash: 79029429A0D782C5EB91EB15A4583BAA796EF45F88F884035DE8D47B85DFBCE404C730

Function 00007FF76169A90C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF76169A9A8
strchr.VCRUNTIME140 ref: 00007FF76169A9D4
strchr.VCRUNTIME140 ref: 00007FF76169AA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169AA32
strchr.VCRUNTIME140 ref: 00007FF76169AB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169AB5A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76169AC85
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76169ACB1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF76169ADE9
CurrentUser, xrefs: 00007FF76169AA22
, xrefs: 00007FF76169A90C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: f67e65bda64f7bc2ff11744649ac0d4417b9831fe5915c7b7913ff7f7f31b820
Instruction ID: 0e74e119b9b6795d4192c4f5d0491c34cc7ba83bcf98e2d288250ccd0fd88279
Opcode Fuzzy Hash: f67e65bda64f7bc2ff11744649ac0d4417b9831fe5915c7b7913ff7f7f31b820
Instruction Fuzzy Hash: 59819F29F09643C2FB55AF259858279A2D2BF05F94F844538CE1E467A0EFBCE844C720

Function 00007FF76166974B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF761669F74
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A10A

Strings

object, xrefs: 00007FF76166A319
array, xrefs: 00007FF76166A18A
number overflow parsing ', xrefs: 00007FF761669F90

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: bb7f3fb9ed15c36171e49e9f8989b7fec12843ec510944212f621a99c3a71fb2
Instruction ID: 621f3d20abf976af62d937409e4dc94a90ecf7ff9fac9524a575c0e58e187c5e
Opcode Fuzzy Hash: bb7f3fb9ed15c36171e49e9f8989b7fec12843ec510944212f621a99c3a71fb2
Instruction Fuzzy Hash: D532D366A08B86C5EB10DB78D4483EDA372FB41B98F805235DA5D17AE9DFBCD084C391

Function 00007FF76169A915 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF76169A9A8
strchr.VCRUNTIME140 ref: 00007FF76169A9D4
strchr.VCRUNTIME140 ref: 00007FF76169AA0E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169AA32
strchr.VCRUNTIME140 ref: 00007FF76169AB42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169AB5A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76169AC85
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76169ACB1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF76169ADE9
CurrentUser, xrefs: 00007FF76169AA22

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: d27a0d2bd81bbd69c5f44cbac832e1c64e7776eb9c4d4244ef604611dd81367d
Instruction ID: 13d1bd186d8a961cbf7fdca947832d37bd27cbd4b27a59089d679e92fcabc656
Opcode Fuzzy Hash: d27a0d2bd81bbd69c5f44cbac832e1c64e7776eb9c4d4244ef604611dd81367d
Instruction Fuzzy Hash: 6681AF29F09643C2FB55AF21A858279A2D2BF05F94F844538CE1E467E0EFBCE844C720

Function 00007FF761672620 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF761672648
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672650

Strings

Unknown error, xrefs: 00007FF761672B40
No error, xrefs: 00007FF761672AA0
%s (0x%08X), xrefs: 00007FF7616726A5
%s - %s, xrefs: 00007FF761672BA9
CRYPT_E_REVOKED, xrefs: 00007FF761672A82
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF761672B59
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF761672AAC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 2c2ecc4646857d6feea65fdae523bac12c2e5c780fb340e982890c109351eac7
Instruction ID: d8fb68ba984ecbba769120bfde8302bed49feb0775e925cc2751fd202cf04c0d
Opcode Fuzzy Hash: 2c2ecc4646857d6feea65fdae523bac12c2e5c780fb340e982890c109351eac7
Instruction Fuzzy Hash: 21518329A0C682C5E761EF34A4583BAA3A6FB84F44FC0453ADA4D02695DFBCE514CB20

Function 00007FF7616985D0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76169884E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761698856
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF76169886C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761698875
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76169887D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761698887

Strings

%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF76169868E
GMT, xrefs: 00007FF761698747
%02d:%02d%n, xrefs: 00007FF76169882D
%02d:%02d:%02d%n, xrefs: 00007FF7616987F9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: d49d3298ae75f34013cd756147334e6d7bf0667b6907b24902a762b26ed2f88a
Instruction ID: 184ff64258ec61eb84c86e88bc321a81fa841a2bc7832b6dfeebb90b7afb58a6
Opcode Fuzzy Hash: d49d3298ae75f34013cd756147334e6d7bf0667b6907b24902a762b26ed2f88a
Instruction Fuzzy Hash: 7FF1377AF14616CBEB24EB2884081BCB3A6BB44B58F900635DE1E577E4DFBCE8119750

Function 00007FF7616BF840 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7616BF886
CryptCreateHash.ADVAPI32 ref: 00007FF7616BF8AA
CryptHashData.ADVAPI32 ref: 00007FF7616BF8C6
CryptGetHashParam.ADVAPI32 ref: 00007FF7616BF8E5
CryptGetHashParam.ADVAPI32 ref: 00007FF7616BF908
CryptDestroyHash.ADVAPI32 ref: 00007FF7616BF918
CryptReleaseContext.ADVAPI32 ref: 00007FF7616BF92A

Strings

@, xrefs: 00007FF7616BF85D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 6136e2d2f60899814bedc5065155a8e394b868ebbd0571b5477ee51700c2f6b1
Instruction ID: 61614bed481d18af0f00da54a1079dde770128eb682e3c4b81a1c2e2f6feac1b
Opcode Fuzzy Hash: 6136e2d2f60899814bedc5065155a8e394b868ebbd0571b5477ee51700c2f6b1
Instruction Fuzzy Hash: 8B215E3A618681C6E760EF25E45866AB362FBC9F84F845136EE8E03A18CF7CD545CF10

Function 00007FF7616C067C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7616C0698
memset.VCRUNTIME140 ref: 00007FF7616C06BC
RtlCaptureContext.KERNEL32 ref: 00007FF7616C06C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7616C06DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7616C0720
memset.VCRUNTIME140 ref: 00007FF7616C0753
IsDebuggerPresent.KERNEL32 ref: 00007FF7616C0774
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7616C0791
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7616C079C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 44a6ae0cd8af2b98538bf3d6ef033a35be83f1fd2ab8966232449bb115425376
Instruction ID: a08bc62f1a2d612b2ab10086f6b6f20bba0ab88ff32a31c703ea6cc23b8ca29f
Opcode Fuzzy Hash: 44a6ae0cd8af2b98538bf3d6ef033a35be83f1fd2ab8966232449bb115425376
Instruction Fuzzy Hash: AD3132BA608B81CAEB609F61E8443EDB365FB84B44F84403ADB4D47B95DF78D548CB20

Function 00007FF7616BD750 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7616BD797
CryptImportKey.ADVAPI32 ref: 00007FF7616BD869
CryptReleaseContext.ADVAPI32 ref: 00007FF7616BD881
CryptEncrypt.ADVAPI32 ref: 00007FF7616BD8B2
CryptDestroyKey.ADVAPI32 ref: 00007FF7616BD8BC
CryptReleaseContext.ADVAPI32 ref: 00007FF7616BD8C8

Strings

@, xrefs: 00007FF7616BD77D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: c3d7f55d531103b682a9b71d8043198a9a0fc1ead9b00ee7f1eeacd26531a0d2
Instruction ID: b85b989b260731f5eb592012bc89163422c371efa810cb381a37ab78eb436901
Opcode Fuzzy Hash: c3d7f55d531103b682a9b71d8043198a9a0fc1ead9b00ee7f1eeacd26531a0d2
Instruction Fuzzy Hash: 82419B26B046A08EF7109BB5E4543EE7BB2FB5A748F444066DE8817A5ACF3C811ADB50

Function 00007FF761695CF0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dP, xrefs: 00007FF761695E0D
%4I64dM, xrefs: 00007FF761695D8C
%5I64d, xrefs: 00007FF761695D05
%4I64dG, xrefs: 00007FF761695DE4
%4I64dk, xrefs: 00007FF761695D1E
%2I64d.%0I64dM, xrefs: 00007FF761695D39
%2I64d.%0I64dG, xrefs: 00007FF761695DAA
%4I64dT, xrefs: 00007FF761695E00

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: d57af410e886d6ef54cd9f21839bf90c88b4b505b0b28237b1efe07e4581d7e2
Instruction ID: a675e7541998f213a4421c2eda3d5ec232c748a439f50806a620de8979e42bd6
Opcode Fuzzy Hash: d57af410e886d6ef54cd9f21839bf90c88b4b505b0b28237b1efe07e4581d7e2
Instruction Fuzzy Hash: 0821905AE1994BC3FF14EB95A41C7F482639B89F80EC04833E81E06791DFEC6956C570

Function 00007FF7616C0A18 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF761661880), ref: 00007FF7616C0A2E
GetLastError.KERNEL32 ref: 00007FF7616C0A79
IsDebuggerPresent.KERNEL32 ref: 00007FF7616C0A91
OutputDebugStringW.KERNEL32 ref: 00007FF7616C0AA2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7616C0A9B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: 5817aa7e7bf68f5fb58bff8602b12e9fb4311fbb383ff5e081a92594f28c09a8
Instruction ID: 6de8d0cb5555a856e9bb2023b4a2bee807cd2203ee2718012f631547bf7703bb
Opcode Fuzzy Hash: 5817aa7e7bf68f5fb58bff8602b12e9fb4311fbb383ff5e081a92594f28c09a8
Instruction Fuzzy Hash: A411943A618B42D3F744AB25D548379B2A6FF08B45F904139CA4D82950EFBCE474CB60

Function 00007FF761699B40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF761699B71
CryptGenRandom.ADVAPI32 ref: 00007FF761699B85
CryptReleaseContext.ADVAPI32 ref: 00007FF761699B96
CryptReleaseContext.ADVAPI32 ref: 00007FF761699BAC

Strings

@, xrefs: 00007FF761699B59

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 0ac105aea5ba1d1cf2cff87d6f6bbec93b26db8ffee4d0c604fb4a7a731729df
Instruction ID: a57d920de749563ad9dd03e23eab893f71b30e5b32140971bf24625a44e3706f
Opcode Fuzzy Hash: 0ac105aea5ba1d1cf2cff87d6f6bbec93b26db8ffee4d0c604fb4a7a731729df
Instruction Fuzzy Hash: 96F08665B08642C2E7109B21F448327E362FF88BD8F944435DE8C46668DFBDC485CB10

Function 00007FF76168A150 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

%ld, xrefs: 00007FF76168A460
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF76168A66B, 00007FF76168A6D6
(nil), xrefs: 00007FF76168A9B6
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF76168A193, 00007FF76168A664, 00007FF76168A6CB
.%ld, xrefs: 00007FF76168A4B9
(nil), xrefs: 00007FF76168A934

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 1a46011813abe3df587649df29dca278059a1793d187c85371252c5ab630468f
Instruction ID: 9856ceaf018b5cc98e18c0faae2aa707b34f7971c87e39139e64e96f213763b1
Opcode Fuzzy Hash: 1a46011813abe3df587649df29dca278059a1793d187c85371252c5ab630468f
Instruction Fuzzy Hash: B842063A918982C6E7B46A189548379E793FF44F94FD44230DE9E47EE4DEBCE8418630

Function 00007FF7616C0894 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7616C08C0
GetCurrentThreadId.KERNEL32 ref: 00007FF7616C08CE
GetCurrentProcessId.KERNEL32 ref: 00007FF7616C08DA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7616C08EA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 041d678dc743e0e5f436598f64fc9b09e1e8aef45ebef0de337f34359adb3a07
Instruction ID: 1d573259c01b4699263f5385a4e032bee58488f5fae1411b90c8d6d4043656c2
Opcode Fuzzy Hash: 041d678dc743e0e5f436598f64fc9b09e1e8aef45ebef0de337f34359adb3a07
Instruction Fuzzy Hash: E4111F2AB14B01C9EB00AB60E8582A873B4FB59B58F441D35DE6D86794DF78D154C750

Function 00007FF76169CB30 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF76169CB60
CryptGetHashParam.ADVAPI32 ref: 00007FF76169CB86
CryptDestroyHash.ADVAPI32 ref: 00007FF76169CB95
CryptReleaseContext.ADVAPI32 ref: 00007FF76169CBA5

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 7a19cfeddf836940870f59dd0f30b0165c1a9781b8daf24688f602d4ec20c495
Instruction ID: f8aa04229fcda98f9d5b30d9e066bcdbfede18a6cac6141bfb70a6825eadb8c3
Opcode Fuzzy Hash: 7a19cfeddf836940870f59dd0f30b0165c1a9781b8daf24688f602d4ec20c495
Instruction Fuzzy Hash: 25015E7A608642C2EB109F20E45876AF332FB84F98F544536DE4D06A68CF7CC488CB50

Function 00007FF76169CAD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF76169CAEC
CryptCreateHash.ADVAPI32 ref: 00007FF76169CB0D

Strings

@, xrefs: 00007FF76169CADC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: 1b93c0d41da9f109d1acfa544d6c01e5a17770cfcf19a319a204773c3ebed238
Instruction ID: 99525ae833229ac08e81f54d4abb8b572e666c042722075563fe2526427c7d3d
Opcode Fuzzy Hash: 1b93c0d41da9f109d1acfa544d6c01e5a17770cfcf19a319a204773c3ebed238
Instruction Fuzzy Hash: 87E0D865B1455283F7305B35E405B16A352FB88B48F845035CF4C07A14DF7CC045CF14

Function 00007FF7616A9410 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7616A944B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616A947F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 14fbe48617075f3174793a590dd64f28711d7743a1a480ca69b05c8c2bed0042
Instruction ID: 04d45f0f2f931f3cfb177bbca32fbbdc4e4c0a061bf7ec8340eb2bee06360ab2
Opcode Fuzzy Hash: 14fbe48617075f3174793a590dd64f28711d7743a1a480ca69b05c8c2bed0042
Instruction Fuzzy Hash: E1113C66A247D0CAD304CF35E5001AD77B0FB6CB84B44962AFB8987B19EB78D690CB44

Function 00007FF76166EC30 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF76166ED10

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: d85b1203621929becc78f717d9455c77eb8f9cc5392cf1a45e86bbadd8f8e732
Instruction ID: 86a30ae492a913efe4fff8a594758780ed7d923cd8c728bb581dbb2d3997d6d4
Opcode Fuzzy Hash: d85b1203621929becc78f717d9455c77eb8f9cc5392cf1a45e86bbadd8f8e732
Instruction Fuzzy Hash: 0F81BE66B18B99C9EB00DB6AD8883AC6772E755F88F984422CF4D17795CFB8D041C3A1

Function 00007FF76166D310 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction ID: 48ab5c917bfd7214a966e5c009fbec28ee9fa4cd38c87fdbb4fd73bec8a87725
Opcode Fuzzy Hash: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction Fuzzy Hash: 6D611776B19B8482DB10DB19E448679A372EB59BD4F608231DF9D67B88EF7CE441C380

Function 00007FF761671750 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction ID: 8d98ba0d72b435e6d902b0b574ef47519edffd4f7af92d64d6fa8245f4bd477d
Opcode Fuzzy Hash: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction Fuzzy Hash: C3417333B1555487E78CCE2AC8256AD73A3F399704F95C23AEA1A87385DE399905CB40

Function 00007FF7616BF7D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: 4774e8bd2471cb961923170e93ddeffb73e4c3ed96dd8da7773c85313db1f00b
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 27F08C29325767BEFE00853B4624FBD5E419BC0B40FA368B58C80420CB8A9E54A3D714

Function 00007FF76169CB20 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735474b44fecfb17f075a3ff19b93d187b15b809f496c8131696174fb3aa68e8
Instruction ID: 13cde2e6fa666a05cd3c3314394b600d101f6736dbf9a820c17b419314ab7cb7
Opcode Fuzzy Hash: 735474b44fecfb17f075a3ff19b93d187b15b809f496c8131696174fb3aa68e8
Instruction Fuzzy Hash: 84A01122B0AC0AC0A3008B20E2A0E20A222FB88B88380A022880C028208E288002C200

Function 00007FF7616C0824 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8085569c1db706f8df0c680955a88674b0be6f25267714de8c820d55b9c9291
Instruction ID: 5208fb1d6ef3beaab84b2dac38610ed20afbb6b3f924ac371565e5e775ec1379
Opcode Fuzzy Hash: d8085569c1db706f8df0c680955a88674b0be6f25267714de8c820d55b9c9291
Instruction Fuzzy Hash: A2A0026D91EC02D4EB04AB10E958031A3B3FBD4B01FC66035C60D874649FBCB500CB60

Function 00007FF761685360 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76168E0C0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF76167613F), ref: 00007FF76168E0D7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616854ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685501
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685515
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685529
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168553D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685551
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685565
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168558D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616855A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616855B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616855C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616855DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616855F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685605
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685619

Part of subcall function 00007FF76168F7F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168F82E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168562D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685641
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685655
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685669
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168567D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685691
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616856A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616856B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616856CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616856E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616856F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685709
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168571D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685731

Part of subcall function 00007FF7616831B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683138), ref: 00007FF7616831CB
Part of subcall function 00007FF7616831B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683138), ref: 00007FF7616831F9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168575B

Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F971
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F981
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F98F
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F99D
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9AB
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9B9
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9C7
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168579B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616857AB

Strings

Closing connection %ld, xrefs: 00007FF761685459

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: 7fb6fdba045e85df113dbcceb1b70f4c6a01c002728a4962571206f5567d49d1
Instruction ID: b0f0fa79201e66f11b4f47ad3b348037c4ff512043d3ed11a82b11ac1d89305f
Opcode Fuzzy Hash: 7fb6fdba045e85df113dbcceb1b70f4c6a01c002728a4962571206f5567d49d1
Instruction Fuzzy Hash: 73C14C79908B81C2E750AF21E4582AC7326FB85F9CF484235DEAE4B799CF789156C330

Function 00007FF7616A77A0 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A789D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A799E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A7A11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A7A8B

Strings

CSeq, xrefs: 00007FF7616A7ABC
Content-Type: text/parameters, xrefs: 00007FF7616A7D37
Content-Type: application/sdp, xrefs: 00007FF7616A7D6D
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF7616A7B37
OPTIONS, xrefs: 00007FF7616A77A0
Transport, xrefs: 00007FF7616A784E
Session, xrefs: 00007FF7616A7AE9
User-Agent, xrefs: 00007FF7616A797E, 00007FF7616A79AD
CSeq cannot be set as a custom header., xrefs: 00007FF7616A7AD0
Accept: application/sdp, xrefs: 00007FF7616A790A
Failed sending RTSP request, xrefs: 00007FF7616A7E01
Accept-Encoding, xrefs: 00007FF7616A7914
Content-Type, xrefs: 00007FF7616A7D23, 00007FF7616A7D59
Range: %s, xrefs: 00007FF7616A7A93
Range, xrefs: 00007FF7616A7A67
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF7616A78D5
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF7616A7823
Accept-Encoding: %s, xrefs: 00007FF7616A7949
Transport: %s, xrefs: 00007FF7616A78AA
Referer, xrefs: 00007FF7616A7A27
%s%s%s%s%s%s%s%s, xrefs: 00007FF7616A7BF6
Session: %s, xrefs: 00007FF7616A7B6D
Session ID cannot be set as a custom header., xrefs: 00007FF7616A7AFD
Content-Length, xrefs: 00007FF7616A7CDC
Accept, xrefs: 00007FF7616A78F8
Referer: %s, xrefs: 00007FF7616A7A42
Content-Length: %I64d, xrefs: 00007FF7616A7CF7

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 630c380efc76a5ffed2834d8e06e875a5572cadbc702f6c11330fde0c288aba2
Instruction ID: 01ff80d4829218c662cbad8f29de0442ddf769e85c1c49a554ef3585e2a13b31
Opcode Fuzzy Hash: 630c380efc76a5ffed2834d8e06e875a5572cadbc702f6c11330fde0c288aba2
Instruction Fuzzy Hash: 54026129A09783C1EB61FB21A4583BAA392EF44F84F844035CE4D47B99EFBDE545C760

Function 00007FF7616A1240 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A129E
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A12D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A1351
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A136B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A137A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A13C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A13D8

Strings

Mime-Version, xrefs: 00007FF7616A1519
SMTPUTF8, xrefs: 00007FF7616A162A
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF7616A166C
Mime-Version: 1.0, xrefs: 00007FF7616A1534
SIZE=, xrefs: 00007FF7616A1641
<%s@%s>, xrefs: 00007FF7616A1336, 00007FF7616A147A
AUTH=, xrefs: 00007FF7616A1635
%I64d, xrefs: 00007FF7616A158E
<%s>, xrefs: 00007FF7616A1359, 00007FF7616A149D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 50beff97ebaddc7567a4d4a9652863f836772c72075f966d32c1a3f403d900ce
Instruction ID: 78d7849f2f50f916907a30ef1321daced41c342a7010bd29f12689ae66e33d16
Opcode Fuzzy Hash: 50beff97ebaddc7567a4d4a9652863f836772c72075f966d32c1a3f403d900ce
Instruction Fuzzy Hash: 4DD19E29E09B52C1FB51EB25A4182B9A3B2AF45F88FC44535DD8E17B95EFBCE405C320

Function 00007FF7616BE720 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE806
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE902
htonl.WS2_32 ref: 00007FF7616BE92F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE941
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE970
htonl.WS2_32 ref: 00007FF7616BE985
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE9B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA4B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA82
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEA94
memcpy.VCRUNTIME140 ref: 00007FF7616BEAAF
memcpy.VCRUNTIME140 ref: 00007FF7616BEAC3
memcpy.VCRUNTIME140 ref: 00007FF7616BEAD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEB00
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEB09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEB12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEB1B

Strings

GSSAPI handshake failure (empty security message), xrefs: 00007FF7616BE887, 00007FF7616BEB28
GSSAPI handshake failure (invalid security layer), xrefs: 00007FF7616BE916
GSSAPI handshake failure (invalid security data), xrefs: 00007FF7616BE897

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 8613a6aaf9016ec076c90eba3747679c487425defe278e58e2270cd0f603949f
Instruction ID: 6a7f6ebb719918b0fee37d0681dac5c6f60bc78e0f716d407ed82eb749b72130
Opcode Fuzzy Hash: 8613a6aaf9016ec076c90eba3747679c487425defe278e58e2270cd0f603949f
Instruction Fuzzy Hash: 23C15D3AA08A42C6E750EB66E4582ADB7B6FB45F88F804035DE4E57B54CFBCE414C720

Function 00007FF7616B34C0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7616B35A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B35F0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B3846
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B385D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B3878
htons.WS2_32 ref: 00007FF7616B38D7

Strings

%s, xrefs: 00007FF7616B3793
Could not DOH-resolve: %s, xrefs: 00007FF7616B3516
bad error code, xrefs: 00007FF7616B3608
TTL: %u seconds, xrefs: 00007FF7616B3685
CNAME: %s, xrefs: 00007FF7616B37D3
DOH: %s type %s for %s, xrefs: 00007FF7616B3624
DOH AAAA: , xrefs: 00007FF7616B36F2
%s%02x%02x, xrefs: 00007FF7616B373E
AAAA, xrefs: 00007FF7616B3616
DOH Host name: %s, xrefs: 00007FF7616B3671
DOH A: %u.%u.%u.%u, xrefs: 00007FF7616B36BE

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: dd297c6df8cd8424e2bd6f979904963bf5a1dead78cd15da62e6547e348515e1
Instruction ID: 3f14f1e2aad71641341056937ffbd04af2773dae2284b40068a6c52310a01cad
Opcode Fuzzy Hash: dd297c6df8cd8424e2bd6f979904963bf5a1dead78cd15da62e6547e348515e1
Instruction Fuzzy Hash: 2FE19E3AB08A82C6E760EF15E4483B9B7A6FB44F88F844135DA4D47A44DFBCE554CB60

Function 00007FF7616698F8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A054
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A082
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A090
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A0CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A10A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166AAFE

Strings

object, xrefs: 00007FF76166A319
array, xrefs: 00007FF76166A18A
number overflow parsing ', xrefs: 00007FF761669F90

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 45795471a48e67c8abc9e4026c2df720b199cf89e055554f4f9b8d24a099660b
Instruction ID: 73ab7cea7c237483527ee7e1a45429848150005fca873a9268d82de4da282a33
Opcode Fuzzy Hash: 45795471a48e67c8abc9e4026c2df720b199cf89e055554f4f9b8d24a099660b
Instruction Fuzzy Hash: 5712D666A18B85C5FB00EB79E4483ADA332FB41BA4F805235DA5D13AE9DFBCD085C351

Function 00007FF7616AE420 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE4A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE4CC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE4DD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE54B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE57C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE59C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE5AE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE610
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE681
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE698
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE753
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE7C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7616ADBDF), ref: 00007FF7616AE7D0

Strings

sub, xrefs: 00007FF7616AE704
one, xrefs: 00007FF7616AE6B3
onetree, xrefs: 00007FF7616AE6C6
subtree, xrefs: 00007FF7616AE717
base, xrefs: 00007FF7616AE6D9
LDAP, xrefs: 00007FF7616AE466

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: e236e2e6d817617efa494662559fcc5df441cb7a7ccf82c35be98ef86a44c401
Instruction ID: c89d3ccb6a46f2846c7947d2827772bfd5bde4b1684d3b1cada4aeecceb932e9
Opcode Fuzzy Hash: e236e2e6d817617efa494662559fcc5df441cb7a7ccf82c35be98ef86a44c401
Instruction Fuzzy Hash: 21B1C22AA09B92C2FB51EB16A458279A792FF49F84FC48535DE4D47B80EF7CE405C720

Function 00007FF7616AC5F0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF7616AC651
memchr.VCRUNTIME140 ref: 00007FF7616AC687
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7616AC70B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7616AC79B

Strings

tsize parsed from OACK, xrefs: 00007FF7616AC7A4
blksize is larger than max supported, xrefs: 00007FF7616AC841
invalid blocksize value in OACK packet, xrefs: 00007FF7616AC85E
Malformed ACK packet, rejecting, xrefs: 00007FF7616AC88A
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF7616AC877
%s (%d) %s (%d), xrefs: 00007FF7616AC75D
blksize, xrefs: 00007FF7616AC6EF
blksize is smaller than min supported, xrefs: 00007FF7616AC81E
%s (%d), xrefs: 00007FF7616AC825, 00007FF7616AC848
requested, xrefs: 00007FF7616AC74A
%s (%ld), xrefs: 00007FF7616AC802
tsize, xrefs: 00007FF7616AC77F
blksize parsed from OACK, xrefs: 00007FF7616AC743
%s (%ld), xrefs: 00007FF7616AC7AB
got option=(%s) value=(%s), xrefs: 00007FF7616AC6CC
server requested blksize larger than allocated, xrefs: 00007FF7616AC7F8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: 389a94f45e149e10ada5d78404fb401863fe9fe4206c8ef92805649dd6b5d67c
Instruction ID: 1d3774a6eeaed6c61b6bf068bd86a8141636a30d1a3cde43de5353223deb3546
Opcode Fuzzy Hash: 389a94f45e149e10ada5d78404fb401863fe9fe4206c8ef92805649dd6b5d67c
Instruction Fuzzy Hash: 5261B168B08646D5FB54FB16A8182B9E652BF80FE0FD14231D92E47AD1DFBCE106C760

Function 00007FF76167C710 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676067
Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676073

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C9A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C9AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C9D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C9DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167CA60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167CA69

Strings

text/plain, xrefs: 00007FF76167C87C
Content-Type, xrefs: 00007FF76167C798
Content-Type: %s%s%s, xrefs: 00007FF76167CA8D
; boundary=, xrefs: 00007FF76167CA83
; name=", xrefs: 00007FF76167C9FF
multipart/mixed, xrefs: 00007FF76167C805
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF76167CA29
multipart/, xrefs: 00007FF76167C947
multipart/form-data, xrefs: 00007FF76167CB67
Content-Transfer-Encoding: %s, xrefs: 00007FF76167CBF1
attachment, xrefs: 00007FF76167C95B, 00007FF76167C962
Content-Transfer-Encoding, xrefs: 00007FF76167CAD1
Content-Disposition, xrefs: 00007FF76167C8D1
form-data, xrefs: 00007FF76167CC16
application/octet-stream, xrefs: 00007FF76167C836
; filename=", xrefs: 00007FF76167C9F1
8bit, xrefs: 00007FF76167CBEA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: d0f9f5741b8606d7082873dd084e5b5c62746362a97b26e35185e4727763db7a
Instruction ID: 4cf792371871fb7372a4a3d799ac9e62f8164ecefef0a66e5d1ffadc30c7b801
Opcode Fuzzy Hash: d0f9f5741b8606d7082873dd084e5b5c62746362a97b26e35185e4727763db7a
Instruction Fuzzy Hash: 9FE16B2AB08683D2FB65AB1595082B9E7A6FF40F84FC84435CE4E47681DFBCE954C360

Function 00007FF761666320 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761664320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351

memcpy.VCRUNTIME140 ref: 00007FF761666496
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF761666528
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF761666569
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616666B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616666F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761666740
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761666781
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616667DE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761666898

Part of subcall function 00007FF7616BFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7616643FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF7616BFB32

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616668D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616669A6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616669E7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF761666A0A

Strings

unexpected , xrefs: 00007FF761666823
syntax error , xrefs: 00007FF76166636D
; expected , xrefs: 00007FF761666930
rsing , xrefs: 00007FF761666478
; last read: ', xrefs: 00007FF7616665EC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 9d7d61f4c3d02218e256affeb54d8d628810e04e4d710cc77930749f09e94d0a
Instruction ID: de9ce30c05b82254874c51f00a1501bf80504992d28a1ec7ec8fcb8872ed0648
Opcode Fuzzy Hash: 9d7d61f4c3d02218e256affeb54d8d628810e04e4d710cc77930749f09e94d0a
Instruction Fuzzy Hash: E012D666E08682C1EB14EB65F44836DA772EB44BA8F804335DA6D237D9DFBCD484C351

Function 00007FF76167A330 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76167B280: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF76167ACFE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9), ref: 00007FF76167B2A3
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B2F9
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B303
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B30D
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B317
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B321
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B32B
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B335
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B33F
Part of subcall function 00007FF76167B280: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B348

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A427
strchr.VCRUNTIME140 ref: 00007FF76167A441
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A46B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A478
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A4A2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A4B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A4C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A4DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A4EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A4F8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A513
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A52F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A54B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A567
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A583
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A59F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A5BB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A5D3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A66B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF76167A6A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A6E3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: 2e53ff19ecb3a8b38f1d63baef50b79b2243b4e56db0847dfde610ffbf885c05
Instruction ID: 119688f363ce31fdd9e78700db96ef9ba0aaf54d28c8e8eaf194ac082ca235bc
Opcode Fuzzy Hash: 2e53ff19ecb3a8b38f1d63baef50b79b2243b4e56db0847dfde610ffbf885c05
Instruction Fuzzy Hash: 22B1BF29A0AB52C5EF65AF259518378A7A2AF44F94F8C4534CE5D033E4DFBCE451C320

Function 00007FF7616AEB50 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AEB60
strstr.VCRUNTIME140 ref: 00007FF7616AEB8F
strchr.VCRUNTIME140 ref: 00007FF7616AEBBB
strrchr.VCRUNTIME140 ref: 00007FF7616AEBD5
strchr.VCRUNTIME140 ref: 00007FF7616AEBEA
strrchr.VCRUNTIME140 ref: 00007FF7616AEC4A

Strings

., xrefs: 00007FF7616AEC2A
/, xrefs: 00007FF7616AEC63
/, xrefs: 00007FF7616AEBA5
/, xrefs: 00007FF7616AEC1E
?, xrefs: 00007FF7616AEBC8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: edf84e59fab7fdd27706c0db91c8a003d70f39cd99aa0d9cec95167bff697e48
Instruction ID: bae3ae2d1d28374f8aedac3fcbeb6b7e05fb7207d3daae2a2d4f74efd7c28936
Opcode Fuzzy Hash: edf84e59fab7fdd27706c0db91c8a003d70f39cd99aa0d9cec95167bff697e48
Instruction Fuzzy Hash: F681A01AA0C286C5FB65BB269118379EA93AF55F84F884431CA5E06BC6DFBDE441C730

Function 00007FF7616A9A50 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7616A9B23
strchr.VCRUNTIME140 ref: 00007FF7616A9B7A
strchr.VCRUNTIME140 ref: 00007FF7616A9B92
strchr.VCRUNTIME140 ref: 00007FF7616A9BAD
strchr.VCRUNTIME140 ref: 00007FF7616A9C29
strchr.VCRUNTIME140 ref: 00007FF7616A9C41
strchr.VCRUNTIME140 ref: 00007FF7616A9C5C
strchr.VCRUNTIME140 ref: 00007FF7616A9C77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A9D04

Strings

CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF7616A9B5A
/M:, xrefs: 00007FF7616A9AA5
/LOOKUP:, xrefs: 00007FF7616A9B0D
default, xrefs: 00007FF7616A9BD3, 00007FF7616A9C9D
lookup word is missing, xrefs: 00007FF7616A9BC4, 00007FF7616A9C8E
/D:, xrefs: 00007FF7616A9AF6
/DEFINE:, xrefs: 00007FF7616A9ADB
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF7616A9C0A
Failed sending DICT request, xrefs: 00007FF7616A9D11
/FIND:, xrefs: 00007FF7616A9AC0
/MATCH:, xrefs: 00007FF7616A9A8A
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF7616A9CE5

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 74dc52b09e250dfa96fe40e8864fd700ce919b4dbfe9769e74b07d6aad3c018f
Instruction ID: 57b19f57b8d35700764f34febdaa49a8a8f606a1a114496afd5dee3653771545
Opcode Fuzzy Hash: 74dc52b09e250dfa96fe40e8864fd700ce919b4dbfe9769e74b07d6aad3c018f
Instruction Fuzzy Hash: A381A129B0DA82C1FB51BB2595182B9E293AF45FC8FD88031CD4E47B95DFAEE501C670

Function 00007FF761685A80 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685A9C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685AB2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685AC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685AD3

Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F971
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F981
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F98F
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F99D
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9AB
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9B9
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9C7
Part of subcall function 00007FF76167F960: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685B0F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685B23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685B76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685B8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685B9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685BB2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685C1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685C2E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685C42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685C56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685CBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685CFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D0E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D22
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D4A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685D86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761685DA8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 449a3cc694915db61add71a76ad10636cd6fb551218fcf97e3b1d13b969389a6
Instruction ID: 545847e5021b1af2d4770622f232aa6fcd5919bd0f17c6dc76d936c68c8ec371
Opcode Fuzzy Hash: 449a3cc694915db61add71a76ad10636cd6fb551218fcf97e3b1d13b969389a6
Instruction Fuzzy Hash: 4D91D27AA18B81D3E7499F21E9A42A8B368F749F48F444139EFAD47754CF74A271C320

Function 00007FF7616A42C0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A430D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A43FF
strchr.VCRUNTIME140 ref: 00007FF7616A4341

Part of subcall function 00007FF76167B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167B474

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A4567
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A4731
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A4753

Part of subcall function 00007FF76168F7F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168F82E

Strings

%u,%u,%u,%u,%u,%u, xrefs: 00007FF7616A448B
%u.%u.%u.%u, xrefs: 00007FF7616A4573
Weirdly formatted EPSV reply, xrefs: 00007FF7616A441F
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF7616A453B
Can't resolve new host %s:%hu, xrefs: 00007FF7616A467E
Can't resolve proxy host %s:%hu, xrefs: 00007FF7616A4613
Bad PASV/EPSV response: %03d, xrefs: 00007FF7616A477E
%c%c%c%u%c, xrefs: 00007FF7616A437B
Connecting to %s (%s) port %d, xrefs: 00007FF7616A470A
Illegal port number in EPSV reply, xrefs: 00007FF7616A43BF
Couldn't interpret the 227-response, xrefs: 00007FF7616A44AE

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: 7b9e4824925e9b7f55e927efd2cd488aa311533b9d912ce27fe012692574f343
Instruction ID: 5a23b467667e0474574dd49025d6138be3977807bfadfe7bafab36eb1fd83c32
Opcode Fuzzy Hash: 7b9e4824925e9b7f55e927efd2cd488aa311533b9d912ce27fe012692574f343
Instruction Fuzzy Hash: B1D1A829A0C682D2EB54EB25E8442B9E7A6FB45F84F984032DB4D03E55DFFCE560C720

Function 00007FF761684B50 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684E72

Strings

socks, xrefs: 00007FF761684C5A
https, xrefs: 00007FF761684BD4
socks4, xrefs: 00007FF761684C46
socks4a, xrefs: 00007FF761684C2B
socks5, xrefs: 00007FF761684C10
Unsupported proxy syntax in '%s', xrefs: 00007FF761684E5A
Unsupported proxy scheme for '%s', xrefs: 00007FF761684C81
socks5h, xrefs: 00007FF761684BF2
http, xrefs: 00007FF761684C6E
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF761684CB4

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: dac52c557d6dab343f032f78f8b6557e4def98c54edf951fdd99c7becfd0baa9
Instruction ID: bc8821026e881e2b91443281333a000c8c2bf42523a31611340f85a0743a7f48
Opcode Fuzzy Hash: dac52c557d6dab343f032f78f8b6557e4def98c54edf951fdd99c7becfd0baa9
Instruction Fuzzy Hash: 0DA1A02AE08642C5FB90EF51D8586BDA7AABB44F88F844931DE0D53A95DFBCE504C330

Function 00007FF7616A3770 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76169C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF761683D1F), ref: 00007FF76169C9BE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A3846
strchr.VCRUNTIME140 ref: 00007FF7616A3864
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A3894
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A38AF
strchr.VCRUNTIME140 ref: 00007FF7616A38D9
strrchr.VCRUNTIME140 ref: 00007FF7616A38F5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A391F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A393A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A395E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A3976
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A39B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A39F0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A3A8C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A3AB1

Strings

Request has same path as previous transfer, xrefs: 00007FF7616A3A96
Uploading to a URL without a file name!, xrefs: 00007FF7616A39DC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 2efa04c74230399bd258a16cad822e2e5ead02ff0f79d9f2166992b9371edbb0
Instruction ID: 262dbce39162463f48ff6aff8f270b4d5029cb279099a9e56123e11979cb1fc4
Opcode Fuzzy Hash: 2efa04c74230399bd258a16cad822e2e5ead02ff0f79d9f2166992b9371edbb0
Instruction Fuzzy Hash: F491B02AF08782C2EB54EB25A4582B9A7A2FB45F80F844035DF8E07B95DF7CE455C721

Function 00007FF76167ACB0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AD13
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AD8D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167ADB1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE3A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE4C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE5F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE7A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE90
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9,?,?,00000000,00007FF761681F05), ref: 00007FF76167AE99

Strings

%s, xrefs: 00007FF76167AE2B
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF76167AD86
## Fatal libcurl error, xrefs: 00007FF76167AEC7
%s.%s.tmp, xrefs: 00007FF76167AD4A

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 4b9c01196034c60f101e9a56bca8748353508c1149ce0dda7be717e391832c11
Instruction ID: 46c42430445387dfaf194116b8850e957af36a1ab160c66de739817f4b842889
Opcode Fuzzy Hash: 4b9c01196034c60f101e9a56bca8748353508c1149ce0dda7be717e391832c11
Instruction Fuzzy Hash: B6515429A0D646C2FF65BB21A91C27AA3A3AF45F85FC84435DD4E47360EEBCE405D720

Function 00007FF761665480 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616655DE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166560C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166561A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761665654
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616656A5
memset.VCRUNTIME140 ref: 00007FF7616654D3

Part of subcall function 00007FF761664320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351

Part of subcall function 00007FF761666320: memcpy.VCRUNTIME140 ref: 00007FF761666496

Part of subcall function 00007FF761661FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761665812
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166583E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166584C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761665887
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616658DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616659C1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7616659D9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7616659E6

Strings

value, xrefs: 00007FF761665546, 00007FF76166577E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 0ba03602f28abc066c3fcc0a8834273002c93528edaf180a920beb04a508591a
Instruction ID: ca9d761f1cd1a78ea9be8b4d3464f87c2c8ecde9654d2a44726b4427993e2472
Opcode Fuzzy Hash: 0ba03602f28abc066c3fcc0a8834273002c93528edaf180a920beb04a508591a
Instruction Fuzzy Hash: 2FF10B26A087C1C5EB10DB75E4483ADA772EB45BA4F405331EAAD13AEADFBCD085C750

Function 00007FF76169BAF0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF76169BDD7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF76169BE47
CertFreeCertificateContext.CRYPT32 ref: 00007FF76169BE85
CertFreeCertificateContext.CRYPT32 ref: 00007FF76169BE98

Strings

ALPN, server did not agree to a protocol, xrefs: 00007FF76169BC65
schannel: failed to setup memory allocation, xrefs: 00007FF76169BBA1
schannel: failed to setup replay detection, xrefs: 00007FF76169BB66
schannel: failed to setup sequence detection, xrefs: 00007FF76169BB4A
schannel: failed to setup stream orientation, xrefs: 00007FF76169BBC0
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF76169BC38
http/1.1, xrefs: 00007FF76169BC4B
schannel: failed to setup confidentiality, xrefs: 00007FF76169BB82
schannel: failed to retrieve remote cert context, xrefs: 00007FF76169BEB7
schannel: failed to retrieve ALPN result, xrefs: 00007FF76169BC0B
schannel: failed to store credential handle, xrefs: 00007FF76169BD3C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 1f8db8496d7dfd341e118b6003e4d791754c8f8896ec6c0848a44e1d99fd1b2b
Instruction ID: 04762355aaa59d4da7063c2d9c50e811d272dd622416ce9c85f58f1240ecacd6
Opcode Fuzzy Hash: 1f8db8496d7dfd341e118b6003e4d791754c8f8896ec6c0848a44e1d99fd1b2b
Instruction Fuzzy Hash: 98B1B66AA08A83C2EB60AB15D8587B9A393FF84F98FC48471D94D47795CFBCD805C760

Function 00007FF761692310 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7616923C8
strchr.VCRUNTIME140 ref: 00007FF7616923DF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169242B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616925F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761692646
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169264F

Strings

Host:, xrefs: 00007FF7616924A9
%s, xrefs: 00007FF7616925DC
Content-Length:, xrefs: 00007FF76169251B
Transfer-Encoding:, xrefs: 00007FF761692568
Cookie:, xrefs: 00007FF76169259B
Authorization:, xrefs: 00007FF761692581
Connection:, xrefs: 00007FF761692541
Content-Type:, xrefs: 00007FF7616924CF, 00007FF7616924F5
1.1, xrefs: 00007FF76169232B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 15ff60a6d3c237a336e91ef1e3c4139078ef5d79dd09f5cb9ca67aec89cc51db
Instruction ID: f66f6ab1fcbe03c06caa64d182f18185a2204b4b9437c5a5a1aaa14e481828d7
Opcode Fuzzy Hash: 15ff60a6d3c237a336e91ef1e3c4139078ef5d79dd09f5cb9ca67aec89cc51db
Instruction Fuzzy Hash: 4091D729A09683C2FB61EB31D4183B9E792AF45F84FC44479CE4D87685EFADE901C720

Function 00007FF7616BD910 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7616B063F), ref: 00007FF7616BD93D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF7616B063F), ref: 00007FF7616BD95F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7616B063F), ref: 00007FF7616BD970
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7616B063F), ref: 00007FF7616BD99E

Strings

/../, xrefs: 00007FF7616BDA6B
/.., xrefs: 00007FF7616BDAA2
/./, xrefs: 00007FF7616BDA2C
../, xrefs: 00007FF7616BDA09

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: a08b28c9933b0941f2efcac164ecd33f5fb3166c4cd9c360851c52c316a69ecd
Instruction ID: 92634038ac27aa1353b395cfccb45ccf701820bbc7f396340dc9b97e0f5948ce
Opcode Fuzzy Hash: a08b28c9933b0941f2efcac164ecd33f5fb3166c4cd9c360851c52c316a69ecd
Instruction Fuzzy Hash: 8A71EA29E0C692C5FB22FB119518279EBA2AB15F98F844131CE9D0B6D0DFBCE461C330

Function 00007FF7616821C0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761672471,?,?,?,?,00007FF7616635A1), ref: 00007FF7616821D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761682221

Strings

<, xrefs: 00007FF761682337
<, xrefs: 00007FF761682468
v, xrefs: 00007FF7616824CF
`, xrefs: 00007FF7616824BA
<, xrefs: 00007FF76168245E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: fd20e6cdcbd1a73617437685a3d3e5ab8989bec76236420843f0ff4b3c7dbce2
Instruction ID: e82a87db082bdac80162341e1a4a82bf9743d91060483aa06cfb9d8f95548879
Opcode Fuzzy Hash: fd20e6cdcbd1a73617437685a3d3e5ab8989bec76236420843f0ff4b3c7dbce2
Instruction Fuzzy Hash: 3E914936908BC1C6E3509F34D4083E877A1FB59F5CF485238CE991A79ADFBAA095C720

Function 00007FF7616B8511 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B8542
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8BBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8BF8

Strings

%s, xrefs: 00007FF7616B8BE6
-----END CERTIFICATE-----, xrefs: 00007FF7616B8B47
FALSE, xrefs: 00007FF7616B852D
Cert, xrefs: 00007FF7616B8BCE
Signature: %s, xrefs: 00007FF7616B89F7
TRUE, xrefs: 00007FF7616B8534
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7616B8A9C
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 70e30d1e3deb7aee05ef397fcba1ec1dd57ac269af20da9b052408b51782595d
Instruction ID: 137f975073327f5a4f771ab7c447275ae3fd575e110496541c4e9b9bc2a6406d
Opcode Fuzzy Hash: 70e30d1e3deb7aee05ef397fcba1ec1dd57ac269af20da9b052408b51782595d
Instruction Fuzzy Hash: BD71EAAAD0D7C2C5EB11EB2990182B9FBA6EF46F48F984032CA4D43362DF6DD055D721

Function 00007FF7616B2580 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2642
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B267A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B268D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B26C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B26CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B278B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2796
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B288A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B290B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B291F

Part of subcall function 00007FF7616B2D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616B4BFA,?,?,00000000,00007FF7616B1635), ref: 00007FF7616B2D20
Part of subcall function 00007FF7616B2D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616B4BFA,?,?,00000000,00007FF7616B1635), ref: 00007FF7616B2D31
Part of subcall function 00007FF7616B2D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616B4BFA,?,?,00000000,00007FF7616B1635), ref: 00007FF7616B2D43

Strings

WDigest, xrefs: 00007FF7616B262C, 00007FF7616B2744
DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF7616B292C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: 3d979c6cc7bd14e6c2ad7290a7be4d6b36be52882975864e4d86410aa6b77bbe
Instruction ID: d1cefe9ce8489680f8acf6bf506a1cd1dbb6bf5df060fadf7622398f639c5bef
Opcode Fuzzy Hash: 3d979c6cc7bd14e6c2ad7290a7be4d6b36be52882975864e4d86410aa6b77bbe
Instruction Fuzzy Hash: A9B16C7AA08B46C6EB10EF25E8582ADB7A6FB48B88F800039DE4D43B54DF7CE555C750

Function 00007FF7616B92D0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B93E3

Strings

dsa(p), xrefs: 00007FF7616B947D
dsa(g), xrefs: 00007FF7616B94DC
RSA Public Key (%lu bits), xrefs: 00007FF7616B939E
dsa(q), xrefs: 00007FF7616B94AC
RSA Public Key, xrefs: 00007FF7616B93CF
dh(g), xrefs: 00007FF7616B9570
dhpublicnumber, xrefs: 00007FF7616B9506
dsa(pub_key), xrefs: 00007FF7616B94F2
rsa(e), xrefs: 00007FF7616B941B
dsa, xrefs: 00007FF7616B9445
rsa(n), xrefs: 00007FF7616B93F0
%lu, xrefs: 00007FF7616B93B8
dh(pub_key), xrefs: 00007FF7616B9586
dh(p), xrefs: 00007FF7616B953F
rsaEncryption, xrefs: 00007FF7616B9315

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 9e8e4190fbbe9dbac736ea4e8f4861b9deb4eea0a2613b1050bd1a2de14b6a8a
Instruction ID: 674fb9721d454ea21b0277c5e7ba8c3ac925bb7e25597c85bf25a4a8b24c3af3
Opcode Fuzzy Hash: 9e8e4190fbbe9dbac736ea4e8f4861b9deb4eea0a2613b1050bd1a2de14b6a8a
Instruction Fuzzy Hash: B9718FAAA09742D1EB14FB21A1481F9A352FF99F88FC44032DE4D43799EEBCE511C760

Function 00007FF7616AF6AC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF918
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF970
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF97D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA7F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFACE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFAE6

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: b00e4fd80b47b58873b5033442e7745e1c8edbf3f5bc81cfb43fb87cb640654b
Instruction ID: 1422534c99013f71d2d870ac795fe11afeef311313a7284e2ce04c18617fe770
Opcode Fuzzy Hash: b00e4fd80b47b58873b5033442e7745e1c8edbf3f5bc81cfb43fb87cb640654b
Instruction Fuzzy Hash: C7A1EB19D0D692C5FB616B21951837DEBE29F05F84F8944B1DE8E46AC1DEACE405C332

Function 00007FF76169D990 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF76169D9E8

Strings

FETCH, xrefs: 00007FF76169DB5C, 00007FF76169DC72
, xrefs: 00007FF76169D9F1
STORE, xrefs: 00007FF76169DC1A
SEARCH, xrefs: 00007FF76169DAFC, 00007FF76169DCCF
LSUB, xrefs: 00007FF76169DCFF
SELECT, xrefs: 00007FF76169DC9F
NOOP, xrefs: 00007FF76169DD2F
LIST, xrefs: 00007FF76169DBCC
EXAMINE, xrefs: 00007FF76169DCB7
EXPUNGE, xrefs: 00007FF76169DCE7
CAPABILITY, xrefs: 00007FF76169DDB0
PREA, xrefs: 00007FF76169DA24
UID, xrefs: 00007FF76169DD17
Unexpected continuation response, xrefs: 00007FF76169DE2E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: d740d961fa4bdd8deb1286ed72fc9618fc2868aaaa0fee692128bcc4af27af90
Instruction ID: 5031b6573b853fb0fc6dd7364b325823eca7553b6a56ea73c9fafca4d08df16e
Opcode Fuzzy Hash: d740d961fa4bdd8deb1286ed72fc9618fc2868aaaa0fee692128bcc4af27af90
Instruction Fuzzy Hash: A0D17D6AA0C243C2FB647A15C55C2B8E693AF51F94FC448B2DA0D4A5D9EFECED05C321

Function 00007FF7616991C0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF761699476), ref: 00007FF7616991DB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616991FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169921C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761699225

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: ae1d98bfd8e04e6bfd092f3e447af08f8539a1ef12be664cab5b6475120f3e2f
Instruction ID: 6712ce61f63b060d1a4aba57583976b9be06c58b26f3677a44f398249d0da15e
Opcode Fuzzy Hash: ae1d98bfd8e04e6bfd092f3e447af08f8539a1ef12be664cab5b6475120f3e2f
Instruction Fuzzy Hash: 0C617C6AA05B42C7EB25DF12A45822DB3A2FB48F98B858475CE4D43750EF7CE894C320

Function 00007FF7616A22E0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A2400

Strings

No data was received!, xrefs: 00007FF7616A273C
Remembering we are in dir "%s", xrefs: 00007FF7616A2498
server did not report OK, got %d, xrefs: 00007FF7616A266E
Received only partial file: %I64d bytes, xrefs: 00007FF7616A270E
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF7616A26D6
Failure sending ABOR command: %s, xrefs: 00007FF7616A2521
partial download completed, closing connection, xrefs: 00007FF7616A2633
ABOR, xrefs: 00007FF7616A24FB
control connection looks dead, xrefs: 00007FF7616A25F2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: 0577d7df4036a8ec348db05af5e8fb1d9fd72d54564ee0a42281e9bfc4ed7481
Instruction ID: 163a7c5536ce292551c24ff68c4f6bae26c5e3d2ab6396134dfddfe94a5eaac4
Opcode Fuzzy Hash: 0577d7df4036a8ec348db05af5e8fb1d9fd72d54564ee0a42281e9bfc4ed7481
Instruction Fuzzy Hash: 1DD1E729A4D682C6EB74FB3295183B9E652FB45B54FC44239CAAD03AC1DFACE455C320

Function 00007FF76166A7B2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761664320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351

Part of subcall function 00007FF761666320: memcpy.VCRUNTIME140 ref: 00007FF761666496

Part of subcall function 00007FF761661FC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662131

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A861
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A88F
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166A89D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A8D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A934
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166AA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166AA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166AA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166AAB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166AAFE

Strings

value, xrefs: 00007FF76166A7D0, 00007FF76166A959

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 5326661d5e7fbd7017e2f05cc9af570629d592ff744eb586dc6c91cc8db18cda
Instruction ID: 20ab69b1ae746c2b251adef629d4e43f35d2f3b6b915b1d81e6bcbf3218e8316
Opcode Fuzzy Hash: 5326661d5e7fbd7017e2f05cc9af570629d592ff744eb586dc6c91cc8db18cda
Instruction Fuzzy Hash: 96A1BB66A18A95C1FB00EB79E4483AD6332FB41BA4F901335DA6D12AE9DFBCD085C750

Function 00007FF76167A920 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A98D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A9AD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167A9E1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167AA02
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167AA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167AA36
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167AA58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167AB0F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167AB24

Strings

none, xrefs: 00007FF76167A9A2
Set-Cookie:, xrefs: 00007FF76167AA96
ignoring failed cookie_init for %s, xrefs: 00007FF76167AA62

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: b31a089bcb1d51404a75fdc29caff769068543d3efb01ad91f06bb5c9c76cb41
Instruction ID: 87340cad48469e84914ca1f3174ab7dd1edb5d27445e4c416815dda8953486e3
Opcode Fuzzy Hash: b31a089bcb1d51404a75fdc29caff769068543d3efb01ad91f06bb5c9c76cb41
Instruction Fuzzy Hash: 7961C12AA0C782C1EB55BB2195182BAA796FF45F84FC84435DE8D077A1DFBCE405C720

Function 00007FF7616B5240 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B52B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B52D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B52F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B52FF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B5386
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B53D5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B5436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B55BC

Strings

HTTP, xrefs: 00007FF7616B5240
Negotiate, xrefs: 00007FF7616B5244, 00007FF7616B534C, 00007FF7616B53F3
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF7616B5486
CompleteAuthToken failed: %s, xrefs: 00007FF7616B5617
InitializeSecurityContext failed: %s, xrefs: 00007FF7616B55DA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: 0d6b655dcbdeab51feffedeff9afb7f8b29fec1c10cdc3d2b61d959f6e169dc5
Instruction ID: cd24cb7bc4080ffdcdfdc7dcf04bc67492255b4867ef4b9d018ec7520aad0609
Opcode Fuzzy Hash: 0d6b655dcbdeab51feffedeff9afb7f8b29fec1c10cdc3d2b61d959f6e169dc5
Instruction Fuzzy Hash: 1FC18D7AA05B51C6EB10EF25E4542ADB7A6FB44F88F800036DE4D87B58DFB8D850CB60

Function 00007FF7616B7120 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B71D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7239
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B725C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B72BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B732C

Strings

Issuer: %s, xrefs: 00007FF7616B72AA
TRUE, xrefs: 00007FF7616B7391
%2d Subject: %s, xrefs: 00007FF7616B7224
Issuer, xrefs: 00007FF7616B7290
%lx, xrefs: 00007FF7616B72FC
Subject, xrefs: 00007FF7616B720A
Version, xrefs: 00007FF7616B7317
Version: %lu (0x%lx), xrefs: 00007FF7616B733E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: ad1976b87a44fb8d818fdb44e7480ec08fb280e608e4c6ec3807d1ae1869fbba
Instruction ID: a82c09f3b3ccae671e582bfc9c67943499e8f4fc47ca3f5f6be0f4e71cc2e284
Opcode Fuzzy Hash: ad1976b87a44fb8d818fdb44e7480ec08fb280e608e4c6ec3807d1ae1869fbba
Instruction Fuzzy Hash: CB61FF69A09782C5EB11EB25A41C3FAA3A2BB45B88FC44536CD4D077D5EFBCE114C320

Function 00007FF7616AA630 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7616AA69B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AA7C5

Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676067
Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676073

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AA77F

Part of subcall function 00007FF761675FA0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761675FB0

Strings

NEW_ENV, xrefs: 00007FF7616AA7E1
%hu%*[xX]%hu, xrefs: 00007FF7616AA849
%127[^= ]%*[ =]%255s, xrefs: 00007FF7616AA740
XDISPLOC, xrefs: 00007FF7616AA79B
Syntax error in telnet option: %s, xrefs: 00007FF7616AA8D6
TTYPE, xrefs: 00007FF7616AA755
Unknown telnet option %s, xrefs: 00007FF7616AA8BD
USER,%s, xrefs: 00007FF7616AA6C0
BINARY, xrefs: 00007FF7616AA86E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: e5b4f2103c453911aedcd51cbfc018986ff4a876cf622d445cf5e43f37735157
Instruction ID: 2209d3be3925957eece9d9ea73f225cad8cd87a65bf7a593bbf1b1aedd63f84c
Opcode Fuzzy Hash: e5b4f2103c453911aedcd51cbfc018986ff4a876cf622d445cf5e43f37735157
Instruction Fuzzy Hash: 8E714D35A086C2D0FB21AF14D4496E9A362FF84B88FC54132DA4D476A9EFBCD546C760

Function 00007FF7616AD730 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7616AD8A3
sendto.WS2_32 ref: 00007FF7616AD95C
WSAGetLastError.WS2_32 ref: 00007FF7616AD96A

Strings

tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF7616AD914
tftp_tx: internal error, event: %i, xrefs: 00007FF7616AD788
Received ACK for block %d, expecting %d, xrefs: 00007FF7616AD8F5
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7616AD79D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 7bbb2639de61ab8c1464d414514da25b57dc3edd0b8e6112f819213a615a5998
Instruction ID: 2b51e04673be8b5a3b834f96f349a6061dcf08d1212bde2867a01d66acf17ff0
Opcode Fuzzy Hash: 7bbb2639de61ab8c1464d414514da25b57dc3edd0b8e6112f819213a615a5998
Instruction Fuzzy Hash: C5B1907A608682C6D761AF39D4483ADB7A2FB88F88F844136CE4D4BB58DF78D441C760

Function 00007FF7616AB160 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7616AB35C
WSAGetLastError.WS2_32 ref: 00007FF7616AB36E
send.WS2_32 ref: 00007FF7616AB466
WSAGetLastError.WS2_32 ref: 00007FF7616AB470

Strings

%c%c%c%c, xrefs: 00007FF7616AB23D
%c%s%c%s, xrefs: 00007FF7616AB300
Sending data failed (%d), xrefs: 00007FF7616AB374, 00007FF7616AB476
#, xrefs: 00007FF7616AB3DE
%c%c, xrefs: 00007FF7616AB338
%c%c%c%c%s%c%c, xrefs: 00007FF7616AB43F
%127[^,],%127s, xrefs: 00007FF7616AB2C8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: b789f81208a5b9aa444f3937666235559fc3fee082451b45fb7e3bbc3329918e
Instruction ID: 1df2f4857cc70213ddfad27061ba1870c361ed49ce6dc8143478b4a059658ec1
Opcode Fuzzy Hash: b789f81208a5b9aa444f3937666235559fc3fee082451b45fb7e3bbc3329918e
Instruction Fuzzy Hash: 2791C036A08AC5C5F721AF24E4497EAA3A2FB84B68F844231EE4D07B95DF7CD145C750

Function 00007FF7616ACB10 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7616ACC88
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7616ACCA3
sendto.WS2_32 ref: 00007FF7616ACD0A
sendto.WS2_32 ref: 00007FF7616ACDC1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7616ACDF9

Strings

tftp_rx: internal error, xrefs: 00007FF7616ACB5E
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF7616ACE01
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7616ACB82
Received last DATA packet block %d again., xrefs: 00007FF7616ACD55

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 5da9b6a1b2756f2ded443be3f07f7f48c2e16873579ccd0a2f5785fbcf2abef3
Instruction ID: 3e3aead7e162e9f8f52b1a6c5975bdb114ebcb5bfb03798d98ab41dbcae5e8e7
Opcode Fuzzy Hash: 5da9b6a1b2756f2ded443be3f07f7f48c2e16873579ccd0a2f5785fbcf2abef3
Instruction Fuzzy Hash: 45919D3A608781C6D751DF29D4483A9BBA2FB88F88F848136CE4D8B758DF79D506C760

Function 00007FF761684700 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168473D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616847BF
strchr.VCRUNTIME140 ref: 00007FF76168483E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF76168486C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168488D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168489F

Strings

Invalid IPv6 address format, xrefs: 00007FF761684827
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF7616847C9
No valid port number in connect to host string (%s), xrefs: 00007FF7616848CB
%25, xrefs: 00007FF7616847B5

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: 87368c59f9fe8063e5992f5de28ffce5ae937202ea33b7f2a591c5681f9ad303
Instruction ID: 41214161183424e00954fd88d129cb4911a635f9f3d570febb2520e3f631450f
Opcode Fuzzy Hash: 87368c59f9fe8063e5992f5de28ffce5ae937202ea33b7f2a591c5681f9ad303
Instruction Fuzzy Hash: 9851F569E187D2C5FBA1BB259468379A7D7AF01F88F884031CA4D46AC1DEECE445C730

Function 00007FF76167A710 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A74E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167A76E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167A7A0
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167A7BD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A7DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A7EC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167A80C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF761674960), ref: 00007FF76167A8BF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF761674960), ref: 00007FF76167A8D5

Strings

none, xrefs: 00007FF76167A763
Set-Cookie:, xrefs: 00007FF76167A846

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 17cfc58c2ff132a4fc18a63d81c33083011eece3fc44a1e24eabeae53038068d
Instruction ID: b73a90bf0df13b3da2582481e56bf6e51d49e692e46304ad35fd7d135d419e60
Opcode Fuzzy Hash: 17cfc58c2ff132a4fc18a63d81c33083011eece3fc44a1e24eabeae53038068d
Instruction Fuzzy Hash: A251C329A0D782C1FB55BB21A418279E6A2BF45F84F8D4434DE9E037A1DFBCE442C720

Function 00007FF76168C2E0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF76168C676

Strings

Unable to allocate trailing headers buffer !, xrefs: 00007FF76168C353
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF76168C60A
%zx%s, xrefs: 00007FF76168C597
Moving trailers state machine from initialized to sending., xrefs: 00007FF76168C321
operation aborted by trailing headers callback, xrefs: 00007FF76168C46D
Successfully compiled trailers., xrefs: 00007FF76168C3BA
read function returned funny value, xrefs: 00007FF76168C51B
Signaling end of chunked upload after trailers., xrefs: 00007FF76168C6C0
Read callback asked for PAUSE when not supported!, xrefs: 00007FF76168C4D9
operation aborted by callback, xrefs: 00007FF76168C44D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: d138500cbaf182bc5e16dc619f2f2d0803747c55357b2c7ce644f458475db220
Instruction ID: 753798723888e86527a5a4ecab0a4f39c21f6fd477fc916786835e6172d6a311
Opcode Fuzzy Hash: d138500cbaf182bc5e16dc619f2f2d0803747c55357b2c7ce644f458475db220
Instruction Fuzzy Hash: C7A17229A18A82C1E790EF25D8583F9A392EB45F98F845131DE4E4B785DFBCE445C330

Function 00007FF76169E2F0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169E420
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169E436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169E499

Strings

Mime-Version, xrefs: 00007FF76169E526
Mime-Version: 1.0, xrefs: 00007FF76169E541
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF76169E5CD
Cannot SELECT without a mailbox., xrefs: 00007FF76169E44F
SELECT %s, xrefs: 00007FF76169E485
Cannot APPEND with unknown input file size, xrefs: 00007FF76169E597
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF76169E308
Cannot APPEND without a mailbox., xrefs: 00007FF76169E4C4

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: be4495601e09c0e77f4391925541b9df5882915bdba6fd6e21452db4e1504eff
Instruction ID: 4aebf814b8ed44d2d494f9115b7615cc836d4e035b4f1ea79e84afcb6f4d5a25
Opcode Fuzzy Hash: be4495601e09c0e77f4391925541b9df5882915bdba6fd6e21452db4e1504eff
Instruction Fuzzy Hash: 49919129B09B83D3FB64AB22D558379A292FF45F84F844875DA4D47691EFACE840C360

Function 00007FF76168EA70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168EB01
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168EB48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168EBE4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168EBFA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168EC1B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168EC6A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF76168ECBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168ECEF

Strings

:%u, xrefs: 00007FF76168EC7E
Shuffling %i addresses, xrefs: 00007FF76168EAEA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: b9b3a82cc03fa1a9ec4c17c3365a74312543c7d8770aac4085486b2e519becef
Instruction ID: c4a76f5a788768acf28684360925d283ab81d17b95058e5504833f6c8030f8ed
Opcode Fuzzy Hash: b9b3a82cc03fa1a9ec4c17c3365a74312543c7d8770aac4085486b2e519becef
Instruction Fuzzy Hash: 3C71D679A09A82C1EBA4AF16E5187B9A362FB48F98F844531CE5E07790DFBCD445C320

Function 00007FF76168C6E0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168C75A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168C775
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168C7F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168C87C

Strings

Issue another request to this URL: '%s', xrefs: 00007FF76168C887
HEAD, xrefs: 00007FF76168C8E7
Switch from POST to GET, xrefs: 00007FF76168C946
Maximum (%ld) redirects followed, xrefs: 00007FF76168C847
Switch to %s, xrefs: 00007FF76168C907
GET, xrefs: 00007FF76168C8EE

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: dd9d7af58e6bbe8eb93ee73e5defa075ebf5cb275832164a3fb021438fdb4af6
Instruction ID: f168e68a4491509a6efd35b5a7bffc9318eeddedc30ca16cd6546032dfd4453f
Opcode Fuzzy Hash: dd9d7af58e6bbe8eb93ee73e5defa075ebf5cb275832164a3fb021438fdb4af6
Instruction Fuzzy Hash: 3871C66AA0C783C0EBA0AB2494483FDA7A2EB45F94F980135DE4E47A95CFBCD441C771

Function 00007FF761681880 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616818FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168191A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168192E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168194A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681967
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168198A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF76168199E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616819B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616819D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF7616819EC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A4F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A5C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761681F05), ref: 00007FF761681A85

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 95def14f1c7f15620b6fe9dc28262b73bc3905a93dfb7c3e10dc90a189a3b1e2
Instruction ID: 7a44b8cec7efd3f3043391529af92125f2e1b750090dae3adf9bb0cb58de3742
Opcode Fuzzy Hash: 95def14f1c7f15620b6fe9dc28262b73bc3905a93dfb7c3e10dc90a189a3b1e2
Instruction Fuzzy Hash: 9A51FE39909A82C1EB54AF21E8682FDA3A2FF85F88F884435DE5E4B655CF789451C330

Function 00007FF7616AFB01 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA7F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFB7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFBE6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFBFE

Part of subcall function 00007FF7616AEB50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AEB60

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFC26
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFC3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFC62
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFCAF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFCC4

Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE0C
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE16
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE20
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE2A
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE34
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE3E
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE48
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE52
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE5C
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE66
Part of subcall function 00007FF7616AFE00: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616AEE32,?,?,00000000,00007FF761685F3B,?,?,00000000,00007FF761681983,?,?,00000000,00007FF761681F05), ref: 00007FF7616AFE70

Strings

:, xrefs: 00007FF7616AFB27
,, xrefs: 00007FF7616AFB44

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 0eb6ece5634b4d6ba9c8edbd0182869b858a6f28525a42b74bdcd66481e9c926
Instruction ID: 0adb48c42f1e28a606b0687c601fa76885a6303179a8391a11b0d2266deb90c7
Opcode Fuzzy Hash: 0eb6ece5634b4d6ba9c8edbd0182869b858a6f28525a42b74bdcd66481e9c926
Instruction Fuzzy Hash: 7E518716E0CB86C2F721AB3595282BDA362BF55F88F449174CF8E12952EFACF5D48311

Function 00007FF76167D240 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF76167D287
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF76167D297
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167D2AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167D32A
strrchr.VCRUNTIME140 ref: 00007FF76167D347
strrchr.VCRUNTIME140 ref: 00007FF76167D357
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167D387
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167D393
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167D3A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167D3B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167D3C9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 84dbd7d387848211ce90fc92c2da0d7d496f12dbdcdf86f95287380649613b1b
Instruction ID: 63e21bd9e03536bbf6db4c1eee34a89a1f310a869986d8602b235e5491c36dc8
Opcode Fuzzy Hash: 84dbd7d387848211ce90fc92c2da0d7d496f12dbdcdf86f95287380649613b1b
Instruction Fuzzy Hash: 64418069B09B06C5FB10BB11A458379A2A2FF49FA4F844534DE5E47B90EFBCE415C720

Function 00007FF761682570 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7616825A8
strchr.VCRUNTIME140 ref: 00007FF7616825CF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761682684
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616826AA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616826CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616826DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616826E5
memcpy.VCRUNTIME140 ref: 00007FF761682703
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761682717
memcpy.VCRUNTIME140 ref: 00007FF761682734
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761682749
memcpy.VCRUNTIME140 ref: 00007FF761682761
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761682776

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: bd7767ed242e23caaf6037ae44a9cf72ff2c28187d5f66eb61473461553de434
Instruction ID: caaa131873699acb128bb705c9317aee132a88633482f32cd644b116ed3923b3
Opcode Fuzzy Hash: bd7767ed242e23caaf6037ae44a9cf72ff2c28187d5f66eb61473461553de434
Instruction Fuzzy Hash: 0E51B529B09791C6EBA4AF25A518279E292BF44FC8F884439DE8D47B44DFBCE455C330

Function 00007FF761684490 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616844D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616844E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168450C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761684519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684542
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684580
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168458D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF761684619

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 7dce388daf7c0360c429ed901a4c1932f585a7893eb07c867ca39c62f188127c
Instruction ID: 57218de7ce3831b41a2f32ed5884d0bc975b9eeb97064a72790aeabf5f1f8672
Opcode Fuzzy Hash: 7dce388daf7c0360c429ed901a4c1932f585a7893eb07c867ca39c62f188127c
Instruction Fuzzy Hash: 4671E52AA08B92C2E7A5EB25D458369A7A6FB44F48F444035CB5D47B90DFFDE450C330

Function 00007FF76168444D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616844D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616844E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168450C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761684519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684542
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684580
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168458D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF761684619

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 730130e72ca5b2f77c77e0587357a2e092e42673f74bbb5f9fb3c086bc5617db
Instruction ID: 6370a7a963e67c9b1120843957c40fb7c4ff435bcd4633b9e17c583bcd157089
Opcode Fuzzy Hash: 730130e72ca5b2f77c77e0587357a2e092e42673f74bbb5f9fb3c086bc5617db
Instruction Fuzzy Hash: 3651D06AA08B82C2EBA5AB25E46836DA7A5FB44F48F854031CB5D47B50DFBCE450C330

Function 00007FF76167278E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
SEC_E_CERT_EXPIRED, xrefs: 00007FF76167278E
%s - %s, xrefs: 00007FF761672BA9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: 8904872445799dc1951122d08534c98c99bda82e2818c7aac7f99ee106927005
Instruction ID: b2dd1edd85660958a5f2527972f22fefdeb69075e49529267428d9f855699770
Opcode Fuzzy Hash: 8904872445799dc1951122d08534c98c99bda82e2818c7aac7f99ee106927005
Instruction Fuzzy Hash: 9D312D2AA0D6C1C5E761EF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF761672782 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
SEC_E_CANNOT_PACK, xrefs: 00007FF761672782
%s - %s, xrefs: 00007FF761672BA9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 840bd877c669b48a6a94fe034f9355eb143cb0b64956bc24ea057a86771c70ac
Instruction ID: 47dfad16eeaa646a7d63aba7dd830c8044e7783fb5b0ad74e261369fc2bf0c19
Opcode Fuzzy Hash: 840bd877c669b48a6a94fe034f9355eb143cb0b64956bc24ea057a86771c70ac
Instruction Fuzzy Hash: 42312D2AA0D6C1C5E761EF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF76167276A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
%s - %s, xrefs: 00007FF761672BA9
SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF76167276A

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 660b00ea6d2708d63aff5c1d89183b731f15090953f73bcd8295e0b2a5769022
Instruction ID: 330a3fa6e13e606e6c1ad57ffa5b702725eb75eb65aa44a763cfa6da23f8424c
Opcode Fuzzy Hash: 660b00ea6d2708d63aff5c1d89183b731f15090953f73bcd8295e0b2a5769022
Instruction Fuzzy Hash: 3431212A60D6C1C5E761EF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF761672776 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
SEC_E_CANNOT_INSTALL, xrefs: 00007FF761672776
%s - %s, xrefs: 00007FF761672BA9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: 1bf145a435fb618fef3f911721eddb159762ac6c7d7498e0217c3f5d397e766c
Instruction ID: 5e26bde85dbb3e456133c96b2bcedd756ece224cb99f8be034c244456f081845
Opcode Fuzzy Hash: 1bf145a435fb618fef3f911721eddb159762ac6c7d7498e0217c3f5d397e766c
Instruction Fuzzy Hash: 2931212A60D6C1C5E761EF30E4593BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF76167275E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
%s - %s, xrefs: 00007FF761672BA9
SEC_E_BAD_PKGID, xrefs: 00007FF76167275E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: c63af1cd2aabe92ea6c560fb305aaf36189a3a90deb3d1dd0a1db05c7edba30e
Instruction ID: db8f19ac1050427a099a11775041938a7f397e4a3d7cc969e8fc1efb08ffe01f
Opcode Fuzzy Hash: c63af1cd2aabe92ea6c560fb305aaf36189a3a90deb3d1dd0a1db05c7edba30e
Instruction Fuzzy Hash: 8C31212A60D6C1C5E761EF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF761672752 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
%s - %s, xrefs: 00007FF761672BA9
SEC_E_BAD_BINDINGS, xrefs: 00007FF761672752

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: 014b7078a5638918f36abdcc571b31f9088153de8ebe60f2355983b34161cd2c
Instruction ID: d28c62bd1c82cd5a0617a1abc67d06ed87914b50d94683322a9658ca289ccea0
Opcode Fuzzy Hash: 014b7078a5638918f36abdcc571b31f9088153de8ebe60f2355983b34161cd2c
Instruction Fuzzy Hash: 1A312F6AA0D6C1C5E761EF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF76167279A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
%s - %s, xrefs: 00007FF761672BA9
SEC_E_CERT_UNKNOWN, xrefs: 00007FF76167279A

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 39d8055be6ec056283ed4960e21ca087c558c9f9d2422bf2f03a300a2b34b755
Instruction ID: bb47d41025afd67a783ff37f04c9b29a4cbe69d0cbefe9be81d1d06de08fee93
Opcode Fuzzy Hash: 39d8055be6ec056283ed4960e21ca087c558c9f9d2422bf2f03a300a2b34b755
Instruction Fuzzy Hash: 76312D2AA0D6C1C5E761EF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF76167269E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7616726F9
strchr.VCRUNTIME140 ref: 00007FF761672720
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761672BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BCA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672BD5
GetLastError.KERNEL32 ref: 00007FF761672BDE
SetLastError.KERNEL32 ref: 00007FF761672BEA

Strings

%s (0x%08X), xrefs: 00007FF7616726A5
%s - %s, xrefs: 00007FF761672BA9
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF76167269E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: a90a319c955fa056155f22b8ab89f66d967a83091b8405e3dea220e42267a1f4
Instruction ID: 5835b52e4c59aacca6feaa93387e46bdc3dbe6bdf0942f43170a1296abe25a12
Opcode Fuzzy Hash: a90a319c955fa056155f22b8ab89f66d967a83091b8405e3dea220e42267a1f4
Instruction Fuzzy Hash: 95312D2A60D6C2C5E761AF30E4583BAB7A6FB84F44F80053ADA8D02A95DF7CD544CB20

Function 00007FF76167B280 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF76167ACFE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7616819C9), ref: 00007FF76167B2A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B2F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B303
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B30D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B317
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B321
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B32B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B335
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B33F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167B348

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 794ec81e754e4059ed5435738d62d671d13dfc205665a64c9ad2aac622e1363a
Instruction ID: db4da757f16a9700927b165383a9720c6011369e12cd0a11e99d0ae570db87c2
Opcode Fuzzy Hash: 794ec81e754e4059ed5435738d62d671d13dfc205665a64c9ad2aac622e1363a
Instruction Fuzzy Hash: 18212F3AA09A41C1EB20AF22E85823DA371FB49F98F488435DE9E53754DEBCD455C360

Function 00007FF761667409 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF761667957
invalid number; expected digit after '.', xrefs: 00007FF7616677A7

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 458a01d5bfcce189351ee8b925d4386c51c3ca0d126a416866c77a1180e90565
Instruction ID: ecbedd9830e67e661f5cd3ca9b3851aa238626f9bdbd60bdf8fa9ce6fd391914
Opcode Fuzzy Hash: 458a01d5bfcce189351ee8b925d4386c51c3ca0d126a416866c77a1180e90565
Instruction Fuzzy Hash: A8B1716A908A81C5E7249F28D44823CB772F715F58FE44635CA5E132D8DFBCE985C3A2

Function 00007FF7616BEB50 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEC1A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEC68
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BECCB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BEE09

Part of subcall function 00007FF7616B2BB0: strchr.VCRUNTIME140(00000000,?,?,00007FF7616B216F), ref: 00007FF7616B2BF6
Part of subcall function 00007FF7616B2BB0: strchr.VCRUNTIME140(00000000,?,?,00007FF7616B216F), ref: 00007FF7616B2C06
Part of subcall function 00007FF7616B2BB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7616B216F), ref: 00007FF7616B2C30
Part of subcall function 00007FF7616B2BB0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B2C65
Part of subcall function 00007FF7616B2BB0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B2C8A
Part of subcall function 00007FF7616B2BB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B2CAC

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616BEE94

Strings

GSSAPI, xrefs: 00007FF7616BEB53
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF7616BED13
Kerberos, xrefs: 00007FF7616BEBE3, 00007FF7616BEC85

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 0c0948d19c927711db8b8bf866371c90e3d7f7b82c2d8019d98afbb20a8a4cda
Instruction ID: f98c2c2cb11bc920c5838af517b7da647f66389189ab878ea11a1bb1d52233f4
Opcode Fuzzy Hash: 0c0948d19c927711db8b8bf866371c90e3d7f7b82c2d8019d98afbb20a8a4cda
Instruction Fuzzy Hash: F4A14A3AA08B45CAEB50EF66E4442ADB3A6FB44F88F800035DE4D57758DFB8E465C750

Function 00007FF761679AC5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679B0A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679B2A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679B7B

Part of subcall function 00007FF76167B390: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167B396

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679C81

Strings

FALSE, xrefs: 00007FF761679C5B
Added, xrefs: 00007FF761679F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF761679F27
Replaced, xrefs: 00007FF761679F11

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: f05e9fc39bd4c4fc730cbf7ee75fb9a2225880a655b2c6a681a1218176bfac06
Instruction ID: f7f4aebbfa70006010b533c51d885df17db1f9aadda89e4161b2663e2d937811
Opcode Fuzzy Hash: f05e9fc39bd4c4fc730cbf7ee75fb9a2225880a655b2c6a681a1218176bfac06
Instruction Fuzzy Hash: 1B91856AA0D782C5FF75A7159548379E7E2EF45F68F884035CA8E02791DFACE444C720

Function 00007FF761684900 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616849DC
strchr.VCRUNTIME140 ref: 00007FF761684A10
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF761684A30
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761684AB4

Strings

%s%s%s, xrefs: 00007FF76168499F
Connecting to hostname: %s, xrefs: 00007FF761684A8B
anonymous, xrefs: 00007FF761684910
Connecting to port: %d, xrefs: 00007FF761684AD0

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: d78e3ff692bd5202c6bbaa1cddfaf308f6c3017d1e039b30db1cab326158a513
Instruction ID: e9c35569e674210d329bb4e916f31f69178b8367892ed9f327adcb923cd80030
Opcode Fuzzy Hash: d78e3ff692bd5202c6bbaa1cddfaf308f6c3017d1e039b30db1cab326158a513
Instruction Fuzzy Hash: CD51D526608BC2C5EBB1AF15A4043A9E796FB41F98F844135DE9D0BB98DFBCD141C720

Function 00007FF761674977 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

Set-Cookie:, xrefs: 00007FF761674A98
RELOAD, xrefs: 00007FF761674A25
SESS, xrefs: 00007FF7616749C3
FLUSH, xrefs: 00007FF761674A03
ALL, xrefs: 00007FF761674983

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 64078f5509ce6789c703cda9e5244dec7a4fd932365f29ec984a8d0e853d9342
Instruction ID: 3896d4d98df164f1b98fa9f833199e947ce1a3c664513c65dd19060cd168b362
Opcode Fuzzy Hash: 64078f5509ce6789c703cda9e5244dec7a4fd932365f29ec984a8d0e853d9342
Instruction Fuzzy Hash: 75413D19F08642C2EB54BB2595582B9D397AF84FC0FD84031DE0E47A96DEEDE412C760

Function 00007FF7616A6C81 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF7616A6C93
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A6CAE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A6CDA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A6CFF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A6DDC

Strings

Wildcard - Parsing started, xrefs: 00007FF7616A6D77

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 028b54095a7822f1396337978b26ea308b95a88309c4f6e321017f34df1af4ed
Instruction ID: 9900dae18b1362b6ea072d62e940eae0c5b57962ef7d2015cc20576ba38a352e
Opcode Fuzzy Hash: 028b54095a7822f1396337978b26ea308b95a88309c4f6e321017f34df1af4ed
Instruction Fuzzy Hash: 29516E3AA09B82C1EB11EF15E4581B8B7A6FF84F84F854435CA4E4B754DFB8E455C320

Function 00007FF7616B73AC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B73D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
FALSE, xrefs: 00007FF7616B73C8
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: ae44b6cc25f1171be3da277d17204bf0ad59979bfeed4c3c9ad4a1016a462e04
Instruction ID: edc2fb03ad427ebfb04985bf56d3a05a49a27cd8f206cb159f5f8a49a097f48b
Opcode Fuzzy Hash: ae44b6cc25f1171be3da277d17204bf0ad59979bfeed4c3c9ad4a1016a462e04
Instruction Fuzzy Hash: 3E41A56AE09782C4EB11EB25945C2F9A766BF05F88F844435CE4D177A6DFBCE150C320

Function 00007FF7616AF1F0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF345
memcpy.VCRUNTIME140 ref: 00007FF7616AF362

Strings

https, xrefs: 00007FF7616AF280
%%25%s], xrefs: 00007FF7616AF372
%ld, xrefs: 00007FF7616AF2AE
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7616AF532
file, xrefs: 00007FF7616AF20B
file://%s%s%s, xrefs: 00007FF7616AF23E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: 469a3e2e16c267789cc01c7905be1eba584b916866bd235b0b9d2c5f4a0e47db
Instruction ID: b5390a5d908ee2073fdfe2722c26694f1b65bec81b2b5e59150e10c0b4829e0d
Opcode Fuzzy Hash: 469a3e2e16c267789cc01c7905be1eba584b916866bd235b0b9d2c5f4a0e47db
Instruction Fuzzy Hash: FEA16D6AA09B82C4EB65AF11E5483A9B3A6EF44F84F844176CE8D03B58DF7CE444C751

Function 00007FF7616B825C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B829F
memcpy.VCRUNTIME140 ref: 00007FF7616B82C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8398
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B84D2

Strings

Expire Date, xrefs: 00007FF7616B83DD
Public Key Algorithm, xrefs: 00007FF7616B8488
Expire Date: %s, xrefs: 00007FF7616B83F7
Public Key Algorithm: %s, xrefs: 00007FF7616B84A2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 4ccdc9ab91a0535d77fa9aa8c0208e1d0a080a60d205a77c385ac69a42cf734e
Instruction ID: bc762b7c58aec8b44113bda6a9f7bf553b33be593e17d15f818ebff87f1680e9
Opcode Fuzzy Hash: 4ccdc9ab91a0535d77fa9aa8c0208e1d0a080a60d205a77c385ac69a42cf734e
Instruction Fuzzy Hash: 8F613669A09783C5EB18EB65801C1B9A7A7BB05F84F844535CE1F077E5DEBCE024D320

Function 00007FF7616B76E6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B771F
memcpy.VCRUNTIME140 ref: 00007FF7616B774A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: e569bb298ba613fd79d8233cd29af96ef3bc2d3c48f7074fe414be77698e85c2
Instruction ID: e3f7b31485d825931a334468683d243f02ac3760bab03a30010bb83cf7b15af0
Opcode Fuzzy Hash: e569bb298ba613fd79d8233cd29af96ef3bc2d3c48f7074fe414be77698e85c2
Instruction Fuzzy Hash: 3C610459E09692C5EB18EB25841C2B9A793AF05F88F844535CE0F0B7D5DEBCA165D320

Function 00007FF7616B1790 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF761694DF8), ref: 00007FF7616B1920
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF761694DF8), ref: 00007FF7616B1957
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF761694DF8), ref: 00007FF7616B197E

Strings

NTLM, xrefs: 00007FF7616B1796
HTTP, xrefs: 00007FF7616B17A6
%sAuthorization: NTLM %s, xrefs: 00007FF7616B1938, 00007FF7616B19E4
Proxy-, xrefs: 00007FF7616B192E, 00007FF7616B19DA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: df50d3c08605608153538d01eb3d3f3672086f7079c31e4fc3a596cca71a9e3d
Instruction ID: 56e12fa86eae11d90b79e0e4a245616ba3d77bed0caa7f4db8c7e1071b5897d4
Opcode Fuzzy Hash: df50d3c08605608153538d01eb3d3f3672086f7079c31e4fc3a596cca71a9e3d
Instruction Fuzzy Hash: F661372AA08B81D1EB60EF15E4483AAB3A6FB45F88F804036DA8D47754DFBCE555C721

Function 00007FF7616A8420 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76167B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167B474

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A853D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A8595
memcpy.VCRUNTIME140 ref: 00007FF7616A85BA

Strings

Session:, xrefs: 00007FF7616A84AE
Unable to read the CSeq header: [%s], xrefs: 00007FF7616A8492
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF7616A854E
Got a blank Session ID, xrefs: 00007FF7616A84E7
: %ld, xrefs: 00007FF7616A8461
CSeq:, xrefs: 00007FF7616A843D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: a3a8ded29e8c24b2ee7d97979504e82674f803be7010108302ac092b5f4bb2fd
Instruction ID: f04baaea4e50c0eb2550c0b852482ef3d8f83a18d1f0dde7eedbf8f7dd34300b
Opcode Fuzzy Hash: a3a8ded29e8c24b2ee7d97979504e82674f803be7010108302ac092b5f4bb2fd
Instruction Fuzzy Hash: B2410529A086C2C1FB50AB2594082B9E792EF45FC5FC84139DE9E87AE5DF6CE401D730

Function 00007FF7616BC530 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BC5C8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BC624
strchr.VCRUNTIME140 ref: 00007FF7616BC80C
strchr.VCRUNTIME140 ref: 00007FF7616BC87A

Strings

0123456789-, xrefs: 00007FF7616BC873
APM0123456789:, xrefs: 00007FF7616BC805
<DIR>, xrefs: 00007FF7616BC750

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 179db5e6ecdb2eedd8a35f1361e26f9261d76770616d7f3031361c8db7d08d42
Instruction ID: fb33fdb8fe23d77770ced9cc2cab38ece1b28b74059b8a37070ff349081c85db
Opcode Fuzzy Hash: 179db5e6ecdb2eedd8a35f1361e26f9261d76770616d7f3031361c8db7d08d42
Instruction Fuzzy Hash: 83B16C3AA09B42C6EB24EF25D058339A7A2FB44F9CF954035CA4E47394DFB8E561C760

Function 00007FF76168DC80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168DCDA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168DDDE
WSAIoctl.WS2_32 ref: 00007FF76168DF37
setsockopt.WS2_32 ref: 00007FF76168DF5F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168E056

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF76168DDF0
We are completely uploaded and fine, xrefs: 00007FF76168DFCA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: 6693351069b30d5b7b6ec30cec5eec467f648fc5bd0d0573ec4d2490d6104c5a
Instruction ID: cda4a1390bf0d226b6f5962ff9a1e6d5fa047f594b2c3094b3838f6abdea17a2
Opcode Fuzzy Hash: 6693351069b30d5b7b6ec30cec5eec467f648fc5bd0d0573ec4d2490d6104c5a
Instruction Fuzzy Hash: 8FB15F36A09AC6C5EBA1AF25D4483F9A392EB44F58F484136CE4D0AB95DFBC9495C330

Function 00007FF7616AE800 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AE847
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE9DF

Part of subcall function 00007FF76169C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF761683D1F), ref: 00007FF76169C9BE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AE8DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AEA1D

Strings

Failed sending Gopher request, xrefs: 00007FF7616AE9E5
%s?%s, xrefs: 00007FF7616AE839

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 483f11529e2bd2f827472fbb64514bc7533f7996d6268b5361bb568acff0b98a
Instruction ID: 8a3c0d83ac7513fbe0f170ed040ab2443e93b66455a0b51729073b98dc8c6e30
Opcode Fuzzy Hash: 483f11529e2bd2f827472fbb64514bc7533f7996d6268b5361bb568acff0b98a
Instruction Fuzzy Hash: B851962AB09B82C1F751AB66A4181BAE392FB45FE4F844231DE6D47BD5DE7CD402C720

Function 00007FF76166AB80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166C27C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166C2AA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166C2B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166C2F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166C343

Strings

value, xrefs: 00007FF76166C1E8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: abc4dcb4bf626f12aceca109b3ac5be41942692fc4efa9d11af6e3b39507fb0f
Instruction ID: 7936e9504c703c1494c2c21bb55d2d03069688c74e8aec46d575f451dea73386
Opcode Fuzzy Hash: abc4dcb4bf626f12aceca109b3ac5be41942692fc4efa9d11af6e3b39507fb0f
Instruction Fuzzy Hash: 4C61F926A18A85C5EB10EB78E4483EDA372FB45BA4F805331DA6D13AD9DFBCD085C750

Function 00007FF7616694E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166A9ED
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166AA1B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF76166AA29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166AA63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166AAB4

Strings

value, xrefs: 00007FF76166A959

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 418e4009ded77f161f9af62bfedde694c8209946c77fb1f942d757c564764665
Instruction ID: bee7c331d57f8c3b5844946e132985e601d1e9bc610a024a2f116863b7f9fbac
Opcode Fuzzy Hash: 418e4009ded77f161f9af62bfedde694c8209946c77fb1f942d757c564764665
Instruction Fuzzy Hash: 1B61E636A18A85C5EB10DB79E4483ED6332EF45BA4F505335EA6C12AE9DFBCD081C750

Function 00007FF7616A74D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7616A7506
_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7616A755B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7616A75CC
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7616A75D9
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7616A76EB

Strings

Can't get the size of %s, xrefs: 00007FF7616A75E2
Can't open %s for writing, xrefs: 00007FF7616A756B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 4646d5958fd0afe558b6e628580ec2560eed784401f815918089c05b269bd973
Instruction ID: abe4ee10b49316e6ce149324f26a0ccaf784169123952f5e566cf17e5255a43e
Opcode Fuzzy Hash: 4646d5958fd0afe558b6e628580ec2560eed784401f815918089c05b269bd973
Instruction Fuzzy Hash: FA51C625B08A86C2EB14AB25D4583B9A392FF85FD0FC49435DE4E47799DEBDE401C320

Function 00007FF7616AF740 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7616AF750
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 74a58f8c083852693bf64881fee03805f566497237c963ec1128527847eabe63
Instruction ID: 23c274d9cd6fafeb36c7213a40892ea1aa3c9c5000874b4de4f70b97ef149b06
Opcode Fuzzy Hash: 74a58f8c083852693bf64881fee03805f566497237c963ec1128527847eabe63
Instruction Fuzzy Hash: 5051EA19E0D692C5FB61A711A01837DABD2AF41F94F8901B5DE9E07BC1DEADE405C332

Function 00007FF7616AF716 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF723
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: 11a0c1ad3791ab075d9d13a3d2058a3ec95cb1eb7b8996445b049866087062de
Instruction ID: 7e99b45e6ba9c07e2b60ed92623eb2b626ecd7db46f907920c5f2e9803660324
Opcode Fuzzy Hash: 11a0c1ad3791ab075d9d13a3d2058a3ec95cb1eb7b8996445b049866087062de
Instruction Fuzzy Hash: F741E519D0D692C5FB62AB1160183BDABD2AF06F54F8905B1DEDE06BC1DEADE405C331

Function 00007FF7616B747E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B7481
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: 848f9bd136f30b638347715e6b3aa5fb2b1dd1155d484af4729bc6df23dfb9d6
Instruction ID: 380827ca32706e37221e5076f52bed5c067a749be56493f0e7f4f9dc3515e43b
Opcode Fuzzy Hash: 848f9bd136f30b638347715e6b3aa5fb2b1dd1155d484af4729bc6df23dfb9d6
Instruction Fuzzy Hash: C531B459E09783C4EB10EB25941C1F9A7A76F05F88F844435CD4E177A6DFBCA110D320

Function 00007FF7616B756D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7616B7691
Serial Number, xrefs: 00007FF7616B7862
GMT, xrefs: 00007FF7616B761E
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 2f203b4647518da1f2e7f5e41acfa6be74a516219f63d053806ad01f872eec19
Instruction ID: 03b7475ca585bd7a77885517963ee0f525acebb1db6d356c7c0fcbf9dea7dc87
Opcode Fuzzy Hash: 2f203b4647518da1f2e7f5e41acfa6be74a516219f63d053806ad01f872eec19
Instruction Fuzzy Hash: 2961E36AA097D2C4EB10EB29940C1B9FBA6AB15F84FC44436CE4D17B95DFBCE161C720

Function 00007FF7616B8865 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B88A8
memcpy.VCRUNTIME140 ref: 00007FF7616B88CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B89A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 9e4491614718e25cc1eab2119404d1c2449d3d8cad68613c048e147f197bde4b
Instruction ID: 889e0251d3efd58cc2cb02d535add90d2f377ea1f86ecb4c74c5114c4b8c846b
Opcode Fuzzy Hash: 9e4491614718e25cc1eab2119404d1c2449d3d8cad68613c048e147f197bde4b
Instruction Fuzzy Hash: 1D513529A08683C6EF18EB19901C3B9A396EB45FD4F840136CA5F077A5EEBCE055D321

Function 00007FF76167F7B0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167F7F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167F822
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76167F84E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 6357a9bd726c514b9537bb7ab30b8792c16bcd5251ca2c88349b3d87cfd3c4aa
Instruction ID: 92e5293586c50a76ec5662ae59fd2a871d25aff17680f0f08c40b4f46c213409
Opcode Fuzzy Hash: 6357a9bd726c514b9537bb7ab30b8792c16bcd5251ca2c88349b3d87cfd3c4aa
Instruction Fuzzy Hash: FD51802AA1AB91C2EB55CF65F054628B7B4FB48F88B481175EF9D03B48EF38D4A1C710

Function 00007FF7616B74A7 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7616B7559
Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
GMT, xrefs: 00007FF7616B7506
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 03dff17ac0cd915ebebac05d076bcb7c51ce859e12afd2d7d7880ca572dcb3ce
Instruction ID: d969195bd63079358ccd328c8e140bd5d268d99fd52ca148b4119a4006e08c24
Opcode Fuzzy Hash: 03dff17ac0cd915ebebac05d076bcb7c51ce859e12afd2d7d7880ca572dcb3ce
Instruction Fuzzy Hash: 2851A16AA09782C4EB10EB2594081F9A767BB05F88FC84436CE4D1B799DFBCE554C320

Function 00007FF7616B8264 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B829F
memcpy.VCRUNTIME140 ref: 00007FF7616B82C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B84D2

Strings

Expire Date, xrefs: 00007FF7616B83DD
Public Key Algorithm, xrefs: 00007FF7616B8488
Expire Date: %s, xrefs: 00007FF7616B83F7
Public Key Algorithm: %s, xrefs: 00007FF7616B84A2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 9cfc241ff50fa9f1d546cf1a4f6eb5ae5dff09977d4f1df51ff9215a3f6f9d9a
Instruction ID: 224eb6e57925e248b09f561b394dec900df614f95f703cc94376d4fe2def9b0f
Opcode Fuzzy Hash: 9cfc241ff50fa9f1d546cf1a4f6eb5ae5dff09977d4f1df51ff9215a3f6f9d9a
Instruction Fuzzy Hash: A841C169A09783C4EB14EB65941C1F9A7A7BF15F88F844435CE0E577A6EFBCA114C320

Function 00007FF76169D240 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D30C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D31A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D328
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D336
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D344
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D360
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D36E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169D37C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f9c98c4728642ed9e1a96ad5c64d8c7b5bcb162c8dc94b6f4a0ea47b6ce93bc3
Instruction ID: 3d55a25d3e096818001bc4c00015d0f9761a5434af6f2613cfa4e352c1289c44
Opcode Fuzzy Hash: f9c98c4728642ed9e1a96ad5c64d8c7b5bcb162c8dc94b6f4a0ea47b6ce93bc3
Instruction Fuzzy Hash: 0C41823A908B43C2E761AF20E444238B3A5FB49F98F848975DE8D53754CF78D850D360

Function 00007FF76167A180 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A1FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A204
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A20E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A218
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A222
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A22C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A236
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A240
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A249

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ba3c6830358e7528ed72be0c954360400be3cdaf49af343b8df36180f5656063
Instruction ID: a983ab1781737581284602451c22bd3d7f169633e1a1b6d1529d7eb8ef331da7
Opcode Fuzzy Hash: ba3c6830358e7528ed72be0c954360400be3cdaf49af343b8df36180f5656063
Instruction Fuzzy Hash: B5312B3AA08A51C2E720AF11E818229B371FB89FC8F484435DE9D53B68CFBCD851D710

Function 00007FF76167A2A0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A2FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167A308

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 89febe505de102955aa40a6d6fbd39999fc8921961043ca983f536c30d848905
Instruction ID: 477afd3012d48ffc4c73ee14024677dd16265e1de2feb7ac957e5e3f32cd87e9
Opcode Fuzzy Hash: 89febe505de102955aa40a6d6fbd39999fc8921961043ca983f536c30d848905
Instruction Fuzzy Hash: C701E169A14A01C2DB14EF21F868138A332FF89F8DB445435CD9E93324CF6CD864D360

Function 00007FF7616B4830 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76167C510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C546
Part of subcall function 00007FF76167C510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C556
Part of subcall function 00007FF76167C510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C564
Part of subcall function 00007FF76167C510: memset.VCRUNTIME140 ref: 00007FF76167C59F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B48F9
memcpy.VCRUNTIME140 ref: 00007FF7616B4914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B492E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: 8fb3d6d3ee099111430005b96dd445b6f329aa6f6764831057bf426af99e6c2f
Instruction ID: 25037c6e4d6977977e1bb7f8eef1ebef5a353a1925da311f68be2d553e6710cb
Opcode Fuzzy Hash: 8fb3d6d3ee099111430005b96dd445b6f329aa6f6764831057bf426af99e6c2f
Instruction Fuzzy Hash: 78916D69B09782C2FB65FA26945837AE292AF84FC4F844434DE5E47785DFFCE4218324

Function 00007FF7616898F0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7616898B8), ref: 00007FF761689A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7616898B8), ref: 00007FF761689A1F

Strings

Internal error removing splay node = %d, xrefs: 00007FF761689902
I32, xrefs: 00007FF7616899F5, 00007FF761689A55
I64, xrefs: 00007FF761689A15, 00007FF761689A7F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 4abe602e0432aed16e7e57adae7ae147e6c576377803e4fc3a9105ccc54124ad
Instruction ID: f53387597720b710835233a2a840977a73d718a629d0f0574f999f7d51f1347e
Opcode Fuzzy Hash: 4abe602e0432aed16e7e57adae7ae147e6c576377803e4fc3a9105ccc54124ad
Instruction Fuzzy Hash: FFA1C436A08682C6DB609F14D48877DBBA5FB89F4CF854135DA9E43694DF7CD208C760

Function 00007FF761698210 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF76167B23A,?,?,?,?,?,?,?,00007FF76167B007), ref: 00007FF761698221
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7616983C3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7616983E0

Strings

0123456789abcdef, xrefs: 00007FF7616983B2, 00007FF7616983BC
0123456789ABCDEF, xrefs: 00007FF7616983D2, 00007FF7616983D9
TRUE, xrefs: 00007FF76169834C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 9224fbc54b73e1d84aa41a66293c8d90ff55d81bd2fcf765c44fad8682bdecb1
Instruction ID: 58c6e96c905094471e813f7aaacc89a9c2c61e631b8ba68d98fd92760ee4d626
Opcode Fuzzy Hash: 9224fbc54b73e1d84aa41a66293c8d90ff55d81bd2fcf765c44fad8682bdecb1
Instruction Fuzzy Hash: DF514616B0D78FC2EB60AF15900817EE296AF41F88FC44875DA4E07768DEBCE845D720

Function 00007FF761679A8C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679A92
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679C81

Strings

FALSE, xrefs: 00007FF761679C5B
Added, xrefs: 00007FF761679F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF761679F27
Replaced, xrefs: 00007FF761679F11

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 98d2d3bcc1ba16a5f119fe8c426068166d2e80bf788a6bcfee71b2c1afddc434
Instruction ID: 20f6a5d9865bd5f9d755d954d761f2f680ad51dcd628abb292bceb3003c7b7c4
Opcode Fuzzy Hash: 98d2d3bcc1ba16a5f119fe8c426068166d2e80bf788a6bcfee71b2c1afddc434
Instruction Fuzzy Hash: F961686A90D782C5FF75AB159448379E7E6EF44F68F884036CE8D02691DFACE444C720

Function 00007FF761679C29 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679C2C

Part of subcall function 00007FF761698000: strchr.VCRUNTIME140 ref: 00007FF761698036

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679C81

Strings

FALSE, xrefs: 00007FF761679C5B
Added, xrefs: 00007FF761679F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF761679F27
Replaced, xrefs: 00007FF761679F11

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: a24a650fb72ad2b09065b53723891c1304722ecbf4ec04612f37557dfc567d4b
Instruction ID: 163b96a67888e9e24eae39b16ce3d2fa4f13e8e8cb8258f52566122301b067aa
Opcode Fuzzy Hash: a24a650fb72ad2b09065b53723891c1304722ecbf4ec04612f37557dfc567d4b
Instruction Fuzzy Hash: 6961786A90D782C5FF71AB159448379E7E6EF44F68F884436DE8D02691DFACE484C720

Function 00007FF7616A3D10 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF7616A3DD3

Strings

Maxdownload = %I64d, xrefs: 00007FF7616A3E6C, 00007FF7616A3F0B
bytes, xrefs: 00007FF7616A3DC9
Getting file with size: %I64d, xrefs: 00007FF7616A3E85
RETR response: %03d, xrefs: 00007FF7616A3D68
, xrefs: 00007FF7616A3D77
Data conn was not available immediately, xrefs: 00007FF7616A3EC7

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 6604bb869a8a57031b4299baf1fbfffbabbfb4a6203eacfed88301d08e207690
Instruction ID: 780d9cb6fc777a3571657cf4eded4ad595ad3b0a2897019c459a9af4d76435d4
Opcode Fuzzy Hash: 6604bb869a8a57031b4299baf1fbfffbabbfb4a6203eacfed88301d08e207690
Instruction Fuzzy Hash: EE51C866A08786C2EB64E759A44C2B9E392EB45F64FC44232DA5C02ED5DFFCD482C720

Function 00007FF7616B86DB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7616B87FF
Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF
GMT, xrefs: 00007FF7616B878E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: cc4af213bcdcfd7440e4ed7acfa4c34d05be6f0fa52ceb2334c71298c3da4e5a
Instruction ID: 265e14db6bda9640da700c653d11d0dbd32a4a01db0ff273eba357139157d3fe
Opcode Fuzzy Hash: cc4af213bcdcfd7440e4ed7acfa4c34d05be6f0fa52ceb2334c71298c3da4e5a
Instruction Fuzzy Hash: 9751B16AA0C6C2C5EB11DB25A40C2BDF7AAEB45F88F944431CA8D03765DFBCE165D720

Function 00007FF7616A3AE0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF7616A3C86

Part of subcall function 00007FF7616BAE10: memcpy.VCRUNTIME140 ref: 00007FF7616BAEB8
Part of subcall function 00007FF7616BAE10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BAEC9

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF7616A3C94
QUOT string not accepted: %s, xrefs: 00007FF7616A3CAF
FTP response timeout, xrefs: 00007FF7616A3CF3
We got a 421 - timeout!, xrefs: 00007FF7616A3CC5
*, xrefs: 00007FF7616A3C54

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 496247f600eb8e8a61c92fbf89c74c7560249ec54409c2c417aedbd0a8a9ab2f
Instruction ID: bcc7c8712529eb2c1903c722ab085b83078fca9bc94876e764c2f259f89d9451
Opcode Fuzzy Hash: 496247f600eb8e8a61c92fbf89c74c7560249ec54409c2c417aedbd0a8a9ab2f
Instruction Fuzzy Hash: 7251E629B08682D5FB64FA2698083B9D353BF45F94F848131DE4E87AD1EFACE445C320

Function 00007FF7616AC8C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF7616AC920
memcpy.VCRUNTIME140 ref: 00007FF7616AC946
memchr.VCRUNTIME140 ref: 00007FF7616ACA43

Strings

TFTP error: %s, xrefs: 00007FF7616ACA60
Received too short packet, xrefs: 00007FF7616AC972
Internal error: Unexpected packet, xrefs: 00007FF7616AC9E8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: a3e2849103a70247068220ebcdcc0a559ec76594586829a5efb8fe2af2be80d4
Instruction ID: ff762cc46792ff66e13d2d2d5ba124257f347ce944814c063b5673d56b0889f9
Opcode Fuzzy Hash: a3e2849103a70247068220ebcdcc0a559ec76594586829a5efb8fe2af2be80d4
Instruction Fuzzy Hash: 0351E379A08692C5EB64EB25D4283BAF392FB45F44F844132DE4E87B85DE7CE405CB60

Function 00007FF761662380 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761666DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7616623DB), ref: 00007FF761666E5E
Part of subcall function 00007FF761666DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7616623DB), ref: 00007FF761666E6C
Part of subcall function 00007FF761666DE0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7616623DB), ref: 00007FF761666E82

Part of subcall function 00007FF761663BC0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF761661D9B), ref: 00007FF761663C06

Part of subcall function 00007FF761665DE0: memcpy.VCRUNTIME140(?,?,?,00007FF761661DCA), ref: 00007FF761665E71

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662479
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616624B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662506
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662554

Strings

at line , xrefs: 00007FF7616623CC
, column , xrefs: 00007FF761662409

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: cd88fc2eb0c43cf2dea86ed3eb464c30a0ca442cdfdcf6784071c49820cf1abd
Instruction ID: 5bbaf011dd01692d1752ad309cdf0282d880e795a7894607d3771cc0652ad066
Opcode Fuzzy Hash: cd88fc2eb0c43cf2dea86ed3eb464c30a0ca442cdfdcf6784071c49820cf1abd
Instruction Fuzzy Hash: 3551B366B18A82C5FB04EB74D4583AC7332EB44BA8F405235DE6D23BDADEB8D485D350

Function 00007FF761664A10 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664AA3
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664AF7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664B1E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664B46
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664B8C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664B93
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF76166315B,?,?,?,00007FF761663114), ref: 00007FF761664BA0

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 8539b71a9476b0b565f630c419d2d07fcfc2176833b4c9dbc2d1a14acb684146
Instruction ID: 6c40066ef9d04a583484e6713fb50fdd1a10671ef2954ca7cd8a78ebaa2edd92
Opcode Fuzzy Hash: 8539b71a9476b0b565f630c419d2d07fcfc2176833b4c9dbc2d1a14acb684146
Instruction Fuzzy Hash: 67518E36608A41C2EB209F19E1A8238E7B2EB80F95F55C235CE5E537A4CFB9D442C395

Function 00007FF7616B1440 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF761694DD6), ref: 00007FF7616B159D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF761694DD6), ref: 00007FF7616B15B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B15C5

Strings

%sAuthorization: Negotiate %s, xrefs: 00007FF7616B157E
Negotiate, xrefs: 00007FF7616B1446, 00007FF7616B1522
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF7616B14F1
Proxy-, xrefs: 00007FF7616B156D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: f198fbd2046383c1a6cce593e2bc3142b815703f912c50491b5b73dd462a67c1
Instruction ID: f7c401e7d8b31f1e78d1587143e3553594c49b4caf9c63f539b240cdf03a61a9
Opcode Fuzzy Hash: f198fbd2046383c1a6cce593e2bc3142b815703f912c50491b5b73dd462a67c1
Instruction Fuzzy Hash: 1251E777909642E2FB11EB61E4482BDA7A6FB41F84F884031DA4D43681DFBCE475C720

Function 00007FF7616AF797 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 2f12533ae5c7d22c91c98250c81db4f994baa735569bf2d412694917429020a2
Instruction ID: e50c9811dabf0361453cddfed26b61457a43ec024602c4638076859fb20724af
Opcode Fuzzy Hash: 2f12533ae5c7d22c91c98250c81db4f994baa735569bf2d412694917429020a2
Instruction Fuzzy Hash: DC41D619D0D692C5EB62A71160183BDABD2AF42F54F8905B1DEDE06BC1DEADE405C331

Function 00007FF7616AF787 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: a2a6ca694af6d6b6ff358b0db032f8cc45bfc6661a346e6da40368cd7cad8861
Instruction ID: d07b644a9a198be168bf1575fe0dfdc370c32680f5cf82621899bcd60c6be1df
Opcode Fuzzy Hash: a2a6ca694af6d6b6ff358b0db032f8cc45bfc6661a346e6da40368cd7cad8861
Instruction Fuzzy Hash: 2041E619D0D2D2C4FB62A71160183BDABD29F46F54F8901B1DE9E06BC1DEADE405C332

Function 00007FF7616AF708 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: add6d49ce95373930ca12822ca5706401dd4ce203f97ecf9262891c636c1e989
Instruction ID: 178df28e6a5724e21824a62cb21ddb9f186796a5bb94283b06cb97695b4fcbbd
Opcode Fuzzy Hash: add6d49ce95373930ca12822ca5706401dd4ce203f97ecf9262891c636c1e989
Instruction Fuzzy Hash: 7E41E719D0D292C5FB62A71160183BDABD29F06F94F8905B1DE9E07BC1DEADE405C332

Function 00007FF7616AF6FA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 6ddab9e1bea1c4541d84d215edef0730235214fb9ebe75839b84cfb8c703a0c1
Instruction ID: 0ef96995af1b086cca3c98bb0e75408de2741b768c9c2e5e2b2ce1d950a5c971
Opcode Fuzzy Hash: 6ddab9e1bea1c4541d84d215edef0730235214fb9ebe75839b84cfb8c703a0c1
Instruction Fuzzy Hash: 8A41E719D0D292C5FB62A72160183BDABD29F06F94F8905B1DE9E07BC1DEADE405C332

Function 00007FF7616AF6EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: f24707c84e03f7a66e94ac29b5f0433a77d803606814e6d8575d6aa59e1712ec
Instruction ID: 8958c89ee244a70b2bccc7c3a408e16edc22ccb4a60929b9246bd5178b26c2b9
Opcode Fuzzy Hash: f24707c84e03f7a66e94ac29b5f0433a77d803606814e6d8575d6aa59e1712ec
Instruction Fuzzy Hash: 0141D619D0D292C5FB62A71160183BDABD29F06F94F8905B1DE9E06BC1DEADE405C332

Function 00007FF7616AF732 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: d0b26e73ffc5f99cf69ba09fbf06d48aaf8e2ad000c814df662444c5f3b2e9b2
Instruction ID: 91988ef619e461189582421931a62c2793abd77d9f78ed79ee535d722c82652c
Opcode Fuzzy Hash: d0b26e73ffc5f99cf69ba09fbf06d48aaf8e2ad000c814df662444c5f3b2e9b2
Instruction Fuzzy Hash: 5941F819D0D292C4FB62A71160183BDABD29F46F94F8905B1DE9E07BC1DEADE405C332

Function 00007FF7616AF7BD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616AF84E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF90A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AF9FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616AFA0B

Strings

%%%02x, xrefs: 00007FF7616AF8B3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 79a656023e6bd4345ef3070d038f4b0a04e506819340c9dc18019e0ab5006f97
Instruction ID: 7cf67a8cb17cd6e85f04cb45cc5a8ed2402b7a4335fe7010a259831b4079836b
Opcode Fuzzy Hash: 79a656023e6bd4345ef3070d038f4b0a04e506819340c9dc18019e0ab5006f97
Instruction Fuzzy Hash: DD41C519D0D692C4FB62AB1160183BDABD29F46F94F8901B5DE9E07BC1DEADE405C332

Function 00007FF7616AD410 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7616AD428
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7616AD591

Strings

gfff, xrefs: 00007FF7616AD49C
Connection time-out, xrefs: 00007FF7616AD44B
gfff, xrefs: 00007FF7616AD508
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF7616AD56C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 74e62bef8fa31f227eae4ae217bd9c3a0d0584a610b1ab6dd052daefc5e3ab35
Instruction ID: 29ca332eec4b6771061aa1b7e2d4a460f4428be72a26bb11164cf60623c2913c
Opcode Fuzzy Hash: 74e62bef8fa31f227eae4ae217bd9c3a0d0584a610b1ab6dd052daefc5e3ab35
Instruction Fuzzy Hash: 4F41277AB24616C6DB20DF2AE0046A8B7A1F798F8CF905032DE4C87B84DE7DE511CB40

Function 00007FF7616948A0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF761694986
strchr.VCRUNTIME140 ref: 00007FF761694999
strchr.VCRUNTIME140 ref: 00007FF7616949AB

Strings

100-continue, xrefs: 00007FF7616949C6
Expect: 100-continue, xrefs: 00007FF761694A08
Expect:, xrefs: 00007FF76169492E
Expect, xrefs: 00007FF761694907

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: d589d7f1a0eca895f8ffff6343643548f106be98028e10f8c7df182552c1a110
Instruction ID: dbdd1aef9c002fb007ae242e323280008ef8b34afbd92b1baafb8395985e186a
Opcode Fuzzy Hash: d589d7f1a0eca895f8ffff6343643548f106be98028e10f8c7df182552c1a110
Instruction Fuzzy Hash: 88411829B1C683C2EB54FB1AA5080B8E392AF45F84FC85474DE5D47796DEECE8418B24

Function 00007FF76168CC70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76168CDBA

Strings

necessary data rewind wasn't possible, xrefs: 00007FF76168CDC5
seek callback returned error %d, xrefs: 00007FF76168CD0E
ioctl callback returned error %d, xrefs: 00007FF76168CD7F
Cannot rewind mime/post data, xrefs: 00007FF76168CDF0
the ioctl callback returned %d, xrefs: 00007FF76168CD65

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 672089d161110b70d9a96796637fe62ce77795772ff06e397206ddfe9950c99d
Instruction ID: 1183e75020f854ed9f0c0dae69e1ac17dbc1028e729c265a38749ffdd1d4f431
Opcode Fuzzy Hash: 672089d161110b70d9a96796637fe62ce77795772ff06e397206ddfe9950c99d
Instruction Fuzzy Hash: 2741C56AA14681C1EB90AF2A94583F85393EB84F98F886031DD0E4B799DFBDD490C770

Function 00007FF7616B861E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7616B86B4
Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF
GMT, xrefs: 00007FF7616B8674

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 81ec5cdf911039d5ac5546a4cba887d0936b7f84550cb837826ce393f7bf0ef0
Instruction ID: 0b61620f52170abf6f6393a6e37596de756a7c8b075e9cc119d0faa59b3fb67a
Opcode Fuzzy Hash: 81ec5cdf911039d5ac5546a4cba887d0936b7f84550cb837826ce393f7bf0ef0
Instruction Fuzzy Hash: DC41812AA08B82C5EB10EB25E4081EAE3A6FB45F88FC80432DA4D17765DFBCD555D720

Function 00007FF7616B73E1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
%s%lx, xrefs: 00007FF7616B7436
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 0727d6f78932e429ab4fbfca8d635a4f14a82bbe5beda4dd6ce3d34bcfbc9a7f
Instruction ID: 6de5e81d2ec855808a7da0f4100985777590be36497cd582be6c7b8b27398e8a
Opcode Fuzzy Hash: 0727d6f78932e429ab4fbfca8d635a4f14a82bbe5beda4dd6ce3d34bcfbc9a7f
Instruction Fuzzy Hash: 2A419359A09792C8EF10EB2594181B9ABA7AF05F88FC45835DE0E5B796DEBCE110D320

Function 00007FF7616A0720 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A075D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A07CE

Strings

., xrefs: 00007FF7616A07C7

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: 126cce29423b04e181cdf8db6ab3ac814217b907ae3d6256a840f172d07d0515
Instruction ID: 1dd3f5d71f4038ddc1a0af46276583b383319ecf952a0b0e731e646519afe258
Opcode Fuzzy Hash: 126cce29423b04e181cdf8db6ab3ac814217b907ae3d6256a840f172d07d0515
Instruction Fuzzy Hash: 4141832AE08B85C2EB60FB15A418379A7A2FB44F84F854035DA4D87B50DFBCE451C7A0

Function 00007FF7616B76EE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B771F
memcpy.VCRUNTIME140 ref: 00007FF7616B774A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 1041f1c514f0783e2dd224254fe01bacb26eac6c194eb6be230712af05d872a0
Instruction ID: f85c0394577ca53b88bbe7a2d7db26d26af681a492d26a0536e58da76026738e
Opcode Fuzzy Hash: 1041f1c514f0783e2dd224254fe01bacb26eac6c194eb6be230712af05d872a0
Instruction Fuzzy Hash: A4418269E09792C4EB14EB2694181F9A763BF05F88F844435CE0E1B7A5EFBCA555C320

Function 00007FF7616B886D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B88A8
memcpy.VCRUNTIME140 ref: 00007FF7616B88CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: f6c58c40ca3c7ba21690231e68ce7d023b12d9f0ab968a8b5222cd54bd54690d
Instruction ID: d2c7eafe9ad8fd517056b2f79ce2efed7024a01b3c6103d2a7d199c0c04f7b4d
Opcode Fuzzy Hash: f6c58c40ca3c7ba21690231e68ce7d023b12d9f0ab968a8b5222cd54bd54690d
Instruction Fuzzy Hash: 3E31A169A09783C5EF50EB16A4182B9A396BF85FD8F840536CE4D177A5EE7CE011C320

Function 00007FF76169F246 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76167B430: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF76167B474

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76169F284
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76169F296

Strings

OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF76169F268
Select failed, xrefs: 00007FF76169F328
Mailbox UIDVALIDITY has changed, xrefs: 00007FF76169F2CE

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 826ba58853a3d136957f2169816f333a83ec11baa541e78f2ddb2eeea56b2deb
Instruction ID: 9cab246e1aa234a2a6f7776bf358ca13e9c6d36301ec0bcd24f7817b32d09cca
Opcode Fuzzy Hash: 826ba58853a3d136957f2169816f333a83ec11baa541e78f2ddb2eeea56b2deb
Instruction Fuzzy Hash: AB317F2EA08643C2EB60B721D04817DA262FF45F94F9148B2DA0D47665DFACEC51C3A1

Function 00007FF7616B7978 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B79AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Strings

Start Date: %s, xrefs: 00007FF7616B7E87
FALSE, xrefs: 00007FF7616B79A1
Start Date, xrefs: 00007FF7616B7E6D
TRUE, xrefs: 00007FF7616B799A

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 62b85369cd27f97f539dac32cc0ef890eb95eb4242f3e514727c1d211b7498cd
Instruction ID: e3046ef165515ccf1f35d3a5f832a72fb392936cbcbec4532ccc9c0bc3b87ddd
Opcode Fuzzy Hash: 62b85369cd27f97f539dac32cc0ef890eb95eb4242f3e514727c1d211b7498cd
Instruction Fuzzy Hash: D021D36AA0C6C2C5EB21EB14A45C2B9B7A3BB05F88FC44431CA4D473A5DF7CE155C320

Function 00007FF7616B85F5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B85F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: 2a26922783b79db217bfca0c63685440ab013e418253220c7c111f94832e3c4e
Instruction ID: 795ac4165aee0f21f6120835040fbbef1d8baf39c39245648747982406461be7
Opcode Fuzzy Hash: 2a26922783b79db217bfca0c63685440ab013e418253220c7c111f94832e3c4e
Instruction Fuzzy Hash: 5221626AA08B83C6EB50EB15E4582BAA3A6FF85F88F840431DE4D57725DF7CD111C720

Function 00007FF76167F960 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F971
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F981
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F98F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F99D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9AB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9B9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761683166), ref: 00007FF76167F9D5

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 159598ebfb569086bc716e34c96faf4a22b156ce6e7ac36b2c598c0d33f506ab
Instruction ID: 9e6ad78907b4c642edacbdc2a7986eafe293bf4fb7fdf18997fda741386e4db9
Opcode Fuzzy Hash: 159598ebfb569086bc716e34c96faf4a22b156ce6e7ac36b2c598c0d33f506ab
Instruction Fuzzy Hash: 6C01957A908B01C2D714AF21F5A823CB3B5FB89F8D7505529CE9E92718CF78D4A5D360

Function 00007FF761682A30 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7616832AB), ref: 00007FF761682A47
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7616832AB), ref: 00007FF761682A78

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 0fb57dad171391ca7d70d225b33378c24a799a4b54e0a408ec16e5806fda4d65
Instruction ID: d13d00f2bb10f1d53e6ac3d722400667664adf1ebf6009296e90a7fef4ac0d6a
Opcode Fuzzy Hash: 0fb57dad171391ca7d70d225b33378c24a799a4b54e0a408ec16e5806fda4d65
Instruction Fuzzy Hash: 3291BC2A609BC1C9D7559F3494543AD77A1FB95B28F48023ACFAC0B3C6CF6991A4C730

Function 00007FF7616B7CEC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7D2F
memcpy.VCRUNTIME140 ref: 00007FF7616B7D55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E28
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Strings

Start Date: %s, xrefs: 00007FF7616B7E87
Start Date, xrefs: 00007FF7616B7E6D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: f556fee176fe82f456707ea2d7e94ec0464d0004553f07bbcd4056a846298c95
Instruction ID: b9829edacf1f3f89508d4e897fc8c0032011ed6ff5014ed5295d3d5306110c08
Opcode Fuzzy Hash: f556fee176fe82f456707ea2d7e94ec0464d0004553f07bbcd4056a846298c95
Instruction Fuzzy Hash: 94415C5AA0D2D2C5EB19EB15402C2B8AB93EF15FD4F844635CA1F077D5DEACA465C330

Function 00007FF76166C610 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF76166C6FA
memcpy.VCRUNTIME140 ref: 00007FF76166C709
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76166C73D
memcpy.VCRUNTIME140 ref: 00007FF76166C744
memcpy.VCRUNTIME140 ref: 00007FF76166C753
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76166C778

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 0937b708e2fe17d654e00c07f550e58b69d54d58ae64189525f92fa438c7aa15
Instruction ID: f4a50e1859c21f14f60dfffd9fe9e54d99249734768af051fd48774b68a0bc2e
Opcode Fuzzy Hash: 0937b708e2fe17d654e00c07f550e58b69d54d58ae64189525f92fa438c7aa15
Instruction Fuzzy Hash: D231F069718B81C1EF10EB16A1081A8E262AB04FE0FC40A32DE6E577D5CFBCE441C3A0

Function 00007FF7616B821F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8409
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B84D2

Strings

Expire Date, xrefs: 00007FF7616B83DD
Public Key Algorithm, xrefs: 00007FF7616B8488
Expire Date: %s, xrefs: 00007FF7616B83F7
Public Key Algorithm: %s, xrefs: 00007FF7616B84A2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: f06e59eeaae8cef8ada80270bc3da1753f3d925e9ea74eb361696e54cb589952
Instruction ID: 5d7cff5349f149bf048841fef542338697bb8274e84840d26e4c709c1db010c2
Opcode Fuzzy Hash: f06e59eeaae8cef8ada80270bc3da1753f3d925e9ea74eb361696e54cb589952
Instruction Fuzzy Hash: FE41E769A08782C8EB10EB6594081F9A767BF05F88F884535CE0D57795DFBCE114C320

Function 00007FF7616BE160 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE209
memcpy.VCRUNTIME140 ref: 00007FF7616BE225
memcpy.VCRUNTIME140 ref: 00007FF7616BE23C
memcpy.VCRUNTIME140 ref: 00007FF7616BE257
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BE28A

Strings

PLAIN, xrefs: 00007FF7616BE16B

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 7aa8b1226e8794902b3a7c6f13b299fd038e878eeaebd1f4d39a8c2478d064d5
Instruction ID: e4d47e0b5686e97df467ede8500031009effb0adf9f9dc6740059a4147c29e7c
Opcode Fuzzy Hash: 7aa8b1226e8794902b3a7c6f13b299fd038e878eeaebd1f4d39a8c2478d064d5
Instruction Fuzzy Hash: 6B31F46AA08B81C2EB10DF12E4442AAB791FB45FE8F848631DEAD477D5DE7CD055C320

Function 00007FF7616B76AF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: eb71e361cb7bb7c5c670ba90f5c307ba5558737232c48933c27f903f0aa1aeed
Instruction ID: 90d21f956f76b058ea94041b5e67f249e7ec1d9c4af3577fa748e5789f04a09b
Opcode Fuzzy Hash: eb71e361cb7bb7c5c670ba90f5c307ba5558737232c48933c27f903f0aa1aeed
Instruction Fuzzy Hash: 4241C76AB09782C8EB14EB2594181F9A762BF05FC8F884435CE4E57799DFBCE154C320

Function 00007FF7616A0241 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A02C6
memcpy.VCRUNTIME140 ref: 00007FF7616A02E1
strchr.VCRUNTIME140 ref: 00007FF7616A02FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A030E

Strings

Got unexpected pop3-server response, xrefs: 00007FF7616A0261
CAPA, xrefs: 00007FF7616A0324

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: b1d3e936dd382e64101da7c55902cb61b4af86ecf09ec8689194697eb391ecd8
Instruction ID: 4947f66853520d01e960d2e901363f5e15d9e0e69d556008a498b40442d67712
Opcode Fuzzy Hash: b1d3e936dd382e64101da7c55902cb61b4af86ecf09ec8689194697eb391ecd8
Instruction Fuzzy Hash: 7C31E269B09382D2EB19AB21914C2B9A292BB05F94FC44135CA5E83B91CFBCF464C361

Function 00007FF7616B8550 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

Signature: %s, xrefs: 00007FF7616B89F7
%s%lx, xrefs: 00007FF7616B85AD
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 3a8dd7c126c2bb8997d435d8e9448206225087e5cb925a77442ceabf54e7fb7f
Instruction ID: 7272e13db37f16a14ed68539a2673e700d54763016cd1300f5892fd0af6be0c6
Opcode Fuzzy Hash: 3a8dd7c126c2bb8997d435d8e9448206225087e5cb925a77442ceabf54e7fb7f
Instruction Fuzzy Hash: 2731A26AB08683C5EF60EB25A4082B9A3A6FF45F88F840431DE4D47766EE6DE010D720

Function 00007FF7616B7451 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 8ff51399e34fb18bdfa4065b559064d0e27037ba38114c71594b9cf6c5c9ea19
Instruction ID: 1062563b92c11940630e45acdb77eb5dc22b50001053ca4447dcd18c2f31f224
Opcode Fuzzy Hash: 8ff51399e34fb18bdfa4065b559064d0e27037ba38114c71594b9cf6c5c9ea19
Instruction Fuzzy Hash: 7D31D459E09783C4EB10FB2594181F9A767AF05F88F844835CE4E1B7A6DEBCE120D320

Function 00007FF7616A85E0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A85F1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A865D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A866F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: b39798a8aef06ed82c566a2d88ee447f92a66763dc49ba57baf9da5a54a9cb28
Instruction ID: 0144526dfbc72020d3f531293d9c637f6ea127626644864565aeec83f556cd71
Opcode Fuzzy Hash: b39798a8aef06ed82c566a2d88ee447f92a66763dc49ba57baf9da5a54a9cb28
Instruction Fuzzy Hash: 9231E43AA08B85C2EB50DB14E0143BDA7A1EB85F89F984030CE4C07BA5DF7DD4559720

Function 00007FF7616B748F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7616B9110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: e8f8e1119d8f664448a53c165c6e65c980d9a364779f0fe52f2c216c99377cce
Instruction ID: 0d5d7bf237b5435fb726a503ed6f24faa3e79c227fa2a9821f1c734c52846136
Opcode Fuzzy Hash: e8f8e1119d8f664448a53c165c6e65c980d9a364779f0fe52f2c216c99377cce
Instruction Fuzzy Hash: D631A269E09792C4EB10EB2594181F9A766AF05F88F844835CE4E1B7AADFBCE110D320

Function 00007FF7616B7469 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7616BAC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BAC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B788E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7933

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Serial Number: %s, xrefs: 00007FF7616B787C
Signature Algorithm, xrefs: 00007FF7616B7907
Serial Number, xrefs: 00007FF7616B7862
Signature Algorithm: %s, xrefs: 00007FF7616B7921

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 5ec3e6fecba39bd3d991c3c6fb9a38e0fd5dbbeef94bd947f9992e81f5bad80f
Instruction ID: fe0a5afc9fac7e36bf553081ac5a7d3cea01e5f66b3ca8c4be89532805732126
Opcode Fuzzy Hash: 5ec3e6fecba39bd3d991c3c6fb9a38e0fd5dbbeef94bd947f9992e81f5bad80f
Instruction Fuzzy Hash: 3331A269A09782C4EB10EB2594181F9A766AF05F88F844835CE4E1B7AADFBCE110D320

Function 00007FF7616A6273 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A628F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A630B

Strings

OS/400, xrefs: 00007FF7616A62D9
SITE NAMEFMT 1, xrefs: 00007FF7616A62EC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 238c0afdacb31243b85ac3d1db810fa013d497470da026d92261a530de5efd79
Instruction ID: b08a5a84152e4f02ca8d798414cc2650e48cef29ea878d8c13c70e13ab8dc6ea
Opcode Fuzzy Hash: 238c0afdacb31243b85ac3d1db810fa013d497470da026d92261a530de5efd79
Instruction Fuzzy Hash: 2031C829A0D6C2C5F771AB19A4583B8A362BB45F48F808031CE8D57B95DEBCE556C730

Function 00007FF76167B980 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF76167B9B3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF76167B9C7
CloseHandle.KERNEL32 ref: 00007FF76167B9D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF76167B9F6
closesocket.WS2_32 ref: 00007FF76167BA14
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF76167BA2D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 5f3c904f0ae646e7217e9643221857d26f1b1b0a293a541f282175a39cabd730
Instruction ID: 714e8f02d398d8131b346950033d45c36129a4f45941adff07cb36d0edf21377
Opcode Fuzzy Hash: 5f3c904f0ae646e7217e9643221857d26f1b1b0a293a541f282175a39cabd730
Instruction Fuzzy Hash: AC213B3A608A41C6E720BF12E598269B371FB89F90F448135DF8E43B54DFB8E4A5C720

Function 00007FF761679AAD Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761698000: strchr.VCRUNTIME140 ref: 00007FF761698036

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761679C81

Strings

FALSE, xrefs: 00007FF761679C5B
Added, xrefs: 00007FF761679F1D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF761679F27
Replaced, xrefs: 00007FF761679F11

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: b530ae3702e63b533a3cc1d87ef15f17ee6ffbd0bf7a021ba09bb2a037e9e83c
Instruction ID: 7ebf63a85dd54568bcebb560b362f94eea8054b8525f17fecee6cc7671bc46fa
Opcode Fuzzy Hash: b530ae3702e63b533a3cc1d87ef15f17ee6ffbd0bf7a021ba09bb2a037e9e83c
Instruction Fuzzy Hash: BE61786A90D782C5FF71AB259449379E7E6EF44F68F884036DE8D02691DFACE444C720

Function 00007FF761692AB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761692CBD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761692CD5

Strings

The requested URL returned error: %d, xrefs: 00007FF761692C5E
Forcing HTTP/1.1 for NTLM, xrefs: 00007FF761692B79

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 3556a0fb8aa02de51f5cb2de88cd450d83914b4afc376172baa3edfbfdd0a290
Instruction ID: c091c8f508ac30ae35f4d58634b9eb99a00ac9c16c0eb0f84911861ae88aadd5
Opcode Fuzzy Hash: 3556a0fb8aa02de51f5cb2de88cd450d83914b4afc376172baa3edfbfdd0a290
Instruction Fuzzy Hash: 9A51A739A086C3C2F7A4AA3495483BDA792EB51F88F8804B9DA4D47695CF6CEC508330

Function 00007FF761662620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761664320: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351

Part of subcall function 00007FF761663C40: memcpy.VCRUNTIME140 ref: 00007FF761663C93

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616626F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761662740
__std_exception_copy.VCRUNTIME140 ref: 00007FF761662790
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7616627DD

Strings

out_of_range, xrefs: 00007FF761662666

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 76b5d1f39a06f829aa9331822407c70e4fe0090e782a3815653c09b6c0711f4b
Instruction ID: 2aaab39ebf858762b78bfb0dc47e1bce900d1b091238adb3bb9378dd08c09b20
Opcode Fuzzy Hash: 76b5d1f39a06f829aa9331822407c70e4fe0090e782a3815653c09b6c0711f4b
Instruction Fuzzy Hash: B8519E36A18B41D9EB00EF74D4583AC7376EB44B98F805235EA5C13AD9DFB8D1A5C350

Function 00007FF761664320 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664351
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF761664416
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF76166446A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF761664471

Part of subcall function 00007FF7616BFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7616643FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF7616BFB32

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF761664322

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: e5d09450d75d7d0d2a987c36b25d823e2b26b5c7a33540b2d8d186e69df48b6a
Instruction ID: dafcbeeebb1b5c746c8d19ce6b52ac03e33b24d6b2424bde34d652e5d3c7d4a0
Opcode Fuzzy Hash: e5d09450d75d7d0d2a987c36b25d823e2b26b5c7a33540b2d8d186e69df48b6a
Instruction Fuzzy Hash: A931F766B0A69584EF18FB1695282789262DF40FE4F840630CE2D27BD5DEFCE492C391

Function 00007FF76168F860 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168F8CA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168F93B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF76168F99B

Strings

:%u, xrefs: 00007FF76168F8DE, 00007FF76168F944
Hostname in DNS cache was stale, zapped, xrefs: 00007FF76168F9C2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: 521fe6832f3cf790d4b15facc39401459d45f648660c420e41be536990509afb
Instruction ID: 8c0f04bcb82d109fda406a32580d139d81b3e620c6c821f765b4a366a27bbc88
Opcode Fuzzy Hash: 521fe6832f3cf790d4b15facc39401459d45f648660c420e41be536990509afb
Instruction Fuzzy Hash: B841C966A186D2D5EB90EB11E4487B9A762FB84F98FC44232DE4D07B95DF7CE005C720

Function 00007FF7616A7320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76169C990: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF761683D1F), ref: 00007FF76169C9BE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7616A73DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A742B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7616A7442
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A745B

Strings

Couldn't open file %s, xrefs: 00007FF7616A7409

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 2aa78f5bc71d4c5fa95e3ddca835f94173a24e12e9090b31d0f437c2ad20b55b
Instruction ID: 4ad6ea248777a8e82e4620d5bfa80999d6322a7fee95dd49a05fc204b97a08a1
Opcode Fuzzy Hash: 2aa78f5bc71d4c5fa95e3ddca835f94173a24e12e9090b31d0f437c2ad20b55b
Instruction Fuzzy Hash: 1F41A166A08B81C1EB149F25E44827DE7A2FB45F94F888131DE9D47B98CFBDE441C720

Function 00007FF761686690 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF76168670E

Part of subcall function 00007FF761672E10: GetLastError.KERNEL32 ref: 00007FF761672E32
Part of subcall function 00007FF761672E10: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761672E3A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168672C
recv.WS2_32 ref: 00007FF761686757
WSAGetLastError.WS2_32 ref: 00007FF761686769

Strings

Recv failure: %s, xrefs: 00007FF761686795

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: ca46f200b82e1adf06dd143e3a4dc972eed31ba8d415bfd83557f489aaddfe68
Instruction ID: ce1a5398ce7e4637ac8909fd92c899f8b3e9b0d3d65a2e5143e1f5302f024a1d
Opcode Fuzzy Hash: ca46f200b82e1adf06dd143e3a4dc972eed31ba8d415bfd83557f489aaddfe68
Instruction Fuzzy Hash: 7531F37AB05B81C1EB50AF15E8482B9A361BB48FD8F904035CE1D47784EEBCD465C7A0

Function 00007FF76168D120 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF76168D215
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168D274

Strings

Connection died, tried %d times before giving up, xrefs: 00007FF76168D1D8
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF76168D1AB
Connection died, retrying a fresh connect, xrefs: 00007FF76168D1FF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: f16b21b77d4c81fbba74814a81fdec6d0cbefe19cea108c1aebaaf06ca801d6d
Instruction ID: 320bcd11f153e13a62e2eae5f248c78cf3864725269677f3e371d19715a793e1
Opcode Fuzzy Hash: f16b21b77d4c81fbba74814a81fdec6d0cbefe19cea108c1aebaaf06ca801d6d
Instruction Fuzzy Hash: 87418335B086C2C1E7959B25E4583ADA7A2EB84F88F888031DB5D47B95CFBCD4A1C730

Function 00007FF7616A16E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A171B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A1761
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A17C6

Strings

RCPT TO:<%s@%s>, xrefs: 00007FF7616A179D
RCPT TO:<%s>, xrefs: 00007FF7616A17AB

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 60c15f7d09dcad11e8e90f63e8166c11e01d1a905cc88d36ae392e94e60358de
Instruction ID: e00f5d7156d2b7094ccf8ce49c97e40f9fac3bd97ddb348f522d10f71b1dcacd
Opcode Fuzzy Hash: 60c15f7d09dcad11e8e90f63e8166c11e01d1a905cc88d36ae392e94e60358de
Instruction Fuzzy Hash: AE31C86AA1CB81C1EB01EB25E4442B9E7A2FB85F94F889231DA5D037D1DFBCD541C710

Function 00007FF7616B9610 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B963D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9B06

Strings

FALSE, xrefs: 00007FF7616B9632
TRUE, xrefs: 00007FF7616B962B
%s: %s, xrefs: 00007FF7616B9AF1

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: a0668f6f08a5207906d9e598c81a2e904b764e4c26932b466be4701ecc668148
Instruction ID: 5a80fa08d9a3c53180accdb2f12a2b73082d2cbdbce491d896048654e6ede4d3
Opcode Fuzzy Hash: a0668f6f08a5207906d9e598c81a2e904b764e4c26932b466be4701ecc668148
Instruction Fuzzy Hash: 270161AAA08782C5EF61EB55A8483B9A3A2BB55F88FC84435CE4D03351DFBCE155C320

Function 00007FF76169735C Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 00007FF7616974B0
warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 00007FF7616974F9
unknown, xrefs: 00007FF7616973EA
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 00007FF7616974D9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
API String ID: 0-3012371547
Opcode ID: 04fcf8145cb42020e372e5070ed4d572ae59c7f9f0e4049c882d18e675978fe1
Instruction ID: e2b916f28e7c75493b9cda911d1249b8524ccc6f12bc3693beb8234f698deb1c
Opcode Fuzzy Hash: 04fcf8145cb42020e372e5070ed4d572ae59c7f9f0e4049c882d18e675978fe1
Instruction Fuzzy Hash: FE61F277A0C382C7E744AB24D4493ADBB92EB91F98F848575DA4943785DF7CE841CB20

Function 00007FF761670B80 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761663D80: memcpy.VCRUNTIME140(?,?,?,00007FF761670BDD,?,?,?,?,?,?,?,0000006E00000006,00000000,?,0000000100000000,00007FF761661744), ref: 00007FF761663E32
Part of subcall function 00007FF761663D80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF761663E57

Part of subcall function 00007FF761663D80: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF761670BDD,?,?,?,?,?,?,?,0000006E00000006,00000000,?,0000000100000000,00007FF761661744), ref: 00007FF761663E14

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670DF0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670DF7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670DFE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670E05
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670E0C

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 9ee18b699d0ee2b22d0ea26408a5de4c3e2fe866b50876750de1e766a30f708b
Instruction ID: d3908e1f05d1c2ef0354e7010292daa81178db6667d478ef4b9477b30f5c75d3
Opcode Fuzzy Hash: 9ee18b699d0ee2b22d0ea26408a5de4c3e2fe866b50876750de1e766a30f708b
Instruction Fuzzy Hash: 4F61B066A05BC1D5EB20EB25E49C3ADB362EB56F84F804035DA4D07A5ADFBDE4D0C350

Function 00007FF7616B4C40 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7616B4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B1635), ref: 00007FF7616B4BC6
Part of subcall function 00007FF7616B4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B1635), ref: 00007FF7616B4BE7
Part of subcall function 00007FF7616B4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B1635), ref: 00007FF7616B4C02
Part of subcall function 00007FF7616B4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B1635), ref: 00007FF7616B4C10
Part of subcall function 00007FF7616B4BA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B1635), ref: 00007FF7616B4C22

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B4CC6

Strings

NTLM, xrefs: 00007FF7616B4C7E, 00007FF7616B4D30
HTTP, xrefs: 00007FF7616B4C4A

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: f397fb2bcd6a45f514f182ea186c6a4e740437deccb595368f6b02b9be4744d2
Instruction ID: 923f7dc2132d29d68a666d260812adef5f5e712289fce492aec617d01e861001
Opcode Fuzzy Hash: f397fb2bcd6a45f514f182ea186c6a4e740437deccb595368f6b02b9be4744d2
Instruction Fuzzy Hash: C9615C3A608B81C2EB60DF15E45466AB3A6FB88F84F944035DE8D43B58DFBCD465CB50

Function 00007FF7616A234B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A2400

Strings

Remembering we are in dir "%s", xrefs: 00007FF7616A2498
Failure sending ABOR command: %s, xrefs: 00007FF7616A2521
ABOR, xrefs: 00007FF7616A24FB
control connection looks dead, xrefs: 00007FF7616A25F2

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 8e02b3b28b6694a18e40372e38f7d30d839d7ad488d6fb036aa5d779c68fab34
Instruction ID: 3cfab2372e9e87e968aa3169f13a835fa2fb5488e4a799916e9889b5238cafbe
Opcode Fuzzy Hash: 8e02b3b28b6694a18e40372e38f7d30d839d7ad488d6fb036aa5d779c68fab34
Instruction Fuzzy Hash: D951D86994D682C2EB64F73190183B9E252FB41B64FC44239CAAD07AC2DFBCE4858361

Function 00007FF7616BA645 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA688
memcpy.VCRUNTIME140 ref: 00007FF7616BA6AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA77B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA7CF

Strings

TRUE, xrefs: 00007FF7616BA7D9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 80d142b2cfaed612c7625e82799aa2ed6ff54757b648a70adbdf1b712a748d0f
Instruction ID: ebc3967b93fb2f5eae3e6a15331032afc2c5fe6d32fefd2a3f99c1d4e016c2e9
Opcode Fuzzy Hash: 80d142b2cfaed612c7625e82799aa2ed6ff54757b648a70adbdf1b712a748d0f
Instruction Fuzzy Hash: DC415AADF1D65285FB05DA16851C374A7A3EB51FE4F844632CA6E433D5DDACD091C320

Function 00007FF7616B9959 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B999C
memcpy.VCRUNTIME140 ref: 00007FF7616B99C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9A99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9B06

Strings

%s: %s, xrefs: 00007FF7616B9AF1

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: d327bfcba7da6c9850592b24ce4796f2f4af7d1b57654c47056b74fb5bfbcf62
Instruction ID: cbae3d297881fc2b97d2191d1fbb1bafbd21ecfa5eda2e1e5aaf03431b77809b
Opcode Fuzzy Hash: d327bfcba7da6c9850592b24ce4796f2f4af7d1b57654c47056b74fb5bfbcf62
Instruction Fuzzy Hash: 1A417D95A092D2C6EF68EA06511C3B99793EB61FE4F444239CE6F077C5DE6CD055C320

Function 00007FF7616B7B63 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Strings

Start Date: %s, xrefs: 00007FF7616B7E87
Start Date, xrefs: 00007FF7616B7E6D
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7616B7C91
GMT, xrefs: 00007FF7616B7C1E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 50459ee11d2f4459c53cb9f1ba6f40b876d28e43561577c7a73ff8fdf612430e
Instruction ID: 0f2eea20c4b73277ec08396b2e84a5f1c5dc8add84616bcae5b1494162ec706a
Opcode Fuzzy Hash: 50459ee11d2f4459c53cb9f1ba6f40b876d28e43561577c7a73ff8fdf612430e
Instruction Fuzzy Hash: 6D51B369A0C6D2C4EB20EF24950C1B9FBA6FB11F84FC48475CA8D46A95DFBCE561C720

Function 00007FF7616B7AA0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7616B7B4F
Start Date: %s, xrefs: 00007FF7616B7E87
Start Date, xrefs: 00007FF7616B7E6D
GMT, xrefs: 00007FF7616B7AFC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: 52833163c9a05776fcc5bc514b77627af3a48e59c6dfb4def29ef17bc0a2b5c0
Instruction ID: 03df3efc4466a6f350cbc9871b39050b85a38e2854c96bc4c94429a0bbc2f6ef
Opcode Fuzzy Hash: 52833163c9a05776fcc5bc514b77627af3a48e59c6dfb4def29ef17bc0a2b5c0
Instruction Fuzzy Hash: 65319E69A0CA82C4EB50EF64A4081B9E793FB15F88FC84032DA4D1B295DFBCE655C720

Function 00007FF7616B882E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: a198ade456d71fd290c192ef9094b732cc5983dbf1400fe6e936b787195600f5
Instruction ID: cd835b2bdfd914defe9e4c76231c676fda4a9c3a085f517e06400b15eb86b220
Opcode Fuzzy Hash: a198ade456d71fd290c192ef9094b732cc5983dbf1400fe6e936b787195600f5
Instruction Fuzzy Hash: 6721B12AB08AC2C6EB50DB15E4082A9A3A6FB44FD8F884532DE5D53795DF7CD101C710

Function 00007FF7616A28A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A296B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A2984
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A2998

Strings

Failure sending QUIT command: %s, xrefs: 00007FF7616A28F3
QUIT, xrefs: 00007FF7616A28CF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 4ca42619a1e31173df9d1b850f7224c4b4225d9bed481e7d5c2d2b67698de71c
Instruction ID: 2dec8d0b7685dcaf71940b90b3f99f56c65865f202106aa95b8cdf817394b980
Opcode Fuzzy Hash: 4ca42619a1e31173df9d1b850f7224c4b4225d9bed481e7d5c2d2b67698de71c
Instruction Fuzzy Hash: B2317E39A48782C1EB90EF3394583B9A3A6FB45F88F884039DA9D47A55DFACD051C370

Function 00007FF7616994A0 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761685880), ref: 00007FF7616994D5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761685880), ref: 00007FF7616994EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761685880), ref: 00007FF7616994FF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761685880), ref: 00007FF76169952C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761685880), ref: 00007FF761699535
memcpy.VCRUNTIME140(?,?,?,00007FF761685880), ref: 00007FF761699569

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 625087e8469335b8afc7a4f200c7716dbfac2a474bdbc393e31681353d0923a6
Instruction ID: b44808132e858675f4e7342a2cc448b61db9dbebce5e9b5c89388b1c355b6625
Opcode Fuzzy Hash: 625087e8469335b8afc7a4f200c7716dbfac2a474bdbc393e31681353d0923a6
Instruction Fuzzy Hash: DD21B579E08782C6E7209F11A42422AB7A2FB49F98F844534DA9E57794DF7CD450C710

Function 00007FF7616A8710 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A8741
strchr.VCRUNTIME140 ref: 00007FF7616A876D
strchr.VCRUNTIME140 ref: 00007FF7616A8784
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616A87A3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: a40886b6908e31578bfd8f82542a965f67959f0adae9ad5dfc49a1b18558c2a1
Instruction ID: 2ed1376a74248592bd0c7f8945d47530e5955ef1ff77d8778d4871331e00fbd2
Opcode Fuzzy Hash: a40886b6908e31578bfd8f82542a965f67959f0adae9ad5dfc49a1b18558c2a1
Instruction Fuzzy Hash: C921516AB16BC581EB85DB21E0583A863E2EB89F58F480134DE4D4BB54EF7DE491C720

Function 00007FF7616B7CF4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7D2F
memcpy.VCRUNTIME140 ref: 00007FF7616B7D55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Strings

Start Date: %s, xrefs: 00007FF7616B7E87
Start Date, xrefs: 00007FF7616B7E6D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 242ad1759060be2da588470a9a518229d6bc086f1797fcb437397f4febbd150b
Instruction ID: 1fb58551d1a7f89ca2168d071d684cbbe71c49fbc9605940b4bbca882d697bc5
Opcode Fuzzy Hash: 242ad1759060be2da588470a9a518229d6bc086f1797fcb437397f4febbd150b
Instruction Fuzzy Hash: 5421F16DA08283C5EF25EB15951C2B4A693AF15FD8F884531CD0E076E5EFBCA515C320

Function 00007FF7616B85C8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 5365f1df1ed3cea1c2c7de787eb6e300e9b64ce9320d70a5ed4b329ba6b3b17f
Instruction ID: 67934505d19017f7d5fefc8b9a9be9535b14d1fc302cb2fe2c28797b63ce6caf
Opcode Fuzzy Hash: 5365f1df1ed3cea1c2c7de787eb6e300e9b64ce9320d70a5ed4b329ba6b3b17f
Instruction Fuzzy Hash: 2221626AA08A83C6EB50EB15E4582FAA366FF45F88F840432DE4D57766DF7CD051C720

Function 00007FF7616B8606 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7616B9110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B915C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 41b76b45187b604ba47561f7a3e753a50d17ac0b22649e8f1a55bbcb22655a30
Instruction ID: 4664e35c2284c3ff25eed3378d7f56c9682fc184af087d72f998d9c319f47b66
Opcode Fuzzy Hash: 41b76b45187b604ba47561f7a3e753a50d17ac0b22649e8f1a55bbcb22655a30
Instruction Fuzzy Hash: 9F21656AA08A83C6EB50EB15E4582EAA366FF85FC8F840432DE4D57725DF7CD151C720

Function 00007FF7616B85E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7616BAC20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BAC55

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A09
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B8A5C

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Signature: %s, xrefs: 00007FF7616B89F7
Signature, xrefs: 00007FF7616B89DF

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: db904f56e6270d6705b2c490b5aa27aa7852b63d4b065eb65d90f7fbd933b535
Instruction ID: b189b13edabd32889a8dc0b142af9c9a74fa75dc3f06e81de22854aed3cdc9a6
Opcode Fuzzy Hash: db904f56e6270d6705b2c490b5aa27aa7852b63d4b065eb65d90f7fbd933b535
Instruction Fuzzy Hash: FA21836AA08A82C6EB50EB15E4582EAA366FF85F88F840432DE4D57725DF7CD011C720

Function 00007FF76167B510 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF76167B9B3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF76167B9C7
CloseHandle.KERNEL32 ref: 00007FF76167B9D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF76167B9F6
closesocket.WS2_32 ref: 00007FF76167BA14
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF76167BA2D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: cdaac871417b2815011e1e24f7daa236251f8bef380f81fe0f9f7e20ce8ad1ed
Instruction ID: 8d8973eca6cc60e8db3e78bacb7652b8ecfefc64494ee78f2876d92fbe14a658
Opcode Fuzzy Hash: cdaac871417b2815011e1e24f7daa236251f8bef380f81fe0f9f7e20ce8ad1ed
Instruction Fuzzy Hash: AF11FE3A604A41C6E710AF12E558229B371FB89F91F548135DF8D43B54CF79E4A5C710

Function 00007FF761673550 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF761672E89), ref: 00007FF7616737EF

Strings

Unrecoverable error in call to nameserver, xrefs: 00007FF7616737DC
Host not found, xrefs: 00007FF7616737B8
Host not found, try again, xrefs: 00007FF7616737E5
No data record of requested type, xrefs: 00007FF7616737D3

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 6380039508780b6add5a13c08d96a73198b9f942589f9f0a8f4d674408762aa1
Instruction ID: 42bed75b84aa040eebb46a276c569c81f69c4e791cb2d091e51bdf3cf70aabd6
Opcode Fuzzy Hash: 6380039508780b6add5a13c08d96a73198b9f942589f9f0a8f4d674408762aa1
Instruction Fuzzy Hash: E11106A9E1C343D0EB18EB18E55C2B8D7A2EF09F80FC85031C60E06684DEECE480C720

Function 00007FF7616BA305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616BA32B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA7CF

Strings

FALSE, xrefs: 00007FF7616BA320
TRUE, xrefs: 00007FF7616BA7D9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: d19699eb54f18728884f9ffff41851f69321f2634b7708db4c0551ad8526aaa1
Instruction ID: 1d17d450f0fb6578f15c3d9f23bd172c193522526b46cd73ef3fa1b81102d655
Opcode Fuzzy Hash: d19699eb54f18728884f9ffff41851f69321f2634b7708db4c0551ad8526aaa1
Instruction Fuzzy Hash: 7741F4AAB0D356C4FF15EA659018378A7E3AB15F98FC84536CE4E063C5DFAEE0518320

Function 00007FF7616AC350 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7616AC391
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7616AC3D0
WSAGetLastError.WS2_32 ref: 00007FF7616AC428

Strings

TFTP response timeout, xrefs: 00007FF7616AC3EA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: 0ab3da824d1dea4b067a677ac3a599116cb6b186ab2029eaec530af2e695dd18
Instruction ID: 9fdc383ed08f96114e892ea16facef12c6f70cef58f008251e71eac19082351e
Opcode Fuzzy Hash: 0ab3da824d1dea4b067a677ac3a599116cb6b186ab2029eaec530af2e695dd18
Instruction Fuzzy Hash: F641F63A619A41C1EB60AF35D4082B9B792EB85FA4F804231DE2E47BC5DFBCD401C760

Function 00007FF761686400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686525
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686540

Strings

..., xrefs: 00007FF7616864A8
..., xrefs: 00007FF761686492

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: 0c08b42f7022a8eadbaf655e4f3f22b107ec018da9aba7661bea463086124471
Instruction ID: dd754656304b99b499318684519b49877a72c759c0c91a2014d462e0b23366e5
Opcode Fuzzy Hash: 0c08b42f7022a8eadbaf655e4f3f22b107ec018da9aba7661bea463086124471
Instruction Fuzzy Hash: 4831A625A19AC1C1EB64EB21E4487F9A3A2FB84F54F808131CA5E03794CFBDD155C7A0

Function 00007FF761694A40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761694479), ref: 00007FF761694ACD

Strings

Rejected %zu bytes header (max is %d)!, xrefs: 00007FF761694A6B
Failed to alloc memory for big header!, xrefs: 00007FF761694AD8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 28b0121e55b498e294cbccc24d51bb5541ef030638a624a5ee614dbf6a3813a8
Instruction ID: ede87693f4d5a9a8958224f567f9131296950444f87248b2e3ac834f5c6057cc
Opcode Fuzzy Hash: 28b0121e55b498e294cbccc24d51bb5541ef030638a624a5ee614dbf6a3813a8
Instruction Fuzzy Hash: 9A217E36B18A85C6DB04AB1AE5842ADA362FB49FC8F444031EF5D43B59CF7CD5A1C740

Function 00007FF761674C23 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761674CB2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761674CCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761674CEB

Strings

:, xrefs: 00007FF761674CA6

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 52448389aad6167ad041a96b6c2331e0cd9db80a6cc4f9b00badf8efbd453cef
Instruction ID: ff6d3784e9aa1d0240ea1dfba7086cf6f0ec61bd0bf0fc12433bfe88848b4458
Opcode Fuzzy Hash: 52448389aad6167ad041a96b6c2331e0cd9db80a6cc4f9b00badf8efbd453cef
Instruction Fuzzy Hash: C1218E2AA09B85C5EB61AF15E5083B9B3A1BB44B94F988231CB9D43794EF7CD410C720

Function 00007FF76169E7F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF76169E877
%s%s, xrefs: 00007FF76169E823

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 01fd01fb85fd1cdc814dc4af1efcb68caa986b23848b21fa259ade442a81e157
Instruction ID: 348d370541e50cb21477d505202fc28fbd9fa03e3aeee7bfd313945911936729
Opcode Fuzzy Hash: 01fd01fb85fd1cdc814dc4af1efcb68caa986b23848b21fa259ade442a81e157
Instruction Fuzzy Hash: C911A22AF08642C2EB14EB56E5481B8A362FB48FC4F844875DE0E07315DF7CE941C750

Function 00007FF7616B7A71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B7A74
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

Start Date: %s, xrefs: 00007FF7616B7E87
Start Date, xrefs: 00007FF7616B7E6D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: f4815eb0cca36db6935b362272cb02cb240f91003449dbf941b94fd9afdc2f62
Instruction ID: 0d17b475c4a0895158e5e2c53da84ccef61d02f3967e865fc1caf4cccf8dcd69
Opcode Fuzzy Hash: f4815eb0cca36db6935b362272cb02cb240f91003449dbf941b94fd9afdc2f62
Instruction Fuzzy Hash: B101B159A0C283C5EB10EB14A41C2B9A7A7AF15F88FC84831CA0A4B1A6DFBCA515C331

Function 00007FF7616929A0 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF761692A04
strchr.VCRUNTIME140 ref: 00007FF761692A17
strchr.VCRUNTIME140 ref: 00007FF761692A29
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761692A5B
memcpy.VCRUNTIME140 ref: 00007FF761692A85

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: e2d21262de4b7909a237c534343391991a6930e2b65d8f6e0f77b0b64d484383
Instruction ID: 984cd486de12d945879d2924edbb662d966ce09335e1c5158ff391f1e2100060
Opcode Fuzzy Hash: e2d21262de4b7909a237c534343391991a6930e2b65d8f6e0f77b0b64d484383
Instruction Fuzzy Hash: 3521F816A0D69282EFA5AB2251142B9E7D39F44FC4F8C4479DE8D477C6DF6CD806C720

Function 00007FF7616BA4BF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA7CF

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7616BA5E1
TRUE, xrefs: 00007FF7616BA7D9
GMT, xrefs: 00007FF7616BA56E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: db9eeee5f1351480a12aa5f2da278e349761a42a46aad56eca97a60ea7c9fc7e
Instruction ID: 017033559af9b83797e99e89e1408c0cf737474ac69fa31732d22cdc47b61ac6
Opcode Fuzzy Hash: db9eeee5f1351480a12aa5f2da278e349761a42a46aad56eca97a60ea7c9fc7e
Instruction Fuzzy Hash: C451C26AA1C696C4EB11DF24A50C2B9EBA7EB11F84FC44032DA4D42B64DFBCE565C720

Function 00007FF7616B97D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9B06

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7616B98FA
%s: %s, xrefs: 00007FF7616B9AF1
GMT, xrefs: 00007FF7616B988E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: beebfd99418d3e134666a3b667360a78397b1afae66b590f3b48bc445c02abfd
Instruction ID: 10b9e54d572596765609ee548da413557eb8a09b2a1ddc3a1f1ee270f1ae1414
Opcode Fuzzy Hash: beebfd99418d3e134666a3b667360a78397b1afae66b590f3b48bc445c02abfd
Instruction Fuzzy Hash: 9B41C2AAA0C692C5EB60DB15A5082B9F792EB61F94FC58431CE8D43755CFBCE056C720

Function 00007FF76166D590 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF76166D1A8), ref: 00007FF76166D66E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF76166D1A8), ref: 00007FF76166D69C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF76166D1A8), ref: 00007FF76166D705

Part of subcall function 00007FF7616BFB18: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7616643FE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF761661B59), ref: 00007FF7616BFB32

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76166D712

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: be577898cfb132f12a0948304b2fb9bc36eb211b7926233c65c7c8ef3fe3742e
Instruction ID: 7f22cdbca9b20a3d23d9c688c8995cfe6aa6b4a0e63903d0ac623fcabf637782
Opcode Fuzzy Hash: be577898cfb132f12a0948304b2fb9bc36eb211b7926233c65c7c8ef3fe3742e
Instruction Fuzzy Hash: A741FF7A705A81C5EB14EF25D00827CA362BB44FA0FA48631CAAD537C4DFACE490C3A1

Function 00007FF761670790 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670870
memcpy.VCRUNTIME140 ref: 00007FF76167089D
memcpy.VCRUNTIME140 ref: 00007FF7616708AC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7616708DE

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: b289941bc787ad963bcb9495ad2c5e3cafef7c1359faf9c99362ff32d762317a
Instruction ID: f088456ffa952b71f7f4b4adea5a72d6712bfd94257685c6eb37df2e27b9a6c5
Opcode Fuzzy Hash: b289941bc787ad963bcb9495ad2c5e3cafef7c1359faf9c99362ff32d762317a
Instruction Fuzzy Hash: B631F725B19B41C1DB20EB12A44827EE2A2BB05FD0F944235DE6D877C1DF7CE091C3A0

Function 00007FF7616BB140 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF76169D2EB), ref: 00007FF7616BB19E

Strings

%s, xrefs: 00007FF7616BB174

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 9458df8b602da903cdb5424232a6394ac26afb359fa881c3766516657283d285
Instruction ID: afc5e0b90dda49b92cb5d31d53775f901458389425f0759ac07fada9b6c0f65b
Opcode Fuzzy Hash: 9458df8b602da903cdb5424232a6394ac26afb359fa881c3766516657283d285
Instruction Fuzzy Hash: EA417E36A18B85C2EB50EB16B4441AAB3A1FB85FA4F544535DF9E03BA1DF78E4A1C310

Function 00007FF7616BB580 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF76169EB30,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF7616BB5D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BB65C

Strings

%s, xrefs: 00007FF7616BB5A5

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: d2a8b9a4341a91b2540e73c8fc20f79953a9bdad88463489212d982f9f51326b
Instruction ID: 70fedc5557887c8a48fadf6a7a2993b5f44896f01468d7545d17c82b58ed77c0
Opcode Fuzzy Hash: d2a8b9a4341a91b2540e73c8fc20f79953a9bdad88463489212d982f9f51326b
Instruction Fuzzy Hash: BD418136A08B85C2EB50EB26B4441AAB3A1FB85F94F444534DF8E43BA1EF7CE491C710

Function 00007FF761670A20 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF761670AFF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF761670B3C
memcpy.VCRUNTIME140 ref: 00007FF761670B46
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF761670B79

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: ff507d46c410e9d9cdcf4b9eb39d48e974748f0d30041aa2655652cf5154f83c
Instruction ID: b3d683a1b0950cc35536e5d0dcd4224d85351ab6a8bf9d20c8d67e5699b384d9
Opcode Fuzzy Hash: ff507d46c410e9d9cdcf4b9eb39d48e974748f0d30041aa2655652cf5154f83c
Instruction Fuzzy Hash: F631106AB09781D5EB10AF22A50826DE292AB05FD4F980235DE5D477C6CFBEE091C320

Function 00007FF7616BA405 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA7CF

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7616BA4AB
TRUE, xrefs: 00007FF7616BA7D9
GMT, xrefs: 00007FF7616BA459

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 7f4687f8412e3f34b693d9f25119206f39845ea297186b2d0ffc6b4486a475f8
Instruction ID: 26ab9e5118059c8aba06f730b9be78c358dd9c1df12d7b5513d30db7ce2a428d
Opcode Fuzzy Hash: 7f4687f8412e3f34b693d9f25119206f39845ea297186b2d0ffc6b4486a475f8
Instruction Fuzzy Hash: 4531A06AA0DA85D8EB11DF65D5082B9A763FB54F94FC44432CA4E03695DFBCE161C320

Function 00007FF7616A6ADD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A6B14

Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686525
Part of subcall function 00007FF761686400: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF761686540

Strings

Wildcard - START of "%s", xrefs: 00007FF7616A6B1D
Wildcard - "%s" skipped by user, xrefs: 00007FF7616A6B7D
%s%s, xrefs: 00007FF7616A6AE4

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 107df9816e9e57e54c596b5414249ee813eff7631e7fd5186d7bed0e4551ce14
Instruction ID: 28c92a605e50adc627f00b1ff1b8ecde9a908919c100116e7a5bf97bb6a8bf96
Opcode Fuzzy Hash: 107df9816e9e57e54c596b5414249ee813eff7631e7fd5186d7bed0e4551ce14
Instruction Fuzzy Hash: 8F41327AA08A82C5E760EF29D4581ADA362FB44F84F854036DF4E4B795DFBDD441C720

Function 00007FF7616B9715 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9B06

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7616B97B9
%s: %s, xrefs: 00007FF7616B9AF1
GMT, xrefs: 00007FF7616B9769

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: f83450b56afee37c46f647a23c326d31c9929905e360993e1279dba9b38c8cf3
Instruction ID: b977c467272699cb0e91e86afcf9d4610cff47aada7b6ecd80877eb0555ef652
Opcode Fuzzy Hash: f83450b56afee37c46f647a23c326d31c9929905e360993e1279dba9b38c8cf3
Instruction Fuzzy Hash: 013190AAA08B81C5EB60EF61A4486B9A3A2EB65F88FD54032CF4D07255CFBCD555C710

Function 00007FF7616BA64D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA688
memcpy.VCRUNTIME140 ref: 00007FF7616BA6AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA7CF

Strings

TRUE, xrefs: 00007FF7616BA7D9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 832afbf59ecc20a4234f36153a96e11bc8f9fb7faa3d461da38802b0e2ff7b07
Instruction ID: 2d830673c24d837e3ac36c6464266fd6dcc84ca528d3fcf343df6e0c4ad1540d
Opcode Fuzzy Hash: 832afbf59ecc20a4234f36153a96e11bc8f9fb7faa3d461da38802b0e2ff7b07
Instruction Fuzzy Hash: 8721A4AEB0D64684EF05DA169518374A763AB55FE4F844532CD1E077D4EEBDD091C320

Function 00007FF761680B50 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2
memcpy.VCRUNTIME140 ref: 00007FF761680BDD

Part of subcall function 00007FF761675F30: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761675F45

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680C12

Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676067
Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676073

Strings

%s:, xrefs: 00007FF761680BBC

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 1a3d84051bc9983276391cc2067a49442cdfa67c9e2bedaa0b5562f7457c09d7
Instruction ID: 0e452b5cd84c6d2e8e4e1879fb9a700b2db2f28284cc23ea1a3f5e320728d4ad
Opcode Fuzzy Hash: 1a3d84051bc9983276391cc2067a49442cdfa67c9e2bedaa0b5562f7457c09d7
Instruction Fuzzy Hash: 8D21F62AA09B85C1DB00EF12E9581AAB365FB94FE8F840532EE5D47795DF7CD441C360

Function 00007FF7616B9961 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B999C
memcpy.VCRUNTIME140 ref: 00007FF7616B99C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9B06

Strings

%s: %s, xrefs: 00007FF7616B9AF1

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: f5d230d09bddb11f4c2be80aeeb1f72dbe8f6298f509e8bbdd2ac7d4761eaa65
Instruction ID: a32f4b2872720774433c20df0daab24c4214b74fdf2ec651b026f37e40ca23f9
Opcode Fuzzy Hash: f5d230d09bddb11f4c2be80aeeb1f72dbe8f6298f509e8bbdd2ac7d4761eaa65
Instruction Fuzzy Hash: 0921C299A09782C1EF61EA02A5083B69352BB94FE8F884132CE5D03B95DF7CE455C310

Function 00007FF7616B79BA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B7E99

Strings

Start Date: %s, xrefs: 00007FF7616B7E87
Start Date, xrefs: 00007FF7616B7E6D
%s%lx, xrefs: 00007FF7616B7A15

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: 8ba2f3c3a053e956985141babda8935762c040b5fe9b0ce8652dc4cd589aa744
Instruction ID: e7f0b1d774276a5af068cdaccad679a942c5d49111af6635411fe3636f71004b
Opcode Fuzzy Hash: 8ba2f3c3a053e956985141babda8935762c040b5fe9b0ce8652dc4cd589aa744
Instruction Fuzzy Hash: 4921F859A0C282C5EF10FB25941C2F9A793AF15F88FC49831CA0E5B696DFADA514C330

Function 00007FF7616B3A40 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616B47A9,00000000,?,?,00007FF7616B3D66), ref: 00007FF7616B3A69
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616B47A9,00000000,?,?,00007FF7616B3D66), ref: 00007FF7616B3AA0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7616B47A9,00000000,?,?,00007FF7616B3D66), ref: 00007FF7616B3AB2
memcpy.VCRUNTIME140(?,?,?,00007FF7616B47A9,00000000,?,?,00007FF7616B3D66), ref: 00007FF7616B3ADA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: 201d7c26a47bb9774e8661d9b7b0fff41fc2ec85823bd8ab3e7185ccf4486254
Instruction ID: 5549183b095a1ca799cf9c6bde568b75ae73aa0e09267b6fb3ca467bf3265e51
Opcode Fuzzy Hash: 201d7c26a47bb9774e8661d9b7b0fff41fc2ec85823bd8ab3e7185ccf4486254
Instruction Fuzzy Hash: D2216D6AB09B81C2DB44CF16F054229B3A1FB48FC8B888435DE5E43758DF78C4A1C710

Function 00007FF76169C850 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C878
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C89E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C8BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF761680DC9,?,?,?,?,00007FF76168016B), ref: 00007FF76169C8D0

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: cabc26addc2401d9eb1a58dc0410cf863a4dbc7c9db6dab5f18b53f72baa0c0e
Instruction ID: 661a586291145f5083057487ed410f7cc33861a3c36025aa82d21f1d157cc4fa
Opcode Fuzzy Hash: cabc26addc2401d9eb1a58dc0410cf863a4dbc7c9db6dab5f18b53f72baa0c0e
Instruction Fuzzy Hash: C311E725F09743C7EB20AB12664823AE692FB49FD0F850435DE4E57B44DEBCD8418750

Function 00007FF7616BDC30 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7616BDC6D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BDC7D
WideCharToMultiByte.KERNEL32 ref: 00007FF7616BDCAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BDCB9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 03c04eedff98bd114c8db373987edfe353b16d9b561a06dbe701af264d9b3090
Instruction ID: e51b324f7734227bfe3fa2c08509f826293a2c04d029fbbd9f9c79f747ce28c6
Opcode Fuzzy Hash: 03c04eedff98bd114c8db373987edfe353b16d9b561a06dbe701af264d9b3090
Instruction Fuzzy Hash: C8115B39B0DB41C6E710AF62B808129B7A5FB88F84B884438DF8D47B14DFB8E561CB50

Function 00007FF761692270 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616922F3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF761692280

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 3a9a473e6be16dc48f278ee67881fb5fe137b81527da702573c6769a82dec04a
Instruction ID: ad8afe8f0f5bc24263de910e17050c3966afcfe477acdc64826af14024c7f53b
Opcode Fuzzy Hash: 3a9a473e6be16dc48f278ee67881fb5fe137b81527da702573c6769a82dec04a
Instruction Fuzzy Hash: A0010466F05B42C2FB156B56B4543A9A261AF44FE0F448674CEA9073C0DFBC9891C360

Function 00007FF76167BA40 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF76167B9F2,?,?,?,00000000), ref: 00007FF76167BA51
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167B9F2,?,?,?,00000000), ref: 00007FF76167BA5A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76167B9F2,?,?,?,00000000), ref: 00007FF76167BA64
closesocket.WS2_32 ref: 00007FF76167BA82

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: af2388205e1df7f8a2eb9a4d6a6a74e23c5d38f564cdff0bf6df485ebc21babc
Instruction ID: 15a4931614009ed91dda30c00505a58c74dba84b57aa87baef3d141cc621a31c
Opcode Fuzzy Hash: af2388205e1df7f8a2eb9a4d6a6a74e23c5d38f564cdff0bf6df485ebc21babc
Instruction Fuzzy Hash: AA017517D18B82C3E714EF35C8681786321FFE9F1CB41A325DE6D411A59FA8A5E0C310

Function 00007FF761689AE2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7616898B8), ref: 00007FF761689A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7616898B8), ref: 00007FF761689A1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761689A62

Strings

I32, xrefs: 00007FF7616899F5
I64, xrefs: 00007FF761689A15

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 1084f5eface751f809c7f2a4aad978dbdc4d4029a98d1f95eb81aebacb5737ad
Instruction ID: f1173a7560beb8157668ceb084111e8298783dbd714b4a7fd6d78a2a95a04013
Opcode Fuzzy Hash: 1084f5eface751f809c7f2a4aad978dbdc4d4029a98d1f95eb81aebacb5737ad
Instruction Fuzzy Hash: DCF08229B08543C1EF909B21D8A8675E7969F89F88F896135CD2E816D4CEACD200C731

Function 00007FF761689ADA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7616898B8), ref: 00007FF761689A05
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7616898B8), ref: 00007FF761689A1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF761689A62

Strings

I32, xrefs: 00007FF7616899F5
I64, xrefs: 00007FF761689A15

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 9ec57b4b14ab1520ae2fd61540b1c7808844ff866eeb48084511e072fc2270d1
Instruction ID: bd2f3938563b37b40c63026a00cad91a64a0cef4671db7ef566d4e6d284de7b8
Opcode Fuzzy Hash: 9ec57b4b14ab1520ae2fd61540b1c7808844ff866eeb48084511e072fc2270d1
Instruction Fuzzy Hash: 28F08229B0C543C1EF909B21D8A8675E7969F89F88F896135CD1E816D4CEACD200C731

Function 00007FF7616B1AD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF761686E86), ref: 00007FF7616B1AE4

Strings

%lx, xrefs: 00007FF7616B1DCA

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: 52c6e097e963a6628f868ec6cac9492ecd733cabba3e5dc2fb46574cf4b56e25
Instruction ID: cb0881d4d956b0a548e5574b840601dcf7b81b13b4fc9b1e6738f5e654d887b8
Opcode Fuzzy Hash: 52c6e097e963a6628f868ec6cac9492ecd733cabba3e5dc2fb46574cf4b56e25
Instruction Fuzzy Hash: C0816D27A1C1D1C5E768DB24B45827DBBF2F785B90F544235EAAE422C0DEBCD451CB20

Function 00007FF76169D7F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF76169D1D3), ref: 00007FF76169D8C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF76169D1D3), ref: 00007FF76169D913

Strings

(){ %*], xrefs: 00007FF76169D80D

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: a2d67765c7a5dc4ec3c005a88b734144e7937f55b09edc6cecbb18d84dfcb0d8
Instruction ID: df1f616371fba7379b97516f83fa7ae34176d535e478df47f74cbb4f05ac359d
Opcode Fuzzy Hash: a2d67765c7a5dc4ec3c005a88b734144e7937f55b09edc6cecbb18d84dfcb0d8
Instruction Fuzzy Hash: 79314619D0C687C6FB216B156148378ABD39F56F58FC949B1D98E072C3CE6DAD05C220

Function 00007FF761689600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761689620
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76168967B

Strings

, xrefs: 00007FF761689633

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: f007defbe466de477ca43de1dbeb36f93a3c148d42cae4483d77c4417899ba6d
Instruction ID: a721069b1a74aff3dfd8475c84e601c9c08d994d5cab34dfc416f8a7ce644e58
Opcode Fuzzy Hash: f007defbe466de477ca43de1dbeb36f93a3c148d42cae4483d77c4417899ba6d
Instruction Fuzzy Hash: 66118176A09B81C1EB849F16E154269B3A1FB48FD8F844535DE5E07B88EF78D5E0C360

Function 00007FF761687920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF76168799F
setsockopt.WS2_32 ref: 00007FF7616879CE

Strings

@, xrefs: 00007FF76168792F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: f6ec6453dcb4e67fffed1e8bcf1aefb452d83f39a6205ecab06ea16d42c783b9
Instruction ID: 877e4765ad38b02e6f44e8c0dececb073ba36b709b06afd6ec1e8cdfad537aef
Opcode Fuzzy Hash: f6ec6453dcb4e67fffed1e8bcf1aefb452d83f39a6205ecab06ea16d42c783b9
Instruction Fuzzy Hash: F9114279A08182C6FB60DF10E408676F7A2FB85B48F940034DA8946AA4DFFDD599CF20

Function 00007FF7616BA3D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616BA3DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616BA7CF

Strings

TRUE, xrefs: 00007FF7616BA7D9

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: 9f7382e18b3041a3e93490953c45f0e4b0f4161914aac1650cb6f1c2e67001f6
Instruction ID: 452431d5680f2d5f46041a3b6848ba389c7f091127ebcf0e4fd9aff1767fc423
Opcode Fuzzy Hash: 9f7382e18b3041a3e93490953c45f0e4b0f4161914aac1650cb6f1c2e67001f6
Instruction Fuzzy Hash: B1014CAEA0965584EB02DB25E518378A7A3AB15F98FC44832CE1E06394DEBCD092C320

Function 00007FF7616B96E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7616B96EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616B9B06

Part of subcall function 00007FF761680B50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF761680BA2

Strings

%s: %s, xrefs: 00007FF7616B9AF1

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: ce95b56a7c92656b16259ff00a4cfcc9f4106ba29798c8b37636380f06af6113
Instruction ID: 5dcc35d51944600897d07d9d5f4569a0421f6957c404a6e79b906807f9f04a85
Opcode Fuzzy Hash: ce95b56a7c92656b16259ff00a4cfcc9f4106ba29798c8b37636380f06af6113
Instruction Fuzzy Hash: B3F04459A0C781C1EB61AB12B8087F59352AB55F88FC84431CE5D07756DF7CE155C724

Function 00007FF7616BDB80 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7616B0CB8), ref: 00007FF7616BDBB1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7616B0CB8), ref: 00007FF7616BDBC4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7616B0CB8), ref: 00007FF7616BDBEB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7616B0CB8), ref: 00007FF7616BDBF8

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 5abc08f8efcdf07fb6a3fff450b6aa11847ea7856984884628bec1e59b2a9258
Instruction ID: ff03f5d54dcbb4a753ead5e42e3d9b7e8121caaca59d67112ad6ca1c51e9851a
Opcode Fuzzy Hash: 5abc08f8efcdf07fb6a3fff450b6aa11847ea7856984884628bec1e59b2a9258
Instruction Fuzzy Hash: E9115129B08752C2E760DB2AF41402AA6A5BF88F98F484535DF4C47B58DF7CD5908710

Function 00007FF76167C510 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676067
Part of subcall function 00007FF761676040: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761680640,?,?,?,?,?,?,?,?,?,?,00000000,00007FF761672471), ref: 00007FF761676073

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C546
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C556
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF76167C564
memset.VCRUNTIME140 ref: 00007FF76167C59F

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: b476d781683bd605753166caffe2319fbc1c98f8906f10cc98198184c3fa0d6f
Instruction ID: b92cc7662f8707aba5b8bf670a7865bce459efbe337537b967f6378287368292
Opcode Fuzzy Hash: b476d781683bd605753166caffe2319fbc1c98f8906f10cc98198184c3fa0d6f
Instruction Fuzzy Hash: 2C211D36E18B91D3E314DB22E6543A8A360F799B44F519225EB9D43A11DFB4F1F1C300

Function 00007FF7616BB720 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76169D5A3), ref: 00007FF7616BE6B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76169D5A3), ref: 00007FF7616BE6D5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76169D5A3), ref: 00007FF7616BE6EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF76169D5A3), ref: 00007FF7616BE6FD

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cceb363f3383bb9859af09066e7c5d0c6a7185a683f001f5595319a996bee7d
Instruction ID: d98c1bdca321c24b2afeafaa3a879a450d56b8f58e385f0ea4ed14f9497c47a5
Opcode Fuzzy Hash: 0cceb363f3383bb9859af09066e7c5d0c6a7185a683f001f5595319a996bee7d
Instruction Fuzzy Hash: C611EC2AA08A45C1EB54EF25E5A423CA3A6FF94F88F948435CA5E42764CE7CD861C350

Function 00007FF7616A3510 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A3548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A356E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A358A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7616A359E

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b3c3805f82caad35ddc01d018df6cc76f4a284c910c5e9ee53ad49d6aa0b3735
Instruction ID: 4d1bfc4f61d089edfc42c472484853bd3ceff13b1df6bc23653a96b6694ed643
Opcode Fuzzy Hash: b3c3805f82caad35ddc01d018df6cc76f4a284c910c5e9ee53ad49d6aa0b3735
Instruction Fuzzy Hash: E211283AA04B40C6D750DF25E584368B3A5F784F48F484039DE8E57728CF38E8A5C360

Function 00007FF7616B5150 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B124E), ref: 00007FF7616B5176
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B124E), ref: 00007FF7616B5197
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B124E), ref: 00007FF7616B51B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7616B124E), ref: 00007FF7616B51C0

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5c8853aa7cfb41fb736cb08fd9c58292c725a3a828156dd37d5180451661d39c
Instruction ID: ff454cae1b777ed7da0cd77540328cb54499e6106c7eccf627bbee27ae14adb5
Opcode Fuzzy Hash: 5c8853aa7cfb41fb736cb08fd9c58292c725a3a828156dd37d5180451661d39c
Instruction Fuzzy Hash: 1911A53AA04B45C2EB14EF26E99412CB3BAFF95F897504426CE5D43768CF78D8A4C390

Function 00007FF7616B2AF0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761688D15,?,?,00000000,00007FF7616819D1,?,?,00000000,00007FF761681F05), ref: 00007FF7616B2B00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761688D15,?,?,00000000,00007FF7616819D1,?,?,00000000,00007FF761681F05), ref: 00007FF7616B2B26
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761688D15,?,?,00000000,00007FF7616819D1,?,?,00000000,00007FF761681F05), ref: 00007FF7616B2B34
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF761688D15,?,?,00000000,00007FF7616819D1,?,?,00000000,00007FF761681F05), ref: 00007FF7616B2B42

Memory Dump Source

Source File: 00000000.00000002.4045743202.00007FF761661000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF761660000, based on PE: true

Associated: 00000000.00000002.4045726305.00007FF761660000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045788411.00007FF7616C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045814302.00007FF7616D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4045839565.00007FF7616DF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff761660000_EspPrivStoreAtt116.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0ca5987a86bd8772b3c6def7f7db8b85989afe65d4c00123de1d083a15ff9c08
Instruction ID: cd56394111b12818beabd7881b62d18530228a95c66f1a11aed3e13f92ddcc55
Opcode Fuzzy Hash: 0ca5987a86bd8772b3c6def7f7db8b85989afe65d4c00123de1d083a15ff9c08
Instruction Fuzzy Hash: B4F0C97AA04B01C2DB149F22F9A8128B3B5FF98F8C7514525CE9D43764CF78D465C350

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EspPrivStoreAtt116.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
EspPrivStoreAtt116.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre