Edit tour

Windows Analysis Report
G9e272AEyo.exe

Overview

General Information

Sample name:	G9e272AEyo.exe renamed because original name is a hash value
Original sample name:	f0f5b379dfbcd101a6abffae96082417.exe
Analysis ID:	1538233
MD5:	f0f5b379dfbcd101a6abffae96082417
SHA1:	505849de091e311eb9ef7c413a18525b7338dc8e
SHA256:	b779b04efc9be9517b8ae479e408f6054a0f7f8ef3d1af542d5c0c863566c165
Tags:	64exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

G9e272AEyo.exe (PID: 6580 cmdline: "C:\Users\user\Desktop\G9e272AEyo.exe" MD5: F0F5B379DFBCD101A6ABFFAE96082417)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6704 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6732 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6828 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6880 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7012 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7080 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7108 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4364 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4820 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6016 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2180 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 928 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2736 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3732 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1368 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5432 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 908 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3584 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6988 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7128 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6636 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6752 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6876 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7068 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7016 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2304 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3916 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2872 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1284 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 480 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4544 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6112 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5236 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 7124 cmdline: C:\Windows\system32\WerFault.exe -u -p 6580 -s 1004 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: G9e272AEyo.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Machine Learning detection for sample

Source: G9e272AEyo.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F9F3D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF6482F9F3D
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF648315AD0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF648315AD0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF64831CE40
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831EF30 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF64831EF30
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482FC1C0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF6482FC1C0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F9230 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF6482F9230
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482FC220 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6482FC220
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482FC210 CryptHashData,	0_2_00007FF6482FC210
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F9300 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6482F9300
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6483163F0 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF6483163F0

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF6482DF0E0
Source: G9e272AEyo.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF648308B00

Source: unknown

HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: G9e272AEyo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Aim\x64\Release\EpicGames.pdb source: G9e272AEyo.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.1.5 104.26.1.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF6482F4A60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,

0_2_00007FF6482F4A60

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: G9e272AEyo.exe	String found in binary or memory: http://185.101.104.122/aimhvcibronkzops.exe
Source: G9e272AEyo.exe	String found in binary or memory: http://185.101.104.122/aimhvcibronkzops.exeC:
Source: G9e272AEyo.exe	String found in binary or memory: http://185.101.104.122/aimhvciforabronkz.exe
Source: G9e272AEyo.exe	String found in binary or memory: http://185.101.104.122/aimhvciforabronkz.exeC:
Source: Amcache.hve.37.dr	String found in binary or memory: http://upx.sf.net
Source: G9e272AEyo.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: G9e272AEyo.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace
Source: G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ce
Source: G9e272AEyo.exe, 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/s

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF64831CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF64831CE40

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E8980	0_2_00007FF6482E8980
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E6980	0_2_00007FF6482E6980
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E7CC0	0_2_00007FF6482E7CC0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F9F3D	0_2_00007FF6482F9F3D
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482D1530	0_2_00007FF6482D1530
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482EF590	0_2_00007FF6482EF590
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482D8990	0_2_00007FF6482D8990
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6483049F0	0_2_00007FF6483049F0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF648315AD0	0_2_00007FF648315AD0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482CEB70	0_2_00007FF6482CEB70
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482CABFD	0_2_00007FF6482CABFD
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F7CC0	0_2_00007FF6482F7CC0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482CDDE0	0_2_00007FF6482CDDE0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831CE40	0_2_00007FF64831CE40
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831EEC0	0_2_00007FF64831EEC0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482FA005	0_2_00007FF6482FA005
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482C1000	0_2_00007FF6482C1000
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F9FFC	0_2_00007FF6482F9FFC
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64830D220	0_2_00007FF64830D220
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482CD250	0_2_00007FF6482CD250
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E3330	0_2_00007FF6482E3330
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F53E0	0_2_00007FF6482F53E0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF648309520	0_2_00007FF648309520
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF648310580	0_2_00007FF648310580
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482C955D	0_2_00007FF6482C955D
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6483115B0	0_2_00007FF6483115B0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482FC5D0	0_2_00007FF6482FC5D0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E0600	0_2_00007FF6482E0600
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482C973B	0_2_00007FF6482C973B
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E9840	0_2_00007FF6482E9840
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F2890	0_2_00007FF6482F2890

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482EA330 appears 33 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482E0240 appears 70 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482EA2A0 appears 37 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482D3030 appears 49 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482E8DB0 appears 46 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482EA410 appears 34 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482E5970 appears 378 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482E5AF0 appears 323 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF6482E8E80 appears 35 times
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: String function: 00007FF648320236 appears 47 times

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6580 -s 1004

Source: classification engine

Classification label: mal56.winEXE@69/22@1/2

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF6482D1D10 GetLastError,_errno,FormatMessageA,strchr,strncpy,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF6482D1D10

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6580
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\816a52bd-16b0-4ce8-b757-20866cdd867b

Jump to behavior

Source: G9e272AEyo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: G9e272AEyo.exe

ReversingLabs: Detection: 31%

Source: G9e272AEyo.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\G9e272AEyo.exe "C:\Users\user\Desktop\G9e272AEyo.exe"
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6580 -s 1004
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: G9e272AEyo.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: G9e272AEyo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: G9e272AEyo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: G9e272AEyo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: G9e272AEyo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: G9e272AEyo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: G9e272AEyo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: G9e272AEyo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: G9e272AEyo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Aim\x64\Release\EpicGames.pdb source: G9e272AEyo.exe

Source: G9e272AEyo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: G9e272AEyo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: G9e272AEyo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: G9e272AEyo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: G9e272AEyo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF6482E8980 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF6482E8980

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\G9e272AEyo.exe

API coverage: 4.3 %

Source: Amcache.hve.37.dr	Binary or memory string: VMware
Source: Amcache.hve.37.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.37.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.37.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.37.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.37.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.37.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.37.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.37.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.37.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.37.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.37.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.37.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.37.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.37.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.37.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.37.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.37.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.37.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.37.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.37.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.37.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.37.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.37.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.37.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.37.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF64831FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF64831FD4C

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF6483200E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6483200E8

Source: C:\Users\user\Desktop\G9e272AEyo.exe

0_2_00007FF6482E8980

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831F9F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF64831F9F4
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF64831FD4C
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64831FEF4 SetUnhandledExceptionFilter,	0_2_00007FF64831FEF4

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T

Source: C:\Users\user\Desktop\G9e272AEyo.exe

Code function: 0_2_00007FF64831FF64 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF64831FF64

Source: Amcache.hve.37.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.37.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.37.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.37.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482F4A60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF6482F4A60
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6483049F0 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF6483049F0
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64830B4F1 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF64830B4F1
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF6482E7630 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF6482E7630
Source: C:\Users\user\Desktop\G9e272AEyo.exe	Code function: 0_2_00007FF64830B750 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF64830B750

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
G9e272AEyo.exe	32%	ReversingLabs	Win64.Trojan.Generic
G9e272AEyo.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.1.5	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.37.dr	false	URL Reputation: safe	unknown
http://185.101.104.122/aimhvcibronkzops.exe	G9e272AEyo.exe	false		unknown
https://keyauth.win/api/1.1/ace	G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/aimhvciforabronkz.exeC:	G9e272AEyo.exe	false		unknown
https://keyauth.win/api/1.2/s	G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/aimhvciforabronkz.exe	G9e272AEyo.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html	G9e272AEyo.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	G9e272AEyo.exe	false		unknown
https://keyauth.win/api/1.1/ce	G9e272AEyo.exe, 00000000.00000002.1822329975.00000257A73EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keyauth.win/api/1.2/	G9e272AEyo.exe, 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmp	false		unknown
http://185.101.104.122/aimhvcibronkzops.exeC:	G9e272AEyo.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.1.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538233
Start date and time:	2024-10-20 21:09:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	G9e272AEyo.exe renamed because original name is a hash value
Original Sample Name:	f0f5b379dfbcd101a6abffae96082417.exe
Detection:	MAL
Classification:	mal56.winEXE@69/22@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 248
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: G9e272AEyo.exe

Simulations

Behavior and APIs

Time	Type	Description
15:10:10	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.1.5	Frozen_Slotted.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse
	4.7.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.29811.31558.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.24813.27582.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.25703.16605.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.5842.23757.exe	Get hash	malicious	Unknown	Browse
	https://app.slidebean.com/p/mbice9jyuy/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Frozen_Slotted.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.TrojanX-gen.12317.30120.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Download.exe	Get hash	malicious	LummaC	Browse	104.21.53.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.1.5
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	104.26.1.5
	ojSv9FmOwn.lnk	Get hash	malicious	Unknown	Browse	104.26.1.5
	a1OueQJq4d.exe	Get hash	malicious	DCRat	Browse	104.26.1.5
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.26.1.5
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.26.1.5
	N2ER4ZENF1.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	N2ER4ZENF1.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win64.Evo-gen.14681.29745.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.26.1.5
	SecuriteInfo.com.Win64.MalwareX-gen.18133.14409.exe	Get hash	malicious	Discord Rat	Browse	104.26.1.5

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_G9e272AEyo.exe_38d8115434c1d6f4526792875acb23d414_949d7e63_24e1ab57-b402-426d-a902-b7bdba8ffb82\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9977624473406657
Encrypted:	false
SSDEEP:	96:w5uFetdsThIx7tfaQXIDcQMc6VhcEGcw3wpm+HbHg/8BRTf3o8Fa9KUNsPQ2w1Ib:BGdD0yfsEpjfVmUzuiFyZ24lO8nxS
MD5:	7CCB07F3CF5B84EB34E4B300F443738E
SHA1:	55DCD47A56E1680E9F00010EFA157B9E32FDB43C
SHA-256:	DF9BF7015B57C255A4A109E74C128AFEDDD13D1F9539A7B59055066AAC53592B
SHA-512:	90F829F12691C8CF69C96E042F88631334412AA62585553116945EE8DE05E56927A87B0E27615E9F8270F9124F4AC6AD76C2FD6A41C523101B9AF8267B27C0C7
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.2.5.0.0.4.5.9.1.4.7.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.2.5.0.0.5.0.7.5.8.4.7.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.e.1.a.b.5.7.-.b.4.0.2.-.4.2.6.d.-.a.9.0.2.-.b.7.b.d.b.a.8.f.f.b.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.6.0.9.4.5.e.-.c.d.c.3.-.4.1.3.8.-.b.f.8.d.-.c.a.6.8.f.e.5.7.1.2.9.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.G.9.e.2.7.2.A.E.y.o...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.b.4.-.0.0.0.1.-.0.0.1.4.-.0.0.f.2.-.b.8.a.7.2.3.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.4.c.f.5.1.3.b.8.2.2.5.4.8.8.9.d.f.7.7.3.5.6.8.9.c.7.2.1.1.2.1.0.0.0.0.f.f.f.f.!.0.0.0.0.5.0.5.8.4.9.d.e.0.9.1.e.3.1.1.e.b.9.e.f.7.c.4.1.3.a.1.8.5.2.5.b.7.3.3.8.d.c.8.e.!.G.9.e.2.7.2.A.E.y.o...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3CEA.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 19:10:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	106100
Entropy (8bit):	1.6106783728828924
Encrypted:	false
SSDEEP:	384:n7NMclZ+0zZkORuKGf0f/3/sdDRtiqvO20N+zl:JF/+0VbRuKGQs5aZ0
MD5:	1470CFD454F4EE6917102197D2C10E11
SHA1:	ED3798036F91E7B21C53501AFFC40EA654F391A1
SHA-256:	CA8C6A53A5104956DBAAE7171F316D860780BE8F5954C4859A76B4FF4F9B9D12
SHA-512:	8F3653C17E898243E8266B328A31D1884F12DD468EEEFC43C85AEF7BC713DBB750AF9561A4AC9B96F210F41A42252146DA6FFC37764869D537BB1E907DC5CAE6
Malicious:	false
Preview:	MDMP..a..... ........U.g............$...............,............J..........T.......8...........T...........p'...w.......................!..............................................................................eJ......T"......Lw......................T............U.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DD6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10132
Entropy (8bit):	3.7087127831487043
Encrypted:	false
SSDEEP:	192:R6l7wVeJcWL6Y9txmGgmfZnEprT89b42lfgom:R6lXJFL6Y3MGgmfZn148fm
MD5:	710609471681C07D73979964D74B4060
SHA1:	D08272E9909FCB9B292DB38CCB52DECBEC4ED918
SHA-256:	CCA44CB62EE1C6BC3570D18ACFC5EBB0E4AAFB78947E87D9D829B7CE7A41852E
SHA-512:	01AF49960C147E6741E990A80FBCB492FCC1A0906A43981CC830172987B48B5E794870D0FCB359F9C705382375142BCFD0214E002851CDBAA258097DE66013D3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E35.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.465403245286182
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9HmzSSWpW8VYOoYm8M4J1TPSMF+yq85R0K2nCCAt4nt3d:uIjf6I7dWz7VjJmXKw3d
MD5:	2AE6B5AA0E17D35CE0788A1343BC1217
SHA1:	93EF10AA6710A9DFF6CDCDB8F4086AE153216A82
SHA-256:	C308B9ECCAA3C87CF1B9CAC771982488DEFA5241A7AF3D42BEE08C23C8F81B63
SHA-512:	63A156ED7B3CBC59BE15A51C135FAF851291DFE63892A4590C467E6FFA6DF1B78A6B8D79F45EB4543078C70AD89FA5399C02C8BFF5B8588554ACFD67F2F701EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552132" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4656039153401315
Encrypted:	false
SSDEEP:	6144:dIXfpi67eLPU9skLmb0b49WSPKaJG8nAgejZMMhA2gX4WABl0uNSdwBCswSbt:OXD949WlLZMM6YFHY+t
MD5:	CF4FE81914BC8ABF87CABF056E8747E1
SHA1:	70D5E160840C6CB6E14CB9C87BF3664475F8EEB4
SHA-256:	39AD7F0821E133E287633C321334B01836A6A4BA17007D06F1BB03A3BD01BEF3
SHA-512:	F6305135935D3884CC4B61B498916D7D83250D6A2AA0C2A15C3C23D032141F7812CA71E5A02E07699538352822F4C55929244126EB2FB79856A10D86ED4C0BB5
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..s.##...............................................................................................................................................................................................................................................................................................................................................4d.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.423322949566928
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	G9e272AEyo.exe
File size:	506'368 bytes
MD5:	f0f5b379dfbcd101a6abffae96082417
SHA1:	505849de091e311eb9ef7c413a18525b7338dc8e
SHA256:	b779b04efc9be9517b8ae479e408f6054a0f7f8ef3d1af542d5c0c863566c165
SHA512:	77a2bc28641ae88fe14ff16bccc738941a7e2f939d9df5279956d76df9f7bcef8dd5f7ce47c0102f92011dfc8153c4f55ea687bca0064df75681345a627b96dc
SSDEEP:	6144:Sy8K4ZP3rneV8giiDYviaN4TuNy+m4W70Lzxw2T942uHde9VWWJpQHCgTf1:SDxVtfkYvi3qNRWYLz2m+P4mzHC6f1
TLSH:	43B46D56A7A807E9D1A7D03CC547C603E7B6B4991310DBDB43A0CA791F63BE16E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14005f9d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67128079 [Fri Oct 18 15:36:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F90C138FA68h
dec eax
add esp, 28h
jmp 00007F90C138F357h
int3
int3
jmp 00007F90C138FD18h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000178Bh]
dec eax
mov ecx, ebx
call dword ptr [000016F2h]
call dword ptr [00001774h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001770h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001764h]
test eax, eax
je 00007F90C138F4E9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018E12h]
call 00007F90C138F6AEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EF9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E89h], eax
dec eax
mov eax, dword ptr [00018EE2h]
dec eax
mov dword ptr [00018D53h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E57h], eax
mov dword ptr [00018D2Dh], C0000409h
mov dword ptr [00018D27h], 00000001h
mov dword ptr [00000031h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fda8	0x5fe00	ad7af0cbccd1a4defd6ae074a195a815	False	0.5327243929269883	data	6.336128214871671	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	1c53da1c44920008c818f71dd0927c63	False	0.37981842376373626	data	5.578623672658902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	227ce6cadd4904b7716198186655da5c	False	0.2138671875	data	2.4411408781631465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	50e902fb009b515c9924ff6238b5e51d	False	0.48175048828125	data	5.776998787420237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	39326fb49822ad82593e9e49b5e608b8	False	0.5123697916666666	data	4.849267575521713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:10:01.332422018 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:01.332451105 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:01.332870007 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:01.343858004 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:01.343874931 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.117132902 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.117264032 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:02.121400118 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:02.121409893 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.121715069 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.125371933 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:02.167431116 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.586214066 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.586270094 CEST	443	49734	104.26.1.5	192.168.2.4
Oct 20, 2024 21:10:02.586801052 CEST	49734	443	192.168.2.4	104.26.1.5
Oct 20, 2024 21:10:11.703583956 CEST	49734	443	192.168.2.4	104.26.1.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:10:01.317313910 CEST	56509	53	192.168.2.4	1.1.1.1
Oct 20, 2024 21:10:01.327142954 CEST	53	56509	1.1.1.1	192.168.2.4
Oct 20, 2024 21:10:45.837368965 CEST	53	49822	162.159.36.2	192.168.2.4
Oct 20, 2024 21:10:46.794553041 CEST	53	56730	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 21:10:01.317313910 CEST	192.168.2.4	1.1.1.1	0x18e	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 21:10:01.327142954 CEST	1.1.1.1	192.168.2.4	0x18e	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:10:01.327142954 CEST	1.1.1.1	192.168.2.4	0x18e	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:10:01.327142954 CEST	1.1.1.1	192.168.2.4	0x18e	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.26.1.5	443	6580	C:\Users\user\Desktop\G9e272AEyo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 19:10:02 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-20 19:10:02 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 32 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.2&name=loader principal&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\G9e272AEyo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\G9e272AEyo.exe"
Imagebase:	0x7ff6482c0000
File size:	506'368 bytes
MD5 hash:	F0F5B379DFBCD101A6ABFFAE96082417
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff776380000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:09:58
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff776380000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2736, Parent PID: 928

General

Target ID:	14
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1368, Parent PID: 3732

General

Target ID:	16
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7699e0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 908, Parent PID: 5432

General

Target ID:	18
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6988, Parent PID: 3584

General

Target ID:	20
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff776380000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6636, Parent PID: 7128

General

Target ID:	22
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff776380000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6876, Parent PID: 6580

General

Target ID:	24
Start time:	15:10:03
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7068, Parent PID: 6876

General

Target ID:	25
Start time:	15:10:03
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:10:03
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2304, Parent PID: 7016

General

Target ID:	27
Start time:	15:10:03
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2872, Parent PID: 3916

General

Target ID:	29
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff631850000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 480, Parent PID: 1284

General

Target ID:	31
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff776380000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff776380000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff7cb6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6580 -s 1004
Imagebase:	0x7ff68cea0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	90

Executed Functions

Function 00007FF6482EF590 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EF668
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EF675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EF748
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EF7CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EF873
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EF90A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EF9D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EFA0D
strchr.VCRUNTIME140 ref: 00007FF6482EFB87
strchr.VCRUNTIME140 ref: 00007FF6482EFB9A
strchr.VCRUNTIME140 ref: 00007FF6482EFBAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EFCB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EFD23
memcpy.VCRUNTIME140 ref: 00007FF6482EFD4A
strchr.VCRUNTIME140 ref: 00007FF6482EFD5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EFD72
strstr.VCRUNTIME140 ref: 00007FF6482EFFA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F00E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F0259

Part of subcall function 00007FF6482E8DB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E8E23

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F030C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F0391
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F05EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F0600
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F060F

Part of subcall function 00007FF6482F1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19BA

strchr.VCRUNTIME140 ref: 00007FF6482F0BC7
strchr.VCRUNTIME140 ref: 00007FF6482F0BDA
strchr.VCRUNTIME140 ref: 00007FF6482F0BEC

Part of subcall function 00007FF6482F1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19DA
Part of subcall function 00007FF6482F1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19E3

strchr.VCRUNTIME140 ref: 00007FF6482F0E3F
strchr.VCRUNTIME140 ref: 00007FF6482F0E52
strchr.VCRUNTIME140 ref: 00007FF6482F0E64

Part of subcall function 00007FF6482F3F90: strchr.VCRUNTIME140 ref: 00007FF6482F4076
Part of subcall function 00007FF6482F3F90: strchr.VCRUNTIME140 ref: 00007FF6482F4089
Part of subcall function 00007FF6482F3F90: strchr.VCRUNTIME140 ref: 00007FF6482F409B

Strings

Host:%s, xrefs: 00007FF6482EFDB6
If-Modified-Since, xrefs: 00007FF6482F085D
Transfer-Encoding:, xrefs: 00007FF6482EFB3E
Referer, xrefs: 00007FF6482EF923
Accept, xrefs: 00007FF6482F0063
Referer: %s, xrefs: 00007FF6482EF93E
Could only read %I64d bytes from the input, xrefs: 00007FF6482F0215
Expect:, xrefs: 00007FF6482F0B85, 00007FF6482F0DFA
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF6482F0274
%s%s, xrefs: 00007FF6482F07A0
;type=%c, xrefs: 00007FF6482F0011
Accept-Encoding, xrefs: 00007FF6482EF9B1
Invalid TIMEVALUE, xrefs: 00007FF6482F0813
1.1, xrefs: 00007FF6482F02FE
PUT, xrefs: 00007FF6482EF708
Expect, xrefs: 00007FF6482F0B64, 00007FF6482F0DD9
100-continue, xrefs: 00007FF6482F0C06, 00007FF6482F0E86
ftp://%s:%s@%s, xrefs: 00007FF6482F03BB
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF6482F0DC1
Range: bytes=%s, xrefs: 00007FF6482F00EE
%s?%s, xrefs: 00007FF6482EF765
OPTIONS, xrefs: 00007FF6482EF6FB
Cookie, xrefs: 00007FF6482EF992
Proxy-Connection: Keep-Alive, xrefs: 00007FF6482F048F, 00007FF6482F04A4
ftp, xrefs: 00007FF6482EFF79
http, xrefs: 00007FF6482EFF0B
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF6482F0298
If-Unmodified-Since, xrefs: 00007FF6482F0854
GET, xrefs: 00007FF6482EF722
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF6482F08E4
Content-Range, xrefs: 00007FF6482F023E
?%s, xrefs: 00007FF6482F03FB
%x, xrefs: 00007FF6482F0F65
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF6482F116E
User-Agent, xrefs: 00007FF6482EF72D
Accept-Encoding: %s, xrefs: 00007FF6482EF9E2
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6482F05CB
Content-Length: 0, xrefs: 00007FF6482F0A60
HEAD, xrefs: 00007FF6482EF6D1
Range, xrefs: 00007FF6482F00C2
Content-Length, xrefs: 00007FF6482F09A4, 00007FF6482F0AF9, 00007FF6482F0D7E
%s, xrefs: 00007FF6482F0B43
0, xrefs: 00007FF6482F0FB6, 00007FF6482F10B5
Host: %s%s%s, xrefs: 00007FF6482EFE2D
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF6482EFC8C
1.0, xrefs: 00007FF6482F02F0
%s , xrefs: 00007FF6482F0323
Proxy-Connection, xrefs: 00007FF6482F0463
%s%s=%s, xrefs: 00007FF6482F0719
Last-Modified, xrefs: 00007FF6482F084B
Failed sending PUT request, xrefs: 00007FF6482F0A39
File already completely uploaded, xrefs: 00007FF6482F01F9
Content-Length: %I64d, xrefs: 00007FF6482F09BB, 00007FF6482F0B10, 00007FF6482F0D95
Cookie: , xrefs: 00007FF6482F06FE, 00007FF6482F0774
Failed sending HTTP request, xrefs: 00007FF6482F0D36
Host: %s%s%s:%d, xrefs: 00007FF6482EFE72
;type=, xrefs: 00007FF6482EFF9E
Content-Range: bytes %s/%I64d, xrefs: 00007FF6482F02A6
Could not seek stream, xrefs: 00007FF6482F0158
chunked, xrefs: 00007FF6482EFBC6
POST, xrefs: 00007FF6482EF715
Failed sending HTTP POST request, xrefs: 00007FF6482F106B
Content-Type, xrefs: 00007FF6482EFA77, 00007FF6482F0DAD
Transfer-Encoding, xrefs: 00007FF6482EFB1D
multipart/form-data, xrefs: 00007FF6482EFABA
Transfer-Encoding: chunked, xrefs: 00007FF6482EFC7F
Accept: */*, xrefs: 00007FF6482F0075
Host:, xrefs: 00007FF6482EFD81
Failed sending POST request, xrefs: 00007FF6482F0A99, 00007FF6482F0CDD
Host, xrefs: 00007FF6482EFCB9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 47623950a0bbe64e698ed1ebe928e22b03c269fb12d880581cf83119aadb09f5
Instruction ID: 8577a82dd03830eefa02a9f49c754e6ae613533b7f8e385c4a94ac5f4678a90a
Opcode Fuzzy Hash: 47623950a0bbe64e698ed1ebe928e22b03c269fb12d880581cf83119aadb09f5
Instruction Fuzzy Hash: 1503CC21A0CA8391FB65FB7196502FA27A2BF55B88F480035CF4E97695EF3CE445D388

Function 00007FF6482F9F3D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6482FA098
strchr.VCRUNTIME140 ref: 00007FF6482FA0C4
strchr.VCRUNTIME140 ref: 00007FF6482FA0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FA122
strchr.VCRUNTIME140 ref: 00007FF6482FA232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FA24A

Strings

CurrentService, xrefs: 00007FF6482FA175
schannel: unable to allocate memory, xrefs: 00007FF6482FA5BC, 00007FF6482FA847
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6482FA733
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF6482FA137
http/1.1, xrefs: 00007FF6482FA767
LocalMachineGroupPolicy, xrefs: 00007FF6482FA1EC
http/1.1, xrefs: 00007FF6482FA753
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF6482FA54F
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF6482FA2B0
Services, xrefs: 00007FF6482FA197
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF6482F9FCB
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF6482FA6B5
LocalMachine, xrefs: 00007FF6482FA153
Users, xrefs: 00007FF6482FA1B6
schannel: Failed to read cert file %s, xrefs: 00007FF6482FA5F9
Microsoft Unified Security Protocol Provider, xrefs: 00007FF6482FA63F
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6482FA4D9
LocalMachineEnterprise, xrefs: 00007FF6482FA20B
CurrentUserGroupPolicy, xrefs: 00007FF6482FA1CD
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF6482FA504
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF6482FA622
schannel: ALPN, offering %s, xrefs: 00007FF6482FA775
CurrentUser, xrefs: 00007FF6482FA112

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: d89aac1099c6e6052993711684499b2b5f7c8b83f93c3e0272dea94e26d5bd3d
Instruction ID: 53c99d8dd9ce19bd91e77d9f4fe80d2a4eab12e55994263777c3e1dcf133869f
Opcode Fuzzy Hash: d89aac1099c6e6052993711684499b2b5f7c8b83f93c3e0272dea94e26d5bd3d
Instruction Fuzzy Hash: 1E42C021A0CB4295EB25BB75EA507BA23A1FF54B98F444135CB0E87790DF3CE584D788

Function 00007FF6482D1530 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6482D155A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6482D1596
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6482D15C2
SetConsoleTitleA.KERNEL32 ref: 00007FF6482D1640
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D1679
GetConsoleWindow.KERNELBASE ref: 00007FF6482D1685
GetWindowLongPtrA.USER32 ref: 00007FF6482D1696
SetWindowLongPtrA.USER32 ref: 00007FF6482D16AC
SetLayeredWindowAttributes.USER32 ref: 00007FF6482D16C0
GetStdHandle.KERNEL32 ref: 00007FF6482D16D0
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6482D16DC
GetStdHandle.KERNEL32 ref: 00007FF6482D16E7
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6482D16F3
GetStdHandle.KERNEL32 ref: 00007FF6482D170A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1716

Part of subcall function 00007FF6482D0680: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6482C11FA), ref: 00007FF6482D075F

Part of subcall function 00007FF6482D1A70: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF6482D1728), ref: 00007FF6482D1A94
Part of subcall function 00007FF6482D1A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF6482D1728), ref: 00007FF6482D1AB5

GetStdHandle.KERNEL32 ref: 00007FF6482D1739
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1745
GetStdHandle.KERNEL32 ref: 00007FF6482D175C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1768
GetStdHandle.KERNEL32 ref: 00007FF6482D177F
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D178B
GetStdHandle.KERNEL32 ref: 00007FF6482D17A2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D17AE
GetStdHandle.KERNEL32 ref: 00007FF6482D17C5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D17D1
GetStdHandle.KERNEL32 ref: 00007FF6482D17E8
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D17F4
GetStdHandle.KERNEL32 ref: 00007FF6482D1817
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1823
GetStdHandle.KERNEL32 ref: 00007FF6482D183A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1846
GetStdHandle.KERNEL32 ref: 00007FF6482D185D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1869
GetStdHandle.KERNEL32 ref: 00007FF6482D188C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D1898
GetStdHandle.KERNEL32 ref: 00007FF6482D18AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D18BB
GetStdHandle.KERNEL32 ref: 00007FF6482D18D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6482D18DE
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF6482D18FB
URLDownloadToFileA.URLMON ref: 00007FF6482D194F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D195B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D1968
Sleep.KERNEL32 ref: 00007FF6482D1973
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D197B
URLDownloadToFileA.URLMON ref: 00007FF6482D19CD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D19D9
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D19E6
Sleep.KERNEL32 ref: 00007FF6482D19F1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D19F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D1A32

Strings

[ Selecione uma opcao: ], xrefs: 00007FF6482D174B
Iniciar Valorant Aim (HVCI DESLIGADO): , xrefs: 00007FF6482D17FA
C:\Windows\System32\SerceubetisHostDialog.exe, xrefs: 00007FF6482D191A
##########################################################, xrefs: 00007FF6482D176E
C:\Windows\System32\SeiebingsHosDialog.exe, xrefs: 00007FF6482D1998
Selecione a opcao: , xrefs: 00007FF6482D18E4
start C:\Windows\System32\SeiebingsHosDialog.exe, xrefs: 00007FF6482D19DF
.exe, xrefs: 00007FF6482D1563
http://185.101.104.122/aimhvciforabronkz.exe, xrefs: 00007FF6482D1909
cd C:\, xrefs: 00007FF6482D1954, 00007FF6482D19D2
##########################################################, xrefs: 00007FF6482D1728
http://185.101.104.122/aimhvcibronkzops.exe, xrefs: 00007FF6482D1987
start C:\Windows\System32\SerceubetisHostDialog.exe, xrefs: 00007FF6482D1961
Iniciar Valorant Aim (HVCI HABILITADO): , xrefs: 00007FF6482D186F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant Aim (HVCI DESLIGADO): $ Iniciar Valorant Aim (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SeiebingsHosDialog.exe$C:\Windows\System32\SerceubetisHostDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/aimhvcibronkzops.exe$http://185.101.104.122/aimhvciforabronkz.exe$start C:\Windows\System32\SeiebingsHosDialog.exe$start C:\Windows\System32\SerceubetisHostDialog.exe
API String ID: 2233566951-1582246269
Opcode ID: 9b615ab752b1db17b677d3e1e2d8fecd8b19d909079fd881a550ae344e632734
Instruction ID: 58a48fc449e6bec704e30fb84fe850821e9fdf0429b34db7901ac3f29dee2064
Opcode Fuzzy Hash: 9b615ab752b1db17b677d3e1e2d8fecd8b19d909079fd881a550ae344e632734
Instruction Fuzzy Hash: 79E16021E1CA4385EB01BBF0DA541FD6361AF85B94F084235E51EC6AF5EE2CF949C388

Function 00007FF6482E8980 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF6482E89A8
WSACleanup.WS2_32 ref: 00007FF6482E89C3
GetModuleHandleA.KERNEL32 ref: 00007FF6482E8A14
GetProcAddress.KERNEL32 ref: 00007FF6482E8A40
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E8A5A
LoadLibraryA.KERNEL32 ref: 00007FF6482E8A7D
GetProcAddress.KERNEL32 ref: 00007FF6482E8A9A
LoadLibraryExA.KERNELBASE ref: 00007FF6482E8AB0
GetSystemDirectoryA.KERNEL32 ref: 00007FF6482E8AC6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E8ADE
GetSystemDirectoryA.KERNEL32 ref: 00007FF6482E8AF2
LoadLibraryA.KERNEL32 ref: 00007FF6482E8B60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E8B6C
GetProcAddress.KERNEL32 ref: 00007FF6482E8B98
VerSetConditionMask.KERNEL32 ref: 00007FF6482E8C21
VerSetConditionMask.KERNEL32 ref: 00007FF6482E8C34
VerSetConditionMask.KERNEL32 ref: 00007FF6482E8C43
VerSetConditionMask.KERNEL32 ref: 00007FF6482E8C52
VerSetConditionMask.KERNEL32 ref: 00007FF6482E8C62
VerifyVersionInfoA.KERNEL32 ref: 00007FF6482E8C73
QueryPerformanceFrequency.KERNEL32 ref: 00007FF6482E8C8F

Strings

if_nametoindex, xrefs: 00007FF6482E8B8E
iphlpapi.dll, xrefs: 00007FF6482E8A46
AddDllDirectory, xrefs: 00007FF6482E8A90
LoadLibraryExA, xrefs: 00007FF6482E8A2E
kernel32, xrefs: 00007FF6482E89FB

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: 372a1b11eae873ffce80445b4ce260fa558d07d99fefe9c51babf47caa90135e
Instruction ID: 34d07de02629a8d4b1486326518a1e9f5df239fa9f18b63fdc74595e6e77ed23
Opcode Fuzzy Hash: 372a1b11eae873ffce80445b4ce260fa558d07d99fefe9c51babf47caa90135e
Instruction Fuzzy Hash: E0919021E0CB8286EB61FBB1A5143BA6391FF88B80F484235D98D86754EF3CE545D748

Function 00007FF6482E7CC0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482E7D5C
socket.WS2_32 ref: 00007FF6482E7DA5
htons.WS2_32 ref: 00007FF6482E7E31
setsockopt.WS2_32 ref: 00007FF6482E7E93
WSAGetLastError.WS2_32 ref: 00007FF6482E7E9D
getsockopt.WS2_32 ref: 00007FF6482E7F3F
setsockopt.WS2_32 ref: 00007FF6482E7F6E
setsockopt.WS2_32 ref: 00007FF6482E7FAD
WSAIoctl.WS2_32 ref: 00007FF6482E803A
WSAGetLastError.WS2_32 ref: 00007FF6482E8044

Part of subcall function 00007FF6482F4C90: ioctlsocket.WS2_32 ref: 00007FF6482F4CA9

Part of subcall function 00007FF6482ED7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF6482D582F), ref: 00007FF6482ED7C7

connect.WS2_32 ref: 00007FF6482E816B
WSAGetLastError.WS2_32 ref: 00007FF6482E8188

Part of subcall function 00007FF6482D2500: GetLastError.KERNEL32 ref: 00007FF6482D2522
Part of subcall function 00007FF6482D2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D252A

Part of subcall function 00007FF6482E5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C15
Part of subcall function 00007FF6482E5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C30

Part of subcall function 00007FF6482E65D0: closesocket.WS2_32 ref: 00007FF6482E6613

Strings

Could not set TCP_NODELAY: %s, xrefs: 00007FF6482E7EBA
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF6482E804D
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF6482E822E
Immediate connect fail for %s: %s, xrefs: 00007FF6482E81B8
Trying %s:%ld..., xrefs: 00007FF6482E7E3F
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF6482E7FBA
@, xrefs: 00007FF6482E7ED7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: a2329d31af6ccdedd8291ba3b20cb9468dd4f4060951aad07901af01d56ef692
Instruction ID: 971278e358ceac5724eda4662f582b20fea012476930a77d8d79b5ae75ddd351
Opcode Fuzzy Hash: a2329d31af6ccdedd8291ba3b20cb9468dd4f4060951aad07901af01d56ef692
Instruction Fuzzy Hash: D1F1D132A0C6828AEB50FB75D5402BE63A0FB44B84F444535EA4DC7795DF3CE945CB88

Function 00007FF6482F4A60 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF6482F4AA1
htonl.WS2_32 ref: 00007FF6482F4ACE
setsockopt.WS2_32 ref: 00007FF6482F4B05
bind.WS2_32 ref: 00007FF6482F4B20
getsockname.WS2_32 ref: 00007FF6482F4B3C
listen.WS2_32 ref: 00007FF6482F4B51
socket.WS2_32 ref: 00007FF6482F4B68
connect.WS2_32 ref: 00007FF6482F4B87
accept.WS2_32 ref: 00007FF6482F4B9E
send.WS2_32 ref: 00007FF6482F4BEC
recv.WS2_32 ref: 00007FF6482F4C0A
memcmp.VCRUNTIME140 ref: 00007FF6482F4C25
closesocket.WS2_32 ref: 00007FF6482F4C31

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 6e6282c668dcfc894862906e82aaace15aa8d0c260b38d1dd148d6634827d9ca
Instruction ID: dce21f95a38df211f915b4488f490fc44c8cbc710f18f6d297f4f91defbbb12d
Opcode Fuzzy Hash: 6e6282c668dcfc894862906e82aaace15aa8d0c260b38d1dd148d6634827d9ca
Instruction Fuzzy Hash: AC515D3160CA4682E750BB75E6441BA7361EB84BB4F545330EABE83AE4DF7CE845C748

Function 00007FF6482E6980 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Connection failed, xrefs: 00007FF6482E6D66
Connection time-out, xrefs: 00007FF6482E6A69
After %I64dms connect time, move on!, xrefs: 00007FF6482E6B45
connect to %s port %ld failed: %s, xrefs: 00007FF6482E6BFD
Failed to connect to %s port %ld: %s, xrefs: 00007FF6482E6EAE

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: f4fc740730976301a7210c533d194c5813da0a247d4e8c83157ccee1db768edb
Instruction ID: 506c9b762d66479ba8a01bf7bbdaf40ae351f6958d938c186bcd989dddadf788
Opcode Fuzzy Hash: f4fc740730976301a7210c533d194c5813da0a247d4e8c83157ccee1db768edb
Instruction Fuzzy Hash: 39E1F062A0C68282EB64BB35D6443BF27A1FB85794F484235EA5D877C1DF3CE651C388

Function 00007FF6482C2AA0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C28A7
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2917
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2977
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C29C7
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2A17

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2C48

Part of subcall function 00007FF6482C48C0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C4980

Part of subcall function 00007FF64831F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6482C43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF64831F20A

Part of subcall function 00007FF6482C4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2C98
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2CD7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2D25
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2D64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2E18
memcpy.VCRUNTIME140 ref: 00007FF6482C2E3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2F13
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2F5A
ShellExecuteA.SHELL32 ref: 00007FF6482C3052
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C305A
MessageBoxA.USER32 ref: 00007FF6482C3090
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C30A1
Sleep.KERNEL32 ref: 00007FF6482C3109
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C3111
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482C3118

Part of subcall function 00007FF6482C3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C326F
Part of subcall function 00007FF6482C3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C32B0

Part of subcall function 00007FF6482C3C30: memcpy.VCRUNTIME140 ref: 00007FF6482C3C83

Part of subcall function 00007FF6482C32D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C33B0

Part of subcall function 00007FF6482C33D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C34B0

Strings

sessionid, xrefs: 00007FF6482C2E9E
Failure, xrefs: 00007FF6482C3087
message, xrefs: 00007FF6482C2FA3, 00007FF6482C3061
open, xrefs: 00007FF6482C3049
invalidver, xrefs: 00007FF6482C2FD9
success, xrefs: 00007FF6482C2E76
download, xrefs: 00007FF6482C3015

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 535ff1e8e221f0c1c75af27359ade00078b131d269cead65d7686762db580418
Instruction ID: f06899072dead41a92499115254d40df1d9ff882402a56c00b70ae1438516477
Opcode Fuzzy Hash: 535ff1e8e221f0c1c75af27359ade00078b131d269cead65d7686762db580418
Instruction Fuzzy Hash: A602E522A0CB8285EB11BB78E5443FE2761FB44794F445635EA5D83ADADF7CE484C384

Function 00007FF6482FB5C0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482FBC01
memcpy.VCRUNTIME140 ref: 00007FF6482FBC1D

Strings

schannel: server closed the connection, xrefs: 00007FF6482FBA94
schannel: enough decrypted data is already available, xrefs: 00007FF6482FB645
schannel: failed to decrypt data, need more data, xrefs: 00007FF6482FBB2A
schannel: failed to read data from server: %s, xrefs: 00007FF6482FBB52
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF6482FBA5F
schannel: renegotiation failed, xrefs: 00007FF6482FBB8E
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF6482FB665
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF6482FBBA2
schannel: remote party requests renegotiation, xrefs: 00007FF6482FB9E2
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF6482FB78D
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF6482FBA18
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF6482FBBAE
schannel: can't renogotiate, an error is pending, xrefs: 00007FF6482FBB82
schannel: unable to re-allocate memory, xrefs: 00007FF6482FB6FD, 00007FF6482FBB66
schannel: Curl_read_plain returned error %d, xrefs: 00007FF6482FB961
schannel: server indicated shutdown in a prior call, xrefs: 00007FF6482FB688

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: cac85cc79ed5ed7f6d07cdb661102536f9163d80bf62f0a97a5fbbab425035fd
Instruction ID: 4390610c7377fb747876132a4982de4c9e9c7ab2ff3a59f8553b5eb9f7591167
Opcode Fuzzy Hash: cac85cc79ed5ed7f6d07cdb661102536f9163d80bf62f0a97a5fbbab425035fd
Instruction Fuzzy Hash: 8502FF72A1CB8685EB60FB29D9843AA27A6FB54B90F100536CE4DC77A0DF7CD441D788

Function 00007FF6482FAA50 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FAB40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FAB91
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FABD4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FACB7
memcpy.VCRUNTIME140 ref: 00007FF6482FAD59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FADC2
memcpy.VCRUNTIME140 ref: 00007FF6482FAE9A
memset.VCRUNTIME140 ref: 00007FF6482FB067
CertFreeCertificateContext.CRYPT32 ref: 00007FF6482FB0CA

Strings

schannel: unable to allocate memory, xrefs: 00007FF6482FB1BF
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6482FB10A
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF6482FAEC6
schannel: unable to re-allocate memory, xrefs: 00007FF6482FABE2
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF6482FAF5E, 00007FF6482FB172
SSL: failed retrieving public key from server certificate, xrefs: 00007FF6482FB0EA
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6482FAF2B
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF6482FAF74
SSL: public key does not match pinned public key!, xrefs: 00007FF6482FB0AC, 00007FF6482FB0D4

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 3a96623b7a79f0fd522c26667b77cad6706a34cfff424cc6794582d72b9afb6a
Instruction ID: b96f2adc44cf74192cfa40ee3875d70e65e485456ddf07e974537891ca92c8e4
Opcode Fuzzy Hash: 3a96623b7a79f0fd522c26667b77cad6706a34cfff424cc6794582d72b9afb6a
Instruction Fuzzy Hash: F412AF72608B8286EB21AB39D9503AF37A1FB54B88F144136DB5E97790DF3CE481D784

Function 00007FF6482F9C70 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6482F9D41
GetProcAddress.KERNEL32 ref: 00007FF6482F9D51

Strings

schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6482F9DE2
schannel: unable to allocate memory, xrefs: 00007FF6482FA847
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6482FA733
ntdll, xrefs: 00007FF6482F9D3A
http/1.1, xrefs: 00007FF6482FA767
http/1.1, xrefs: 00007FF6482FA753
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF6482FA9E9
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF6482FA6EF
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF6482F9D22
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF6482FA90C, 00007FF6482FA953
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6482FA92D
wine_get_version, xrefs: 00007FF6482F9D4A
schannel: ALPN, offering %s, xrefs: 00007FF6482FA775

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 2338b05bd6f938158b7bbd3647836caff589d68b3deee7ea365616dd5d438d8c
Instruction ID: a7bead12df0448d2c4587577983b3bb0d27a0f241c97342f35e8a980f3223cd7
Opcode Fuzzy Hash: 2338b05bd6f938158b7bbd3647836caff589d68b3deee7ea365616dd5d438d8c
Instruction Fuzzy Hash: 38029A32A0CB818AEB11BB35DA403EA37A5FB54788F504136DB4E87795DF38E584DB84

Function 00007FF6482DB2B0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB2E2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB37D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF6482DB396

Part of subcall function 00007FF6482F4A60: socket.WS2_32 ref: 00007FF6482F4AA1

DeleteCriticalSection.KERNEL32 ref: 00007FF6482DB3D0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB3E4
closesocket.WS2_32 ref: 00007FF6482DB402
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB438
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482DB43E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DB46D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB487
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DB490
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482DB4C5
EnterCriticalSection.KERNEL32 ref: 00007FF6482DB4E6
LeaveCriticalSection.KERNEL32 ref: 00007FF6482DB4FA
CloseHandle.KERNEL32 ref: 00007FF6482DB507
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB532
closesocket.WS2_32 ref: 00007FF6482DB54B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB55F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 5be7457888181850c85d56aadbc1f894fea58f0b3c7651b9d9ee872265a8f40c
Instruction ID: dc44c45321dfd77aa59d3006d4d372ffe2d5adbf818b4509ca50c63a4e16e8b2
Opcode Fuzzy Hash: 5be7457888181850c85d56aadbc1f894fea58f0b3c7651b9d9ee872265a8f40c
Instruction Fuzzy Hash: 8F814A22E09B8182E665FF21E65026A77A0FB98B50F045235DB9E427A2DF7CF4D4C344

Function 00007FF6482E2920 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

ftp@example.com, xrefs: 00007FF6482E2ADF
No connections available in cache, xrefs: 00007FF6482E331B
anonymous, xrefs: 00007FF6482E2AD8
proxy, xrefs: 00007FF6482E2FE2
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF6482E31A0
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF6482E3003
No more connections allowed to host %s: %zu, xrefs: 00007FF6482E30B2
host, xrefs: 00007FF6482E2FF0
No connections available., xrefs: 00007FF6482E30C1
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF6482E3172

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: efddc1f6dacb3119a96794c8e25f0bd1cf04d4b00aa7f066a4e6263cdbba1fe6
Instruction ID: beb2c7fba79f431e537da085935dc50fa763ab40e084dce58d5f5fe4553b5990
Opcode Fuzzy Hash: efddc1f6dacb3119a96794c8e25f0bd1cf04d4b00aa7f066a4e6263cdbba1fe6
Instruction Fuzzy Hash: 68429D62A0DB8291EB59BB35D6443BA67E0FB45B84F084135DE5E8B785DF3CE460C388

Function 00007FF6482E18B0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482D1B61,?,?,?,?,00007FF6482C3591), ref: 00007FF6482E18C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1911

Strings

<, xrefs: 00007FF6482E1B4E
v, xrefs: 00007FF6482E1BBF
`, xrefs: 00007FF6482E1BAA
<, xrefs: 00007FF6482E1B58
<, xrefs: 00007FF6482E1A27

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction ID: 935be667b37a24e952f548a508eacf084646a3516c7320ca48fd17d0ed30a034
Opcode Fuzzy Hash: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction Fuzzy Hash: 95915972908BC186E301AF34D5043E937A0FB95B5CF085238CE995B79ADFBAA094C764

Function 00007FF6482E8660 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF6483124BA,?,?,?,?,00007FF6482E89EB), ref: 00007FF6482E8674
GetProcAddress.KERNEL32(?,?,00007FF6483124BA,?,?,?,?,00007FF6482E89EB), ref: 00007FF6482E8699
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF6483124BA,?,?,?,?,00007FF6482E89EB), ref: 00007FF6482E86AC

Strings

AddDllDirectory, xrefs: 00007FF6482E86F3
LoadLibraryExA, xrefs: 00007FF6482E868A
kernel32, xrefs: 00007FF6482E866D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 230c0ed0a1b2d880a65c49ba9e4704915758f5ad6352508eade00287004d952d
Instruction ID: 98ebf2fba629c6aed970fb95e2a1fb4732954d151cd6c3144574782d3a3ad0b2
Opcode Fuzzy Hash: 230c0ed0a1b2d880a65c49ba9e4704915758f5ad6352508eade00287004d952d
Instruction Fuzzy Hash: 7041B516B0D64286EB16BF76A64017A6791EF46BE1F0C4130CE4D877D4EE3CE886D748

Function 00007FF6482E7300 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF6482E736C
WSAGetLastError.WS2_32 ref: 00007FF6482E7376

Part of subcall function 00007FF6482D2500: GetLastError.KERNEL32 ref: 00007FF6482D2522
Part of subcall function 00007FF6482D2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D252A

getsockname.WS2_32 ref: 00007FF6482E73F6
WSAGetLastError.WS2_32 ref: 00007FF6482E7400

Strings

getpeername() failed with errno %d: %s, xrefs: 00007FF6482E7396
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF6482E751C
getsockname() failed with errno %d: %s, xrefs: 00007FF6482E7420
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF6482E7486

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 78bda30eb9f00ef79d3851da8f0a2d784c8795b32e686334d913f5884b7e80e3
Instruction ID: 2a8ceb5cb99af05ac0a7ebc73f6c47bb4ee21c00c7917ea28aa2470c47b391f7
Opcode Fuzzy Hash: 78bda30eb9f00ef79d3851da8f0a2d784c8795b32e686334d913f5884b7e80e3
Instruction Fuzzy Hash: 69918F22A18BC186E711EF75D5502ED33A0FB98B88F485236DE4C87659EF38E185CB48

Function 00007FF6482F86D0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF6482F86F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F875E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8798
memcpy.VCRUNTIME140(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F87B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F87BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F87FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8803
freeaddrinfo.WS2_32(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8831
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8845
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F884F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F885C
WSASetLastError.WS2_32(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F887D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction ID: cdb9a9479455a5c7fdae133512d1646bdd2c022c09b6b9dcf53341072d43a339
Opcode Fuzzy Hash: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction Fuzzy Hash: D3512D36A0DB4593EA25BF61A65023AA7A1FB54B90F084035CF8E97B50DF3CF844E748

Function 00007FF6482F5FE0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF6482F603D
Sleep.KERNEL32 ref: 00007FF6482F604E
WSASetLastError.WS2_32 ref: 00007FF6482F61B8
Sleep.KERNEL32 ref: 00007FF6482F61C9
__WSAFDIsSet.WS2_32 ref: 00007FF6482F627C
__WSAFDIsSet.WS2_32 ref: 00007FF6482F6293
__WSAFDIsSet.WS2_32 ref: 00007FF6482F62AE
__WSAFDIsSet.WS2_32 ref: 00007FF6482F62C2
__WSAFDIsSet.WS2_32 ref: 00007FF6482F62DD
__WSAFDIsSet.WS2_32 ref: 00007FF6482F62F1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction ID: 8b06bacf414cc6352c9f7cd10f7dcf355ea880c1b030cde5cc74d874fb3cf883
Opcode Fuzzy Hash: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction Fuzzy Hash: 0E911B31B0C6828AEB257E749A502BB6292FF68354F144135EB19C7BC4DF3CEB44D684

Function 00007FF6482E4EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4F3F

Strings

Unix socket path too long: '%s', xrefs: 00007FF6482E4F96
Couldn't resolve host '%s', xrefs: 00007FF6482E5071
Couldn't resolve proxy '%s', xrefs: 00007FF6482E511C

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: d745ec9ae58cf2da707b93dddb6ae0445aae9b10f91d28d0416c49dab86b07c7
Instruction ID: 1f260f1bc5f709635dfc9cff9a53077b7e6613cbae4f476ed27da3d3ad043269
Opcode Fuzzy Hash: d745ec9ae58cf2da707b93dddb6ae0445aae9b10f91d28d0416c49dab86b07c7
Instruction Fuzzy Hash: 9251B122B0CB8292FA1ABB35E6503BA6790FB44790F140031DB4D877A4DF3DE9919788

Function 00007FF6482C2840 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C28A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2917
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2977
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C29C7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2A17
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2A88

Strings

.8, xrefs: 00007FF6482C2A65
h%49, xrefs: 00007FF6482C2A5E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: e1d3076ed9d51c2f839fb864ec69f16c8f30c31a97545b534a8eb50fa7e2259f
Instruction ID: 9db5958d95517588d1008e316a9b5974eb17520d88227e347bd2f93e0003957a
Opcode Fuzzy Hash: e1d3076ed9d51c2f839fb864ec69f16c8f30c31a97545b534a8eb50fa7e2259f
Instruction Fuzzy Hash: 7C613F22E187D689F302EBB8E8451FC7770BB99B48F445368DFC565916EFAC5148C388

Function 00007FF6482DB1A0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482F86D0: getaddrinfo.WS2_32 ref: 00007FF6482F86F2
Part of subcall function 00007FF6482F86D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F875E
Part of subcall function 00007FF6482F86D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8798
Part of subcall function 00007FF6482F86D0: memcpy.VCRUNTIME140(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F87B1
Part of subcall function 00007FF6482F86D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F87BF
Part of subcall function 00007FF6482F86D0: freeaddrinfo.WS2_32(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8831
Part of subcall function 00007FF6482F86D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F8845
Part of subcall function 00007FF6482F86D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F884F
Part of subcall function 00007FF6482F86D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB1F5), ref: 00007FF6482F885C

WSAGetLastError.WS2_32 ref: 00007FF6482DB1FB
WSAGetLastError.WS2_32 ref: 00007FF6482DB205
EnterCriticalSection.KERNEL32 ref: 00007FF6482DB220
LeaveCriticalSection.KERNEL32 ref: 00007FF6482DB22F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DB240
send.WS2_32 ref: 00007FF6482DB263
WSAGetLastError.WS2_32 ref: 00007FF6482DB26D
LeaveCriticalSection.KERNEL32 ref: 00007FF6482DB280

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: bf152be5e74fb760d3c049dad89691837c5dff5b7d510eaca98c6ec77837753b
Instruction ID: 17d120fd5f64b9dd74ad10ee43c3405ca3797540c6dde1de8baaf8a365763a46
Opcode Fuzzy Hash: bf152be5e74fb760d3c049dad89691837c5dff5b7d510eaca98c6ec77837753b
Instruction Fuzzy Hash: 43314F32A0C642C6EB41BFB5D55426E27A0EF44B94F544132D95EC3694DF3CE845C784

Function 00007FF6482F5C40 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF6482F5CA6
WSASetLastError.WS2_32 ref: 00007FF6482F5E66
Sleep.KERNEL32 ref: 00007FF6482F5E76
__WSAFDIsSet.WS2_32 ref: 00007FF6482F5F8A
__WSAFDIsSet.WS2_32 ref: 00007FF6482F5FA2
Sleep.KERNEL32 ref: 00007FF6482F5FCD

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction ID: b6e0ba0f67bf95b9e132951ce61da9668774e33dffdaa61ea5a5651ef3f538e1
Opcode Fuzzy Hash: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction Fuzzy Hash: 8BA10431A1D68386EB697B3497042BA6296FF65B94F444334EB1AC6BC4DE3CD800D78C

Function 00007FF6482FBC90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FBD2E
memcpy.VCRUNTIME140 ref: 00007FF6482FBDC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FBEFC

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF6482FBEC4
select/poll on SSL socket, errno: %d, xrefs: 00007FF6482FBEA4

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 58276ae4104af4279235665e12cd0472266481aaff42abc0abba8617f3f097de
Instruction ID: 622d2026c9de2318745421c459a230fb40b8f5b564e97d90abb45eabbe16e98b
Opcode Fuzzy Hash: 58276ae4104af4279235665e12cd0472266481aaff42abc0abba8617f3f097de
Instruction Fuzzy Hash: 26719F72B08B018AEB10EB75D5506AE37A2FB58BA8F440635DF2D877D4EE38E405C784

Function 00007FF64831F85C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF64831F8F3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64831F941
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64831F946
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64831F94E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64831F956
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64831F978
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64831F9D2

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction ID: 3baeb20a599ae38e4bf45bdf8aa23988ba88cac514d4fa335720e7754b31c3ff
Opcode Fuzzy Hash: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction Fuzzy Hash: 25316B21E0C64382FA52BBF4E5613F95B91AF45B84F4C4435EE4DCB6D7DE2CE8488288

Function 00007FF6482D6D00 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D6D4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D6D65
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D6E92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D6EBE

Strings

%s, xrefs: 00007FF6482D6FC7
Connection #%ld to host %s left intact, xrefs: 00007FF6482D6F7B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 25ab57a35ded7b4366cd3229136faa6fbebb1ef31794a7cbe106c78bf5a5e3d9
Instruction ID: 8a4ceb358555b643dc0e64391359ab337a56a4960bc0e5aad212c897c7a46031
Opcode Fuzzy Hash: 25ab57a35ded7b4366cd3229136faa6fbebb1ef31794a7cbe106c78bf5a5e3d9
Instruction Fuzzy Hash: 93917072A0CA8196EB69BB3596407BA67E1FF44B84F484431DE4E87795CF3CE56083C8

Function 00007FF6482E1190 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E11BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E11D1

Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E0FED
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E100A
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E101E
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E103A
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E1057
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E107A
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E108E
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10A2
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10C8
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10DC
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10F0
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E113F
Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E114C

Part of subcall function 00007FF6482E0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E1175

memset.VCRUNTIME140 ref: 00007FF6482E1205

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF6482E13E1
User-Agent: %s, xrefs: 00007FF6482E129F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: b4bb99099c09c2f90696dadfa9133446c6bcfceade5dd8e952d596f6c22118ac
Instruction ID: 8c5d87a7c16b9652b7a46c690da46365cc9d40d2dcd26816248b90d33a84fe39
Opcode Fuzzy Hash: b4bb99099c09c2f90696dadfa9133446c6bcfceade5dd8e952d596f6c22118ac
Instruction Fuzzy Hash: B5717A62A0CAC281E751FF3595503FE27A1FB95B84F084136DB9D9B686DF3CE4818398

Function 00007FF6482F1710 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F17A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F17B1
memcpy.VCRUNTIME140 ref: 00007FF6482F17CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F192C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F1935

Strings

1.1, xrefs: 00007FF6482F171F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction ID: dbb81fc89625edec90da059179de1f5962b29e097ec6f55c0e2c559988a03a9d
Opcode Fuzzy Hash: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction Fuzzy Hash: 92519E72608B8596E669EF32EA403AA73A5FB54B84F444031CF9E97754CF3CE194D384

Function 00007FF6482E5ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5F96
recv.WS2_32 ref: 00007FF6482E5FC0
send.WS2_32 ref: 00007FF6482E5FE3
WSAGetLastError.WS2_32 ref: 00007FF6482E5FF5

Strings

Send failure: %s, xrefs: 00007FF6482E6025

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: e7aa3ecffacd2081bbf43444e43266681bc0ee491360cb4430632f44b078b7a1
Instruction ID: 24be2b3d1aa2f33d933013d86d55ad13f94e75693ff51300c2995d32e361b8a0
Opcode Fuzzy Hash: e7aa3ecffacd2081bbf43444e43266681bc0ee491360cb4430632f44b078b7a1
Instruction Fuzzy Hash: C2419022A09B4245EB65BF75EA1077A6690BB09BA8F144235DE6D877C4DF3CD440C788

Function 00007FF6482D7DF8 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D7F48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D7F8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D7FBA

Part of subcall function 00007FF6482D6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D6D4E
Part of subcall function 00007FF6482D6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D6D65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D7FEF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF6482D7336

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 064f49bb6e255ade0c927bea9155e5f26801896246ecfeb9cc64ea89652f1773
Instruction ID: cc7b69e4b7f647ee3eb9583ddf01b4fb6c033ecb45066e44f9a6f5625e2b3f05
Opcode Fuzzy Hash: 064f49bb6e255ade0c927bea9155e5f26801896246ecfeb9cc64ea89652f1773
Instruction Fuzzy Hash: 52D1B022A0C68286FB24BF3596443BA27E1FF44B88F045532CE0D97699DF3CE544D388

Function 00007FF6482C3550 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C28A7
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2917
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2977
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C29C7
Part of subcall function 00007FF6482C2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2A17

MessageBoxA.USER32 ref: 00007FF6482C3727

Part of subcall function 00007FF6482C4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C378A

Strings

null, xrefs: 00007FF6482C35B2
keyauth.win, xrefs: 00007FF6482C36B3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 79ccd1b35729c2f2b7c2be3b61086d29319e1764c5c35db29fb58a3430b23799
Instruction ID: 98030f7bbbb5c98e637c7d7f06a4e1e39442ce5af7585681efd1601586a629a0
Opcode Fuzzy Hash: 79ccd1b35729c2f2b7c2be3b61086d29319e1764c5c35db29fb58a3430b23799
Instruction Fuzzy Hash: 3B51CE22B08B5285FB04FBB5D6193BE2761EF44B88F404534DE4D57A96DF7CD0828388

Function 00007FF648312480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482E8660: GetModuleHandleA.KERNEL32(?,?,?,00007FF6483124BA,?,?,?,?,00007FF6482E89EB), ref: 00007FF6482E8674

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF6482E89EB), ref: 00007FF6483124D0

Strings

InitSecurityInterfaceA, xrefs: 00007FF6483124C6
security.dll, xrefs: 00007FF6483124AA
secur32.dll, xrefs: 00007FF6483124A3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: f8e17ba8d6c6c72759de793df64b220ff247381932ecd5de2460a51393658e6d
Instruction ID: cccb602d837552b2696e9f3f0c233392f1566bb8965014bdb4e7b55000ddfcd5
Opcode Fuzzy Hash: f8e17ba8d6c6c72759de793df64b220ff247381932ecd5de2460a51393658e6d
Instruction Fuzzy Hash: 25F03764E0EB4380FE16FBB5A9817B01791AF55B40F8C4434C44CC2A91EE3CA599D348

Function 00007FF6482D792B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF6482D7336

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: f84caca69c7972fb98c0df09d891486e401f7fb6e43fed5d7a8f50e34cea5287
Instruction ID: cf8ea7b9ac785b01d758ac558b95e6a6e53572764836897ac72fea79e22267ba
Opcode Fuzzy Hash: f84caca69c7972fb98c0df09d891486e401f7fb6e43fed5d7a8f50e34cea5287
Instruction Fuzzy Hash: 3AB19322A1C6428AFB64BE35965437E2BE0EF41B88F145536CE0E87295DF3DE944D3C8

Function 00007FF6482F12D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F13D0

Part of subcall function 00007FF6482F1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19BA

Part of subcall function 00007FF6482F1710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F17A8
Part of subcall function 00007FF6482F1710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F17B1

Strings

PROXY %s %s %s %li %li, xrefs: 00007FF6482F13A4
TCP6, xrefs: 00007FF6482F1357
TCP4, xrefs: 00007FF6482F136A

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 576f52932e20a67f69501a890910ecf293095fa115c1143bd2a4251892c664de
Instruction ID: aad5552fc66a8e0ff4b06688ed454d09500944ff5cbd1e57ed5ec1793b3efeeb
Opcode Fuzzy Hash: 576f52932e20a67f69501a890910ecf293095fa115c1143bd2a4251892c664de
Instruction Fuzzy Hash: 5641B331A0C68286EB61FB71A5403BB27A2AF95784F584036DB8CD7685DF3DD404DB84

Function 00007FF6482D5BC0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF6482D1BF6,?,?,?,?,00000000,?,00007FF6482C370E), ref: 00007FF6482D5BDD
closesocket.WS2_32 ref: 00007FF6482D5CE9
closesocket.WS2_32 ref: 00007FF6482D5CF6

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 6726d0aa8d66446f52f79849a812bac3dfc78dd39627bec9a0ad9fa3862d7e62
Instruction ID: dd1b7735d4f48ac3a0fff7db784e98cf0e8646361ed2701499aaf108726724a5
Opcode Fuzzy Hash: 6726d0aa8d66446f52f79849a812bac3dfc78dd39627bec9a0ad9fa3862d7e62
Instruction Fuzzy Hash: 54415E32A0CA4281E740FF35D6502FA27A1EF98724F984631DE5DC62DAEF78E5458398

Function 00007FF6482F9A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF6482F9BDC
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF6482F9BC3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 679e295fc6ef9dac0797c2cd924231e25b208d8f0f9d6fee978d21ac4117f7fd
Instruction ID: b9728630b81b5e6ea56003b9e954ba5da4ea44fb5d2623bbeb3e90be9c223a72
Opcode Fuzzy Hash: 679e295fc6ef9dac0797c2cd924231e25b208d8f0f9d6fee978d21ac4117f7fd
Instruction Fuzzy Hash: 4D51A221B0C69689EB15FB3597443BB6692EF697A8F148231CF2D872D0DE3CE441D788

Function 00007FF6482D5DC0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6482D61B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D61D7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction ID: bbd30006e3ef5112257605bede5637889a00019ae956aa1dff74e8601bd4850d
Opcode Fuzzy Hash: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction Fuzzy Hash: 98C11732A0C68286EB25BB3596003BB6AD0FF447A4F444235DEAE877C4DF7CE9418784

Function 00007FF6482E1E90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1EF5

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF6482E2034
User-Agent: %s, xrefs: 00007FF6482E1F06

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 14735c8d4da5ff9c77df89ee8aaeda6f25f4d3af1a329b697456f181ecc354f3
Instruction ID: 7a327010f035d0d7593f5b3850102fe8e7ae0a46be03db5c8497e5be9035cea2
Opcode Fuzzy Hash: 14735c8d4da5ff9c77df89ee8aaeda6f25f4d3af1a329b697456f181ecc354f3
Instruction Fuzzy Hash: AA517D62A0CAC181E751AF35D1503BA67A0EB94B98F084135EF8D9B3DACF7CD491C398

Function 00007FF6482E5CF0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6482E5CFC
WSAGetLastError.WS2_32 ref: 00007FF6482E5D0B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction ID: c481784bacf34a0ede134f81b2a77fe2b5783d8de62cc0da1e0712f60f1a55c2
Opcode Fuzzy Hash: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction Fuzzy Hash: 28E0DF61F0850542FF2A67F4A95437911909F48772F584774CA3BC63C0DE2C48D24344

Function 00007FF6482E65D0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF6482E6613

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction ID: d612581609d573500a549c1f532521ce8e0a5635f5b8be6259f35c96d689fa19
Opcode Fuzzy Hash: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction Fuzzy Hash: E2019212B1D54281EF54FB7AE2983BE2790EF88B84F184031DB0EC7296CE2CD591C788

Function 00007FF6482EE0F0 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF6482EE119

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction ID: 9cd523706a3aad1371710aed37ece72544acb1fcb37ceed424e5f0b461c61a12
Opcode Fuzzy Hash: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction Fuzzy Hash: B2E0D83AF0A64582DE88BB75C8922BB2360AF55734FC44771C63D473D0DE2CE6969B44

Function 00007FF6482F8D50 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F8D6B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction ID: ba0fb7b8abf92d673f40e82a117d588432951a677b84a294aa3a1384779ec343
Opcode Fuzzy Hash: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction Fuzzy Hash: 1ED02B63B18A00839F10DFB1A84006DE351B788774B4C4338EE7D827E0DF3CD1454604

Function 00007FF6482F4C90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF6482F4CA9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction ID: 45c71889f44103be22027de3c9f50c9f812cfde323200df9c85f28843542f3cb
Opcode Fuzzy Hash: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction Fuzzy Hash: D8C08027F14581C2D3447FB154850DB6771ABC4204F955435D24B82124DD3CD6E58B44

Non-executed Functions

Function 00007FF6482D8990 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 738stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF6482DA1E7), ref: 00007FF6482D8A00
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D8A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D8A54
strchr.VCRUNTIME140 ref: 00007FF6482D8A67
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D8BE7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D8C08
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D8C2B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D8C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D8CD1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D8CDA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D8CF2
strchr.VCRUNTIME140 ref: 00007FF6482D8EDF
strchr.VCRUNTIME140 ref: 00007FF6482D8EF9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D8FEC
strchr.VCRUNTIME140 ref: 00007FF6482D9018
strrchr.VCRUNTIME140 ref: 00007FF6482D902A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D904B
memcpy.VCRUNTIME140 ref: 00007FF6482D9064
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D90D8
strchr.VCRUNTIME140 ref: 00007FF6482D90FB
strchr.VCRUNTIME140 ref: 00007FF6482D9110

Strings

secure, xrefs: 00007FF6482D8C5E
httponly, xrefs: 00007FF6482D8C96
localhost, xrefs: 00007FF6482D8D3F
__Host-, xrefs: 00007FF6482D8C01
Added, xrefs: 00007FF6482D960D
path, xrefs: 00007FF6482D8CBD
__Secure-, xrefs: 00007FF6482D8BE0
version, xrefs: 00007FF6482D8E1B
FALSE, xrefs: 00007FF6482D914E, 00007FF6482D934B
domain, xrefs: 00007FF6482D8D11
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF6482D8F6F
max-age, xrefs: 00007FF6482D8E48
#HttpOnly_, xrefs: 00007FF6482D90CE
TRUE, xrefs: 00007FF6482D9147
%4095[^;=] =%4095[^;], xrefs: 00007FF6482D8AA6
expires, xrefs: 00007FF6482D8E75
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF6482D8DFE
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: f95ef0917ce51c0cb13b4cb9c775ec3e14fb74c515eb4bcdbab68ce709324142
Instruction ID: 06ab31c99e1077dc25fc235d3bf4793d1f6ccb10ae358ea02d81fd95cefe46f3
Opcode Fuzzy Hash: f95ef0917ce51c0cb13b4cb9c775ec3e14fb74c515eb4bcdbab68ce709324142
Instruction Fuzzy Hash: C672C461A0D79286FB62BB35D6403BA2BE0EF54794F480531DE8E826D1DF3CE484D388

Function 00007FF64830D220 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482E5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C15
Part of subcall function 00007FF6482E5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C30

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830D2AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830D2E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830D2EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830D309
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830D31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830D325
#22.WLDAP32 ref: 00007FF64830D336
#211.WLDAP32 ref: 00007FF64830D3D0
#217.WLDAP32 ref: 00007FF64830D3EC
#211.WLDAP32 ref: 00007FF64830D405
#211.WLDAP32 ref: 00007FF64830D417
#60.WLDAP32 ref: 00007FF64830D447
#211.WLDAP32 ref: 00007FF64830D562
#60.WLDAP32 ref: 00007FF64830D587
#22.WLDAP32 ref: 00007FF64830D62A
#41.WLDAP32 ref: 00007FF64830DA46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DA6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DA78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DA98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DAAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DAB4
#46.WLDAP32 ref: 00007FF64830DAC6

Strings

Microsoft Corporation., xrefs: 00007FF64830D240
encrypted, xrefs: 00007FF64830D37E
DN: , xrefs: 00007FF64830D722
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF64830D46B
LDAP local: trying to establish %s connection, xrefs: 00007FF64830D369
LDAP remote: %s, xrefs: 00007FF64830D6A7
cleartext, xrefs: 00007FF64830D35F
;binary, xrefs: 00007FF64830D8B0
LDAP local: %s, xrefs: 00007FF64830D33C
There are more than %d entries, xrefs: 00007FF64830DA56
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF64830D254
LDAP local: %s, xrefs: 00007FF64830D297
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF64830D634

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 831d87dee25c1670673b59d4b4179000b4e3fe808a50e4d779f915d0a570c901
Instruction ID: 03880568feabdfb4ed40ede464eb7e0c52fa87439ff259e6c5e7e756c561d5d3
Opcode Fuzzy Hash: 831d87dee25c1670673b59d4b4179000b4e3fe808a50e4d779f915d0a570c901
Instruction Fuzzy Hash: 69425E65B0DB4286EB12FBB295542BD23A1FB46B98F484131DE0E97B98DE3CF445C348

Function 00007FF6482C955D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 978COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6482C9F5D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6482C9F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CA0BB

Strings

object key, xrefs: 00007FF6482C9DEF, 00007FF6482CA629
number overflow parsing ', xrefs: 00007FF6482C9F80
object separator, xrefs: 00007FF6482C9C63, 00007FF6482CA49A
array, xrefs: 00007FF6482CA17A
object, xrefs: 00007FF6482CA309

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 5dc6d2020e20b7b7b4f3fd0f005dc465797da0486d902d5c39db5575fa961406
Instruction ID: d5d8a6687e10fb274752440f4327a6430313269082de4d6b8680bf81f5969daf
Opcode Fuzzy Hash: 5dc6d2020e20b7b7b4f3fd0f005dc465797da0486d902d5c39db5575fa961406
Instruction Fuzzy Hash: C7A2A472A1CA8695EB11BBB8E5443FE2361FB457A4F404231DA5D87ADADF7CE081C384

Function 00007FF648309520 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830956F
WSAStartup.WS2_32 ref: 00007FF648309610
FreeLibrary.KERNEL32 ref: 00007FF6483097FD
GetStdHandle.KERNEL32 ref: 00007FF64830980C
GetFileType.KERNEL32 ref: 00007FF64830982D
WaitForMultipleObjects.KERNEL32 ref: 00007FF648309877
PeekNamedPipe.KERNEL32 ref: 00007FF6483098FC
ReadFile.KERNEL32 ref: 00007FF648309923
ReadFile.KERNEL32 ref: 00007FF6483099DD
WSAGetLastError.WS2_32 ref: 00007FF648309A3E
WSAGetLastError.WS2_32 ref: 00007FF648309C3A
FreeLibrary.KERNEL32 ref: 00007FF648309C5A
GetLastError.KERNEL32 ref: 00007FF648309C64

Part of subcall function 00007FF64830A490: send.WS2_32 ref: 00007FF64830A4CD
Part of subcall function 00007FF64830A490: WSAGetLastError.WS2_32 ref: 00007FF64830A4D7

Strings

WSACloseEvent failed (%d), xrefs: 00007FF648309C40
WSAEnumNetworkEvents, xrefs: 00007FF648309740
WSACreateEvent, xrefs: 00007FF6483096A5
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF648309760
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF648309C6A
WSACloseEvent, xrefs: 00007FF6483096CC
failed to find WSAEventSelect function (%u), xrefs: 00007FF648309737
insufficient winsock version to support telnet, xrefs: 00007FF648309C9F
WSAEventSelect, xrefs: 00007FF648309711
failed to load WS2_32.DLL (%u), xrefs: 00007FF64830968B
WS2_32.DLL, xrefs: 00007FF64830965E
failed to find WSACreateEvent function (%u), xrefs: 00007FF6483096C3
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF648309A52
WSAStartup failed (%d), xrefs: 00007FF64830961D
failed to find WSACloseEvent function (%u), xrefs: 00007FF6483096EC
WSACreateEvent failed (%d), xrefs: 00007FF64830977E
Time-out, xrefs: 00007FF648309C17
, xrefs: 00007FF648309C02

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: 3a84ad12ddd9242ef5708b47fd60f2fc0ce5b5ff1c798c18c0fc51936d33e422
Instruction ID: 4b231bc1bc44fc90b82eadcb53101f065c1ce4229fb9a26cc65bd7618f68a6c9
Opcode Fuzzy Hash: 3a84ad12ddd9242ef5708b47fd60f2fc0ce5b5ff1c798c18c0fc51936d33e422
Instruction Fuzzy Hash: 47126C31A0C68285EB66BFB5A5443BA63A0FB46B98F484135DE4E87798DF7CE440C748

Function 00007FF6482CABFD Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 930COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB594
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CB5C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CB5D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB60A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB667
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB720
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CB74E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CB75C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB796
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB7F3

Part of subcall function 00007FF6482CEFB0: memcmp.VCRUNTIME140 ref: 00007FF6482CF03D
Part of subcall function 00007FF6482CEFB0: memcmp.VCRUNTIME140 ref: 00007FF6482CF0C1

Strings

object key, xrefs: 00007FF6482CB68C, 00007FF6482CBEB8
number overflow parsing ', xrefs: 00007FF6482CB80F
object separator, xrefs: 00007FF6482CB500, 00007FF6482CBD29
array, xrefs: 00007FF6482CBA09
object, xrefs: 00007FF6482CBB98

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: 4b3d2206014de7f61fa1300ad114516bb9951d61e68c3632b4719bc4a50493be
Instruction ID: 970ba04ff9b0b66389db54b893fca0ca8204217a30a99b7a4a4257ec5aae5a67
Opcode Fuzzy Hash: 4b3d2206014de7f61fa1300ad114516bb9951d61e68c3632b4719bc4a50493be
Instruction Fuzzy Hash: 6D92B462A1CB8586EB11FBB8E5443BE2361FB457A4F401231DA5D87ADADF7CE085C384

Function 00007FF648315AD0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF648315C3F
GetLastError.KERNEL32 ref: 00007FF648315C52
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF648315D04
GetLastError.KERNEL32 ref: 00007FF648315D0E
CertGetCertificateChain.CRYPT32 ref: 00007FF648315D9B
GetLastError.KERNEL32 ref: 00007FF648315DA5
CertGetNameStringA.CRYPT32 ref: 00007FF648315F13
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF64831638B
CertCloseStore.CRYPT32 ref: 00007FF6483163A0
CertFreeCertificateChain.CRYPT32 ref: 00007FF6483163B0
CertFreeCertificateContext.CRYPT32 ref: 00007FF6483163C0

Strings

schannel: failed to create certificate chain engine: %s, xrefs: 00007FF648315D28
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF648315C11
2.5.29.17, xrefs: 00007FF648315F73, 00007FF648315FA4, 00007FF64831610F, 00007FF64831614B
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF648315E69
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF64831633D
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF648315FDE, 00007FF648316185
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF648316253
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF648315DBF
schannel: failed to create certificate store: %s, xrefs: 00007FF648315C6C
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF648315E52
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF648315E3C
schannel: Null certificate context., xrefs: 00007FF648315F28, 00007FF6483160D7
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF648315E0D
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF648315E7A
schannel: Null certificate info., xrefs: 00007FF648315F63, 00007FF6483160F4
schannel: Empty DNS name., xrefs: 00007FF64831601A, 00007FF6483161C8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF648315E25
schannel: CertFindExtension() returned no extension., xrefs: 00007FF648315F8B, 00007FF648316127
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF6483162B9
schannel: server certificate name verification failed, xrefs: 00007FF6483162FE
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF648316316
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF64831605D
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF6483162C9
schannel: Not enough memory to list all host names., xrefs: 00007FF64831623C

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: b99ef1342f43ec3ae102a7ff4fd16fab8c957940eb817becddc35c7575eee630
Instruction ID: c650ebd47d3dd5d94ded5ecab8481909c9ff3bbcbdc09082a85ab350bbfa8763
Opcode Fuzzy Hash: b99ef1342f43ec3ae102a7ff4fd16fab8c957940eb817becddc35c7575eee630
Instruction Fuzzy Hash: 7242AD32A0CB4282EB12BBB5E5402BD6BA0FB44B94F584235DE5D87794DF3CE945C788

Function 00007FF6483049F0 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648304AD1
getsockname.WS2_32 ref: 00007FF648304CCA
WSAGetLastError.WS2_32 ref: 00007FF648304CD4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830520B

Strings

bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF648304E64
getsockname() failed: %s, xrefs: 00007FF648304CEE, 00007FF648304EFE
bind(port=%hu) failed: %s, xrefs: 00007FF648304F35
,%d,%d, xrefs: 00007FF6483050E9
EPRT, xrefs: 00007FF648305182
bind() failed, we ran out of ports!, xrefs: 00007FF648304EC6
failed to resolve the address provided to PORT: %s, xrefs: 00007FF6483051F9
%s %s, xrefs: 00007FF648305119
%s |%d|%s|%hu|, xrefs: 00007FF648305199
PORT, xrefs: 00007FF648305112
Failure sending PORT command: %s, xrefs: 00007FF64830513C
Failure sending EPRT command: %s, xrefs: 00007FF6483051BF
socket failure: %s, xrefs: 00007FF648304DCF, 00007FF648304FD6

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: b97dba633d30b4d0c544a2ffe8f3c3dcebe4e1f558373a43b1b957c6b0dbfa42
Instruction ID: 16e30650852aaee28df70a14400da13c197157c2c5dbcc7d8197cf8c9d9f7bb7
Opcode Fuzzy Hash: b97dba633d30b4d0c544a2ffe8f3c3dcebe4e1f558373a43b1b957c6b0dbfa42
Instruction Fuzzy Hash: AA22C761A0C78282EB52BBB5E4502BE67A1FF47788F484031DA4EC769ADF7CE544C748

Function 00007FF6482DF0E0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF146
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF16D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF1C8

Strings

-----BEGIN PUBLIC KEY-----, xrefs: 00007FF6482DF39A
sha256//, xrefs: 00007FF6482DF13C, 00007FF6482DF28E
-----END PUBLIC KEY-----, xrefs: 00007FF6482DF3CE
;sha256//, xrefs: 00007FF6482DF240
public key hash: sha256//%s, xrefs: 00007FF6482DF1DE

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 87d8b74bfaf9f01fe411e33134954ef59d3277864874ae862f6e598a426349ef
Instruction ID: df509d44ac2f00276fb8641c052ccb76b9e4e2b9aa65c816045a044669aac870
Opcode Fuzzy Hash: 87d8b74bfaf9f01fe411e33134954ef59d3277864874ae862f6e598a426349ef
Instruction Fuzzy Hash: 1DA1B361B0D78281FA51BB76AA542BA6BD2FF44BD0F484031DE0E97795DE3CE845838C

Function 00007FF6483163F0 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF648316436

Part of subcall function 00007FF6482D2640: GetLastError.KERNEL32 ref: 00007FF6482D265C
Part of subcall function 00007FF6482D2640: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D2664

CreateFileA.KERNEL32 ref: 00007FF648316490
GetLastError.KERNEL32 ref: 00007FF6483164A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483167DD

Strings

schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF648316781
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF648316502
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF648316450
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF648316765
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF6483167A2
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF648316735
-----END CERTIFICATE-----, xrefs: 00007FF648316609
schannel: failed to open CA file '%s': %s, xrefs: 00007FF6483164BB
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF6483166E0
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF648316539
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6483165DE
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF648316716
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF6483167B3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 919779ac502394a4df49bfc1684378c912bd20c5370d5fdb507a62585e4b15d8
Instruction ID: 398a2ed256da8105470b906958407f966df3c08547c6cf7110e791d8b3c0608c
Opcode Fuzzy Hash: 919779ac502394a4df49bfc1684378c912bd20c5370d5fdb507a62585e4b15d8
Instruction Fuzzy Hash: 81B1B161B1C74282E712BBF5E4002BA67A1BF44B94F484136DD8D87B94EE7CF905C788

Function 00007FF6482E3330 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6482E338A
memset.VCRUNTIME140 ref: 00007FF6482E339F
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E33BB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E33E2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3459
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E348C
strchr.VCRUNTIME140 ref: 00007FF6482E3576
strchr.VCRUNTIME140 ref: 00007FF6482E35BB
strchr.VCRUNTIME140 ref: 00007FF6482E35EB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3693

Part of subcall function 00007FF6482FBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBF68
Part of subcall function 00007FF6482FBF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBF8E
Part of subcall function 00007FF6482FBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBFAF
Part of subcall function 00007FF6482FBF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3766
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3795
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E37BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E37E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E37F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E39AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E39B3

Strings

all_proxy, xrefs: 00007FF6482E3719
NO_PROXY, xrefs: 00007FF6482E34CD
ALL_PROXY, xrefs: 00007FF6482E3730
Uses proxy env variable %s == '%s', xrefs: 00007FF6482E34EC, 00007FF6482E374A
no_proxy, xrefs: 00007FF6482E34B1
http_proxy, xrefs: 00007FF6482E36DD
memory shortage, xrefs: 00007FF6482E3467
_proxy, xrefs: 00007FF6482E36A9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 85b546518fe974906508f346c34f15a72552962cb0c771cf6e189cb72353a543
Instruction ID: 2093bd04923b5800c8db4fe03c2a82066be90dbb919149b53ad7e480939d2f9f
Opcode Fuzzy Hash: 85b546518fe974906508f346c34f15a72552962cb0c771cf6e189cb72353a543
Instruction Fuzzy Hash: 64029D62A0D78291EA62FB39A5583BB6794FF85B89F080035DE8D87785DF3CE444C748

Function 00007FF6482F9FFC Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6482FA098
strchr.VCRUNTIME140 ref: 00007FF6482FA0C4
strchr.VCRUNTIME140 ref: 00007FF6482FA0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FA122
strchr.VCRUNTIME140 ref: 00007FF6482FA232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FA24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482FA375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482FA3A1

Strings

, xrefs: 00007FF6482F9FFC
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6482FA4D9
CurrentUser, xrefs: 00007FF6482FA112

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 0f6e02ceec97318be6b8f6dc4e8b7d26f1a3ae136c02508b05c6ed373cd8a422
Instruction ID: 4b6bda5d2f319614da3b1807c862ec8f97f1384499492f3584cf235467b964aa
Opcode Fuzzy Hash: 0f6e02ceec97318be6b8f6dc4e8b7d26f1a3ae136c02508b05c6ed373cd8a422
Instruction Fuzzy Hash: 5A818321B0D64291FB56BB75AA503BA2692BF54B98F484135CB1E877D0EF3CE484E348

Function 00007FF6482FA005 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6482FA098
strchr.VCRUNTIME140 ref: 00007FF6482FA0C4
strchr.VCRUNTIME140 ref: 00007FF6482FA0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FA122
strchr.VCRUNTIME140 ref: 00007FF6482FA232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FA24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482FA375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482FA3A1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6482FA4D9
CurrentUser, xrefs: 00007FF6482FA112

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 15180cf14c634b185d4ef2093e72c7660534080491c5eda22c727618502a933b
Instruction ID: ea718239e313251545e51c88f65c748068f991d41360111b114c3fc8678c252e
Opcode Fuzzy Hash: 15180cf14c634b185d4ef2093e72c7660534080491c5eda22c727618502a933b
Instruction Fuzzy Hash: 93818321B0D64291FB56BF75AA503BA2692BF54B98F484135CB1E877D0EF3CE484E348

Function 00007FF648310580 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF648310613
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF64831063D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648310702
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831070E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648310772
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831077E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648310881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831088F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF64831089A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483108EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831090E

Strings

, xrefs: 00007FF648310651, 00007FF648310852
password, xrefs: 00007FF6483107B9
default, xrefs: 00007FF64831082D
machine, xrefs: 00007FF6483107D1, 00007FF648310812
login, xrefs: 00007FF64831079E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 95c53613c4b75bead37d9737eb2d18ca3386db0ad298d740e1b388510a37e02d
Instruction ID: d4fa7a4d2f560446110a0177dcefee2b65b5c6a574fd4aecf4e4d38507541fff
Opcode Fuzzy Hash: 95c53613c4b75bead37d9737eb2d18ca3386db0ad298d740e1b388510a37e02d
Instruction Fuzzy Hash: 86A1A422A0C79285FA62BFB5D56037A6AD0EF95F84F0C4031DE8E86694EF3CE4448748

Function 00007FF6482D1D10 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6482D1D38
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D1D40

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
No error, xrefs: 00007FF6482D2190
%s - %s, xrefs: 00007FF6482D2299
Unknown error, xrefs: 00007FF6482D2230
CRYPT_E_REVOKED, xrefs: 00007FF6482D2172
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF6482D219C
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF6482D2249

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 708f498282070d420d337acb99e452de26abb5abd9db17b713cf8609bfd7f0db
Instruction ID: 37fb7d4e9353712d0b2975c676aec1127e24ed9d41e0a1ae41211175e2a5e7d2
Opcode Fuzzy Hash: 708f498282070d420d337acb99e452de26abb5abd9db17b713cf8609bfd7f0db
Instruction Fuzzy Hash: F3519322A0C68286F721BBB0A6443FE7BA4FF44B40F484536DA9D82695DF3CF505C698

Function 00007FF6482F7CC0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F7F3E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F7F46
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6482F7F5C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F7F65
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F7F6D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F7F77

Strings

%02d:%02d:%02d%n, xrefs: 00007FF6482F7EE9
GMT, xrefs: 00007FF6482F7E37
%02d:%02d%n, xrefs: 00007FF6482F7F1D
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF6482F7D7E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: d5ea2b37de5eb515f93575f2e8a4e345096032bb43ad1bb4d757d0c498c82414
Instruction ID: 1cfea739d7f26706c27ce8e8b7fd035f9f8d0ef4b1bcdb217c1f8fabcd6c3bde
Opcode Fuzzy Hash: d5ea2b37de5eb515f93575f2e8a4e345096032bb43ad1bb4d757d0c498c82414
Instruction Fuzzy Hash: 8AF1E072F1C5428AEB24BB7885101BE33A2BB64758F904236DF1AA77D4DF3CA805D784

Function 00007FF6482F9300 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6482F9340
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F935F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F9389
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F93A1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F93C6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F93F2
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F9402
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6482F92C9), ref: 00007FF6482F9414

Strings

@, xrefs: 00007FF6482F9355

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction ID: 85d5328b5d4448c188e071fd6a9b2bd61490cbcaebff361283cadc74125210a4
Opcode Fuzzy Hash: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction Fuzzy Hash: 25318D3261868186EB65EF61E544AAEB761FBD4BC4F048031EF8E93A18CF3CD405DB44

Function 00007FF64831EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF64831EF76
CryptCreateHash.ADVAPI32 ref: 00007FF64831EF9A
CryptHashData.ADVAPI32 ref: 00007FF64831EFB6
CryptGetHashParam.ADVAPI32 ref: 00007FF64831EFD5
CryptGetHashParam.ADVAPI32 ref: 00007FF64831EFF8
CryptDestroyHash.ADVAPI32 ref: 00007FF64831F008
CryptReleaseContext.ADVAPI32 ref: 00007FF64831F01A

Strings

@, xrefs: 00007FF64831EF4D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 429e55f396393fe66fea98e7d9a8171e41cdb5e0e9661a133493c8119aebbe06
Instruction ID: c2f758f3ac54b273786b66ea9a4ed144a9d5d1a96373cf03e1a2f426b3c6858e
Opcode Fuzzy Hash: 429e55f396393fe66fea98e7d9a8171e41cdb5e0e9661a133493c8119aebbe06
Instruction Fuzzy Hash: 4121643261C68186E761AFA1E45066AB760FBC9B94F445135EA8E47A18CF3CD4058B44

Function 00007FF64831FD4C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF64831FD68
memset.VCRUNTIME140 ref: 00007FF64831FD8C
RtlCaptureContext.KERNEL32 ref: 00007FF64831FD95
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF64831FDAF
RtlVirtualUnwind.KERNEL32 ref: 00007FF64831FDF0
memset.VCRUNTIME140 ref: 00007FF64831FE23
IsDebuggerPresent.KERNEL32 ref: 00007FF64831FE44
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF64831FE61
UnhandledExceptionFilter.KERNEL32 ref: 00007FF64831FE6C

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction ID: f33b1c2fc7312b698ceede2e41b4ee854c51abb78d2795eb88c08a940b09c242
Opcode Fuzzy Hash: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction Fuzzy Hash: 01312F72608B818AEB61EFA0E8503ED7764FB84744F44443ADA4E87B99EF7CD548C714

Function 00007FF64831CE40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF64831CE87
CryptImportKey.ADVAPI32 ref: 00007FF64831CF59
CryptReleaseContext.ADVAPI32 ref: 00007FF64831CF71
CryptEncrypt.ADVAPI32 ref: 00007FF64831CFA2
CryptDestroyKey.ADVAPI32 ref: 00007FF64831CFAC
CryptReleaseContext.ADVAPI32 ref: 00007FF64831CFB8

Strings

@, xrefs: 00007FF64831CE6D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction ID: e657a208d55867765ed461a9d8601299d2c185c49da7f26c490f4ed45a2589f4
Opcode Fuzzy Hash: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction Fuzzy Hash: 1941AE22B086A08EF7119BB5E4503EE3BB0F74A788F084026DE8D57A5ACF3CD11AD754

Function 00007FF64830B4F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830B56E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830B5CB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830B5F3
bind.WS2_32 ref: 00007FF64830B672
WSAGetLastError.WS2_32 ref: 00007FF64830B67C

Strings

bind() failed; %s, xrefs: 00007FF64830B697

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 043503e0fdb1e12a905a901aa78c990b7d9c545350290c38aea68328abc36be4
Instruction ID: 5eab0e2d374553c14ce846ae435e7c1cbc512488dabf9bd4623d068fad864b4e
Opcode Fuzzy Hash: 043503e0fdb1e12a905a901aa78c990b7d9c545350290c38aea68328abc36be4
Instruction Fuzzy Hash: 3F51BC72A0CB868AFB16AB75D4543E927A0FB4AB84F084035CA4D8B785DF7CE456CB44

Function 00007FF6482F53E0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dT, xrefs: 00007FF6482F54F0
%2I64d.%0I64dG, xrefs: 00007FF6482F549A
%4I64dM, xrefs: 00007FF6482F547C
%4I64dP, xrefs: 00007FF6482F54FD
%5I64d, xrefs: 00007FF6482F53F5
%2I64d.%0I64dM, xrefs: 00007FF6482F5429
%4I64dG, xrefs: 00007FF6482F54D4
%4I64dk, xrefs: 00007FF6482F540E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 1a402775ebe9d7af04e26a2663a3cff6c5ec690d9225f72786fb014b8e9cfb9a
Instruction ID: f0db8fb294e1d534f0a3675702b5e474b4efc5b2fe2463cb0f293e689315b1e7
Opcode Fuzzy Hash: 1a402775ebe9d7af04e26a2663a3cff6c5ec690d9225f72786fb014b8e9cfb9a
Instruction Fuzzy Hash: F721A491E0D98B83FE14FBB5A7107F602625F94B80EC81432E90E86391EEBC6551D2CC

Function 00007FF6483200E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF6482C1870), ref: 00007FF6483200FE
GetLastError.KERNEL32 ref: 00007FF648320149
IsDebuggerPresent.KERNEL32 ref: 00007FF648320161
OutputDebugStringW.KERNEL32 ref: 00007FF648320172

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF64832016B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: ab1929773185d78aa00c1a2a7ebb499de6df1f4eca2485d34b4072589dd37bee
Instruction ID: b27bd69220f33372647740a598769cdc564ad2a88431c1a421e4e001ec44eee2
Opcode Fuzzy Hash: ab1929773185d78aa00c1a2a7ebb499de6df1f4eca2485d34b4072589dd37bee
Instruction Fuzzy Hash: D4116D32A18B4292E745BBB2D6513B933A0FF04314F084539C64DC2A60EF3CF468C784

Function 00007FF6482F9230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6482F9261
CryptGenRandom.ADVAPI32 ref: 00007FF6482F9275
CryptReleaseContext.ADVAPI32 ref: 00007FF6482F9286
CryptReleaseContext.ADVAPI32 ref: 00007FF6482F929C

Strings

@, xrefs: 00007FF6482F9249

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction ID: 69a7383cc4c589e572d2c03e2ff34792fe1d37b9780c644e1eb4391314e70650
Opcode Fuzzy Hash: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction Fuzzy Hash: 39F08665B0C68182E710ABA5F54436BE360FFC8BE4F448031DF8C87668DE7CD4858748

Function 00007FF6482C1000 Relevance: 6.7, Strings: 5, Instructions: 438COMMON

Download Yara Rule

Strings

8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913, xrefs: 00007FF6482C1311
loader principal, xrefs: 00007FF6482C1557
8.2, xrefs: 00007FF6482C1203
9WIvTVJa9m, xrefs: 00007FF6482C1539
https://keyauth.win/api/1.2/, xrefs: 00007FF6482C1037

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: 8.2$8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913$9WIvTVJa9m$https://keyauth.win/api/1.2/$loader principal
API String ID: 0-222467820
Opcode ID: 198cf660564fbbd7d4705920a8d0edb8e8ebed0ffb8d8fc4396b7e4d5df849be
Instruction ID: d09fb14726cc19499c6d059a3aaf1c92a60bcd575cc4fffb49250d7bedb60117
Opcode Fuzzy Hash: 198cf660564fbbd7d4705920a8d0edb8e8ebed0ffb8d8fc4396b7e4d5df849be
Instruction Fuzzy Hash: D7124B26D2EB924AF703B77594011B9E7149FA37C4F54D336ED48B1D62EF2DB2828248

Function 00007FF64831FF64 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF64831FF90
GetCurrentThreadId.KERNEL32 ref: 00007FF64831FF9E
GetCurrentProcessId.KERNEL32 ref: 00007FF64831FFAA
QueryPerformanceCounter.KERNEL32 ref: 00007FF64831FFBA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 81fecbbe110443faa4b077698657e2e73d1f9485f01ab5ea6c5b974c73907ae6
Instruction ID: a5e41dbd535cde095851eb217984c13fcc977264b9aa6f3b19b76f16448cfbb3
Opcode Fuzzy Hash: 81fecbbe110443faa4b077698657e2e73d1f9485f01ab5ea6c5b974c73907ae6
Instruction Fuzzy Hash: 92113326B18F0189EB00EFB0E8552B833A4F719B58F480E31DA6D86794DF7CE5548344

Function 00007FF6482FC220 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF6482FC250
CryptGetHashParam.ADVAPI32 ref: 00007FF6482FC276
CryptDestroyHash.ADVAPI32 ref: 00007FF6482FC285
CryptReleaseContext.ADVAPI32 ref: 00007FF6482FC295

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction ID: 82753405528d1715bdf7770916aba9931b6fb6e0f1e7421193397fa0808d860e
Opcode Fuzzy Hash: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction Fuzzy Hash: 64015A3660868182EB50EFB4E55476EB731FB85BD8F188536DB4946A68CF3CD848CB84

Function 00007FF6482FC1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6482FC1DC
CryptCreateHash.ADVAPI32 ref: 00007FF6482FC1FD

Strings

@, xrefs: 00007FF6482FC1CC

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction ID: 540509012e864c55441c1d084ff286ebf762b7b6bae01cc2f00150d905e1bdff
Opcode Fuzzy Hash: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction Fuzzy Hash: 0FE0D861B1869243F7206BB1E401F5A6350FB94B88F488031CF4C47A18CF3CD0418B48

Function 00007FF648308B00 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF648308B3B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF648308B6F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction ID: a3ddb892f0c2f919f3a1472a93641e009bcb9679ef556ea97db441b33a672b58
Opcode Fuzzy Hash: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction Fuzzy Hash: A5112A26A287D0CAD304DF75E5001AD77B0FB58B88F04962AFB8987B19EB7CD690C744

Function 00007FF6482CDDE0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6482CDEE4

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction ID: e87d4acfe0b5997ac33f26beb7cf6466abe32afbe27794e3eb704aa866cc0263
Opcode Fuzzy Hash: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction Fuzzy Hash: 46818D62B09B9989EB00EB79D4843BD37B0E715B88F984026DF4E97796DF39D081C384

Function 00007FF6482CEB70 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF6482CEC50

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction ID: 2758bdc5fff72e016ea474cacf7ea436efef3604cdd74ab1e530fa0919946fa0
Opcode Fuzzy Hash: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction Fuzzy Hash: D981AD66B19B9989EB00EB79D0843BD3BB4E719B88F584422CF4D87796CF39D081C394

Function 00007FF6482CD250 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction ID: 9cd377626f205f94810892442cfd42c52c003e6001d31734a6c7fa21c8c80c8d
Opcode Fuzzy Hash: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction Fuzzy Hash: 93610362B0DB8882EA10EB29E54427A63A1FB597D4F109235DF5D87B89EF3CE041D744

Function 00007FF64831EEC0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: d2ff6923fffca0b598910b26649e3c982845d9ded6c75c15994ae2b301fe7650
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 6AF08C25724767BEFE01853B4624FBD1E419BD0B40FA77974CC80420CB8A9F5493D714

Function 00007FF6482FC210 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction ID: c253c596fd21983b7f4979928796f6033eb4f98f550d047d35db9131688cfe4d
Opcode Fuzzy Hash: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction Fuzzy Hash: 72A00265A099458097115755E650D555650F7987657559031C50D45410CD2995458244

Function 00007FF64831FEF4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction ID: 45b2505b9f5c2bdcc0ef46984285c702a860534a71e99160d449ddd0dc22fb24
Opcode Fuzzy Hash: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction Fuzzy Hash: 35A0022191CC02D1E606FBE0EA500742735FB55740B490431D51EC10609F7CB900C348

Function 00007FF6482F9430 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 425stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6482F9463
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F94B3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F94D4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F94EA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F9508
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F9526
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F9544
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F955C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F9574

Strings

CALG_HUGHES_MD5, xrefs: 00007FF6482F972F
CALG_MD5, xrefs: 00007FF6482F951F
CALG_SHA1, xrefs: 00007FF6482F9555
CALG_HASH_REPLACE_OWF, xrefs: 00007FF6482F98F1
CALG_SSL3_MASTER, xrefs: 00007FF6482F97C5
CALG_AES_256, xrefs: 00007FF6482F994B
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF6482F97E3
CALG_SHA_384, xrefs: 00007FF6482F99A5
CALG_RC2, xrefs: 00007FF6482F967B
CALG_SHA, xrefs: 00007FF6482F953D
CALG_ECDH, xrefs: 00007FF6482F99DE
CALG_HMAC, xrefs: 00007FF6482F98B5
CALG_MAC, xrefs: 00007FF6482F956D
CALG_DESX, xrefs: 00007FF6482F965D
CALG_3DES_112, xrefs: 00007FF6482F9621
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF6482F981F
CALG_AES_128, xrefs: 00007FF6482F990F
CALG_RSA_SIGN, xrefs: 00007FF6482F958B
CALG_3DES, xrefs: 00007FF6482F963F
CALG_SSL2_MASTER, xrefs: 00007FF6482F985B
CALG_TLS1PRF, xrefs: 00007FF6482F98D3
CALG_TLS1_MASTER, xrefs: 00007FF6482F9879
CALG_NO_SIGN, xrefs: 00007FF6482F95C7
CALG_CYLINK_MEK, xrefs: 00007FF6482F9789
CALG_AES, xrefs: 00007FF6482F9969
CALG_ECDH_EPHEM, xrefs: 00007FF6482F9A2F
CALG_DH_SF, xrefs: 00007FF6482F96D5
CALG_TEK, xrefs: 00007FF6482F976B
CALG_SEAL, xrefs: 00007FF6482F96B7
CALG_RC5, xrefs: 00007FF6482F9897
CALG_DES, xrefs: 00007FF6482F9603
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF6482F9801
CALG_SHA_256, xrefs: 00007FF6482F9987
CALG_DSS_SIGN, xrefs: 00007FF6482F95A9
CALG_SKIPJACK, xrefs: 00007FF6482F974D
CALG_ECMQV, xrefs: 00007FF6482F99F9
CALG_MD2, xrefs: 00007FF6482F94E3
CALG_PCT1_MASTER, xrefs: 00007FF6482F983D
CALG_SHA_512, xrefs: 00007FF6482F99C3
CALG_RC4, xrefs: 00007FF6482F9699
CALG_SSL3_SHAMD5, xrefs: 00007FF6482F97A7
CALG_AES_192, xrefs: 00007FF6482F992D
CALG_DH_EPHEM, xrefs: 00007FF6482F96F3
CALG_ECDSA, xrefs: 00007FF6482F9A14
CALG_MD4, xrefs: 00007FF6482F9501
CALG_AGREEDKEY_ANY, xrefs: 00007FF6482F9711
CALG_RSA_KEYX, xrefs: 00007FF6482F95E5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: a95fb3a32220d5d2373a41e2be5983f02937563951c6669e17548706725ee269
Instruction ID: e96659a0dc2914e726681a2d5e3e1802dae3081560935b4845022e1c84816edc
Opcode Fuzzy Hash: a95fb3a32220d5d2373a41e2be5983f02937563951c6669e17548706725ee269
Instruction Fuzzy Hash: 63121F10F1C66390FB12F7B5DA505FA2266AF2035CF845032EA0EC65D9EE2CE519E7C8

Function 00007FF6482E4A50 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482ED7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF6482D582F), ref: 00007FF6482ED7C7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4BDD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4BF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4C91
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4CA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4CB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4CCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4CE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4CF5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D09

Part of subcall function 00007FF6482EEEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EEF1E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D45
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4DA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4DBD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4DD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4DE5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4DF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4E0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4E21

Part of subcall function 00007FF6482E28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2828), ref: 00007FF6482E28BB
Part of subcall function 00007FF6482E28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2828), ref: 00007FF6482E28E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4E4B

Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF061
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF071
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF07F
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF08D
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF09B
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0A9
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0B7
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4E77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4E8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4E9B

Strings

Closing connection %ld, xrefs: 00007FF6482E4B49

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: b9841c2d2f7e244eaf557c7957d55c27c61e3d7d63ad313c88b15d1e5c17b3dc
Instruction ID: e7ec1ba4b3de839f7a2898dcdd20119a263279519ab93c146be4c9a27703de65
Opcode Fuzzy Hash: b9841c2d2f7e244eaf557c7957d55c27c61e3d7d63ad313c88b15d1e5c17b3dc
Instruction Fuzzy Hash: 00C10A7590CB8282E741BF31E9902AD3364FB85F98F084231DE9E87799CF3C95968358

Function 00007FF648306E90 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648306F8D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830708E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648307101
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830717B

Strings

Range, xrefs: 00007FF648307157
Content-Length, xrefs: 00007FF6483073CC
Referer, xrefs: 00007FF648307117
Accept, xrefs: 00007FF648306FE8
CSeq cannot be set as a custom header., xrefs: 00007FF6483071C0
Referer: %s, xrefs: 00007FF648307132
Content-Type: application/sdp, xrefs: 00007FF64830745D
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF648307227
Session ID cannot be set as a custom header., xrefs: 00007FF6483071ED
Content-Length: %I64d, xrefs: 00007FF6483073E7
Accept-Encoding, xrefs: 00007FF648307004
Transport, xrefs: 00007FF648306F3E
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF648306F13
Content-Type: text/parameters, xrefs: 00007FF648307427
CSeq, xrefs: 00007FF6483071AC
OPTIONS, xrefs: 00007FF648306E90
Session, xrefs: 00007FF6483071D9
Transport: %s, xrefs: 00007FF648306F9A
Content-Type, xrefs: 00007FF648307413, 00007FF648307449
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF648306FC5
Session: %s, xrefs: 00007FF64830725D
Failed sending RTSP request, xrefs: 00007FF6483074F1
Accept: application/sdp, xrefs: 00007FF648306FFA
%s%s%s%s%s%s%s%s, xrefs: 00007FF6483072E6
User-Agent, xrefs: 00007FF64830706E, 00007FF64830709D
Accept-Encoding: %s, xrefs: 00007FF648307039
Range: %s, xrefs: 00007FF648307183

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 2ec97d5793b2a055e3b496001f5adaffbf27f7ecb529a76ec01f4e511673b300
Instruction ID: 828fb57fdf8eca9e5608640c0d12844db59084fc29f59a1c048a7c9d80ebcc25
Opcode Fuzzy Hash: 2ec97d5793b2a055e3b496001f5adaffbf27f7ecb529a76ec01f4e511673b300
Instruction Fuzzy Hash: 87029061A0DB8281FA66BBB5E9403FA2391EF46780F480035CE4DC7799EF3DE5458798

Function 00007FF64831DE10 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831DEF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831DFF2
htonl.WS2_32 ref: 00007FF64831E01F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E031
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E060
htonl.WS2_32 ref: 00007FF64831E075
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E0A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E129
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E132
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E13B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E172
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E17B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E184
memcpy.VCRUNTIME140 ref: 00007FF64831E19F
memcpy.VCRUNTIME140 ref: 00007FF64831E1B3
memcpy.VCRUNTIME140 ref: 00007FF64831E1C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E1F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E1F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E202
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E20B

Strings

GSSAPI handshake failure (invalid security data), xrefs: 00007FF64831DF87
GSSAPI handshake failure (invalid security layer), xrefs: 00007FF64831E006
GSSAPI handshake failure (empty security message), xrefs: 00007FF64831DF77, 00007FF64831E218

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 5ccaf9b6bd47add414f92efa479d141dd7631a221141d7cb2d10b0ad0c26a9f5
Instruction ID: 9f47b8b2b645f96e7f6f60a62b55dc57cf6a1b2f83450e7e9a8559288cb73cf7
Opcode Fuzzy Hash: 5ccaf9b6bd47add414f92efa479d141dd7631a221141d7cb2d10b0ad0c26a9f5
Instruction Fuzzy Hash: 76C14C72A1CB4286EB51BBB5E8902AD7BA0FB45B84F084435DE4E87B54DF3CE845C744

Function 00007FF6482CAE0F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF6482CAE17
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB8D3
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CB901
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CB90F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB94A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CB989

Strings

number overflow parsing ', xrefs: 00007FF6482CB80F
array, xrefs: 00007FF6482CBA09
object, xrefs: 00007FF6482CBB98

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: 2b25a70388e658df558de5c10f1f6de355e433b31a00a9922361f82aacf7a162
Instruction ID: 624e6aaab06703243ea0658d24a549f7243c7294161b283c5dab92e0b003dff8
Opcode Fuzzy Hash: 2b25a70388e658df558de5c10f1f6de355e433b31a00a9922361f82aacf7a162
Instruction Fuzzy Hash: 1022B362A1CB8585EB11BBB8E9443FE2361FB457A4F504232DA5D87AD6DF7CE081C348

Function 00007FF648312BB0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF648312C99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312CE0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312F36
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648312F4D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312F68
htons.WS2_32 ref: 00007FF648312FC7

Strings

bad error code, xrefs: 00007FF648312CF8
Could not DOH-resolve: %s, xrefs: 00007FF648312C06
DOH: %s type %s for %s, xrefs: 00007FF648312D14
%s, xrefs: 00007FF648312E83
DOH AAAA: , xrefs: 00007FF648312DE2
%s%02x%02x, xrefs: 00007FF648312E2E
AAAA, xrefs: 00007FF648312D06
DOH Host name: %s, xrefs: 00007FF648312D61
DOH A: %u.%u.%u.%u, xrefs: 00007FF648312DAE
CNAME: %s, xrefs: 00007FF648312EC3
TTL: %u seconds, xrefs: 00007FF648312D75

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 56bba87fc7c51af6d924c74d1b1b2e1982686a9a0faedffc57aa1329a3a47c90
Instruction ID: 519f234722d20a5d2bb6617482148fd9bd2ac48a10fc16b6f76b5e092eada76c
Opcode Fuzzy Hash: 56bba87fc7c51af6d924c74d1b1b2e1982686a9a0faedffc57aa1329a3a47c90
Instruction Fuzzy Hash: C4E18C32A0C68686EB61FFB5D5403BA7BA0FB44B84F484135DA8E87A48DF3CE545C744

Function 00007FF64830DB10 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DB96
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DBBC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DBCD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DC3B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DC6C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DC8C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DC9E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DD00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DD71
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DD88
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DE43
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DEB7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF64830D2CF), ref: 00007FF64830DEC0

Strings

LDAP, xrefs: 00007FF64830DB56
onetree, xrefs: 00007FF64830DDB6
subtree, xrefs: 00007FF64830DE07
base, xrefs: 00007FF64830DDC9
sub, xrefs: 00007FF64830DDF4
one, xrefs: 00007FF64830DDA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: 0558161d3525c0c5b2a966061e87bab19ec401be3912131fe2ef438a4881e9cb
Instruction ID: 4c0f5833962070bdb808808dfa73f6519c3eca7219dbe2a693ea2858d55fda14
Opcode Fuzzy Hash: 0558161d3525c0c5b2a966061e87bab19ec401be3912131fe2ef438a4881e9cb
Instruction Fuzzy Hash: BCB16F26A0DB8292EA56BB75955027A27D0FF96B80F4C4235DE4D87B88EF3CF445C708

Function 00007FF64830BCE0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF64830BD41
memchr.VCRUNTIME140 ref: 00007FF64830BD77
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF64830BDFB
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF64830BE8B

Strings

got option=(%s) value=(%s), xrefs: 00007FF64830BDBC
%s (%ld), xrefs: 00007FF64830BEF2
Malformed ACK packet, rejecting, xrefs: 00007FF64830BF7A
%s (%d), xrefs: 00007FF64830BF15, 00007FF64830BF38
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF64830BF67
%s (%ld), xrefs: 00007FF64830BE9B
tsize, xrefs: 00007FF64830BE6F
%s (%d) %s (%d), xrefs: 00007FF64830BE4D
requested, xrefs: 00007FF64830BE3A
blksize is larger than max supported, xrefs: 00007FF64830BF31
blksize is smaller than min supported, xrefs: 00007FF64830BF0E
tsize parsed from OACK, xrefs: 00007FF64830BE94
server requested blksize larger than allocated, xrefs: 00007FF64830BEE8
blksize parsed from OACK, xrefs: 00007FF64830BE33
invalid blocksize value in OACK packet, xrefs: 00007FF64830BF4E
blksize, xrefs: 00007FF64830BDDF

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: 590790d0129b1d5c45be9896e4dc915168101e99f472bba4d13294d82c54f45f
Instruction ID: 01da8bad1f2363c0366ff19a35e29837e8698d4d7c2681e1f977e7427e2f0a9d
Opcode Fuzzy Hash: 590790d0129b1d5c45be9896e4dc915168101e99f472bba4d13294d82c54f45f
Instruction Fuzzy Hash: AB61D160B0C64695EA16FBB6A5002FA6350AF42BE0F484671D95EC77E9DF3CE105C788

Function 00007FF6482DBE00 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5757
Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DC094
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DC09C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DC0C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DC0CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DC150
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DC159

Strings

text/plain, xrefs: 00007FF6482DBF6C
Content-Disposition, xrefs: 00007FF6482DBFC1
Content-Transfer-Encoding: %s, xrefs: 00007FF6482DC2E1
Content-Type, xrefs: 00007FF6482DBE88
multipart/form-data, xrefs: 00007FF6482DC257
Content-Type: %s%s%s, xrefs: 00007FF6482DC17D
multipart/, xrefs: 00007FF6482DC037
; name=", xrefs: 00007FF6482DC0EF
form-data, xrefs: 00007FF6482DC306
application/octet-stream, xrefs: 00007FF6482DBF26
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF6482DC119
attachment, xrefs: 00007FF6482DC04B, 00007FF6482DC052
multipart/mixed, xrefs: 00007FF6482DBEF5
; filename=", xrefs: 00007FF6482DC0E1
Content-Transfer-Encoding, xrefs: 00007FF6482DC1C1
; boundary=, xrefs: 00007FF6482DC173
8bit, xrefs: 00007FF6482DC2DA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: 300bd899a9cef0cdbabd0a11104f44b44084b0c6fc07b8b834b64faa677ac54b
Instruction ID: 41c10da5b33b7bf896ff8b7d1a854e4143d5dd29f00feae426a649a4c351c8db
Opcode Fuzzy Hash: 300bd899a9cef0cdbabd0a11104f44b44084b0c6fc07b8b834b64faa677ac54b
Instruction Fuzzy Hash: BDE18222A0C79295FAA5BB3296102BA6BD0FF45B84F884435DE4DC7781DF3CE855C788

Function 00007FF6482F4480 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F45F7

Strings

Digest, xrefs: 00007FF6482F44FE
CONNECT, xrefs: 00007FF6482F448E
Authorization, xrefs: 00007FF6482F463A
%s:%s, xrefs: 00007FF6482F4689
Bearer, xrefs: 00007FF6482F45F0
Proxy-, xrefs: 00007FF6482F4706
Authorization: Bearer %s, xrefs: 00007FF6482F4600
NTLM, xrefs: 00007FF6482F44DC
Proxy, xrefs: 00007FF6482F47A4
Proxy-authorization, xrefs: 00007FF6482F4563
Authorization:, xrefs: 00007FF6482F45D1
%sAuthorization: Basic %s, xrefs: 00007FF6482F4710
%s auth using %s with user '%s', xrefs: 00007FF6482F4796
Server, xrefs: 00007FF6482F478C
Negotiate, xrefs: 00007FF6482F44BA
Basic, xrefs: 00007FF6482F4757

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: 9d864d28d9e300f388af087b7d8b9fd2095f76582643c860ef49b6a4ced9ffbd
Instruction ID: bff65cdd16eb75500b5b2fda336a43b0b83b5c7f57db8c2a01bf8730bf1a92ee
Opcode Fuzzy Hash: 9d864d28d9e300f388af087b7d8b9fd2095f76582643c860ef49b6a4ced9ffbd
Instruction Fuzzy Hash: C1919E21E0CE9291FA61FB7196503BA2391EF61B94F184032DB4C877A1EF7CE855D788

Function 00007FF6482C6310 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482C4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341

memcpy.VCRUNTIME140 ref: 00007FF6482C6486
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6482C6518
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6482C6559
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C66A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C66E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C6730
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C6771
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C67CE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C6888

Part of subcall function 00007FF64831F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6482C43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF64831F20A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C68C9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C6996
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C69D7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482C69FA

Strings

unexpected , xrefs: 00007FF6482C6813
rsing , xrefs: 00007FF6482C6468
; last read: ', xrefs: 00007FF6482C65DC
; expected , xrefs: 00007FF6482C6920
syntax error , xrefs: 00007FF6482C635D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 4e1204277121835ebe4e06a958129741cbb2a0c4066216bae6c9bb7d253b311e
Instruction ID: 334247f72ab1d2950cf544a81bf19499786d7fdbd0692b2b5a04d274f118a757
Opcode Fuzzy Hash: 4e1204277121835ebe4e06a958129741cbb2a0c4066216bae6c9bb7d253b311e
Instruction Fuzzy Hash: AF12D362E0CA4645EB11BBB4E6043BE2761EB447E8F144735DA6D836DADF7CE184C388

Function 00007FF6482D9A20 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482DA970: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF6482DA3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9), ref: 00007FF6482DA993
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA9E9
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA9F3
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA9FD
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA07
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA11
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA1B
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA25
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA2F
Part of subcall function 00007FF6482DA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA38

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9B17
strchr.VCRUNTIME140 ref: 00007FF6482D9B31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9B5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9B68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9B92
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9BA6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9BB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9BCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9BDA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9BE8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9C03
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9C1F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9C3B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9C57
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9C73
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9C8F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9CAB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9CC3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9D5B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6482D9D92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9DD3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: be88be890d69c48f3ab97c3fa41fe16f5b033f2fd1f21b873e75df2716961dc1
Instruction ID: f512b3d7452acf3f0bf313830cc669475a2e00e7ec40cf1786c13e92f454aaef
Opcode Fuzzy Hash: be88be890d69c48f3ab97c3fa41fe16f5b033f2fd1f21b873e75df2716961dc1
Instruction Fuzzy Hash: 22B1AE65A0EB5255EA57BF75A65037A2BD0EF45B94F080130DE4E83781DF3CE894C398

Function 00007FF64830E240 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830E250
strstr.VCRUNTIME140 ref: 00007FF64830E27F
strchr.VCRUNTIME140 ref: 00007FF64830E2AB
strrchr.VCRUNTIME140 ref: 00007FF64830E2C5
strchr.VCRUNTIME140 ref: 00007FF64830E2DA
strrchr.VCRUNTIME140 ref: 00007FF64830E33A

Strings

/, xrefs: 00007FF64830E295
., xrefs: 00007FF64830E31A
/, xrefs: 00007FF64830E353
?, xrefs: 00007FF64830E2B8
/, xrefs: 00007FF64830E30E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: 532677097c9836d2ba0a64a8e6dc7d0731298d3760ddfc5c2a40f58a8fc9dc2d
Instruction ID: 0817f61b6c0033aa91cc31bd48b20ed6b07a405f81d6a6caa4ed74e554727486
Opcode Fuzzy Hash: 532677097c9836d2ba0a64a8e6dc7d0731298d3760ddfc5c2a40f58a8fc9dc2d
Instruction Fuzzy Hash: 9781BD12F0C28285FB67BBB195103796B91AF87784F4C4475DE8D8A7CADE3CE8458308

Function 00007FF648309140 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF648309213
strchr.VCRUNTIME140 ref: 00007FF64830926A
strchr.VCRUNTIME140 ref: 00007FF648309282
strchr.VCRUNTIME140 ref: 00007FF64830929D
strchr.VCRUNTIME140 ref: 00007FF648309319
strchr.VCRUNTIME140 ref: 00007FF648309331
strchr.VCRUNTIME140 ref: 00007FF64830934C
strchr.VCRUNTIME140 ref: 00007FF648309367
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483093F4

Strings

CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF6483092FA
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF6483093D5
lookup word is missing, xrefs: 00007FF6483092B4, 00007FF64830937E
/D:, xrefs: 00007FF6483091E6
/M:, xrefs: 00007FF648309195
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF64830924A
default, xrefs: 00007FF6483092C3, 00007FF64830938D
/MATCH:, xrefs: 00007FF64830917A
/DEFINE:, xrefs: 00007FF6483091CB
/FIND:, xrefs: 00007FF6483091B0
/LOOKUP:, xrefs: 00007FF6483091FD
Failed sending DICT request, xrefs: 00007FF648309401

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 40fc0069801b7dfe2785114d83a4b2d6c3cc27889de5eff3aac2ff71acebb616
Instruction ID: a417d69853c5194d2eeba8025eed45893f44716c9755de8eab20e1ba3128370f
Opcode Fuzzy Hash: 40fc0069801b7dfe2785114d83a4b2d6c3cc27889de5eff3aac2ff71acebb616
Instruction Fuzzy Hash: 2C818F21A0C68284FF27BBB299502B96395AF47BC8F8C4071DE4D87799DE2CF505C758

Function 00007FF6482E5170 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E518C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E51A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E51B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E51C3

Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF061
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF071
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF07F
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF08D
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF09B
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0A9
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0B7
Part of subcall function 00007FF6482DF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E51FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5213
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5266
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E527A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E528E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E52A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E530A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E531E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5332
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5346
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E53AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E53EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E53FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5412
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5426
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E543A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E544E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5462
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5476
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5498

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction ID: a0b6cc60168a746fad079360342caab7039f198b698ab513bb44b79afc004698
Opcode Fuzzy Hash: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction Fuzzy Hash: F491B576618B81A3E74AAF31D9902AC7368F749F48F080135EF9D47755CF38A6A5C314

Function 00007FF6483039B0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483039FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648303AEF
strchr.VCRUNTIME140 ref: 00007FF648303A31

Part of subcall function 00007FF6482DAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DAB64

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648303C57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648303E21
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648303E43

Part of subcall function 00007FF6482EEEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EEF1E

Strings

Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF648303C2B
%u.%u.%u.%u, xrefs: 00007FF648303C63
Can't resolve proxy host %s:%hu, xrefs: 00007FF648303D03
Weirdly formatted EPSV reply, xrefs: 00007FF648303B0F
%u,%u,%u,%u,%u,%u, xrefs: 00007FF648303B7B
Can't resolve new host %s:%hu, xrefs: 00007FF648303D6E
%c%c%c%u%c, xrefs: 00007FF648303A6B
Illegal port number in EPSV reply, xrefs: 00007FF648303AAF
Bad PASV/EPSV response: %03d, xrefs: 00007FF648303E6E
Couldn't interpret the 227-response, xrefs: 00007FF648303B9E
Connecting to %s (%s) port %d, xrefs: 00007FF648303DFA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: e3891626471682f6b1a9a5526d2baab70864a2c76d2e9b59f3580da1619b8368
Instruction ID: a5e133e2934d200782e2ef8011014f526a1642cef28d1a1ecee2e4ef5d8818f7
Opcode Fuzzy Hash: e3891626471682f6b1a9a5526d2baab70864a2c76d2e9b59f3580da1619b8368
Instruction Fuzzy Hash: 01D19722B0C68252EA66FB75D5402BAB7A0FF47784F480036DB4D83A59DF3CE564C749

Function 00007FF6482E4240 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E4562

Strings

Unsupported proxy syntax in '%s', xrefs: 00007FF6482E454A
socks4a, xrefs: 00007FF6482E431B
socks4, xrefs: 00007FF6482E4336
socks5, xrefs: 00007FF6482E4300
socks5h, xrefs: 00007FF6482E42E2
http, xrefs: 00007FF6482E435E
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF6482E43A4
Unsupported proxy scheme for '%s', xrefs: 00007FF6482E4371
socks, xrefs: 00007FF6482E434A
https, xrefs: 00007FF6482E42C4

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: a4b04b913e93c2f9c523f7cf3eae0e2690bd5702689a41c3ee2f1092c1171054
Instruction ID: 019ab164f88391d2f1d85be88dfeedbc7a31af8698bb23f7f1ef9d4f918b4868
Opcode Fuzzy Hash: a4b04b913e93c2f9c523f7cf3eae0e2690bd5702689a41c3ee2f1092c1171054
Instruction Fuzzy Hash: EFA16B62F0CE4285FB11FBB1EA406BE27A4AB44794F494532DE0D97A95DF3CE944838C

Function 00007FF648302E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482FC080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6482E340F), ref: 00007FF6482FC0AE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302F36
strchr.VCRUNTIME140 ref: 00007FF648302F54
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302F84
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648302F9F
strchr.VCRUNTIME140 ref: 00007FF648302FC9
strrchr.VCRUNTIME140 ref: 00007FF648302FE5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830300F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830302A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830304E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648303066
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6483030A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483030E0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830317C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483031A1

Strings

Request has same path as previous transfer, xrefs: 00007FF648303186
Uploading to a URL without a file name!, xrefs: 00007FF6483030CC

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 9dcf305a52cd3e23aaf1153be538e4d3e6a8ad2efff6f173cfe376763f3954e1
Instruction ID: cf12e3b63b15050b55f4ba0a89811b83a18b936eec68ade7943abbb0ca0d8e84
Opcode Fuzzy Hash: 9dcf305a52cd3e23aaf1153be538e4d3e6a8ad2efff6f173cfe376763f3954e1
Instruction Fuzzy Hash: 6D91D621B0D78282EA56BBB9D4543B923E0FB47B80F5C4435DA4E83B99DF3CE4558705

Function 00007FF6482DA3A0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA403
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA47D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA4A1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA4F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA52A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA53C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA54F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA56A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA580
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482DA589

Strings

%s, xrefs: 00007FF6482DA51B
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF6482DA476
%s.%s.tmp, xrefs: 00007FF6482DA43A
## Fatal libcurl error, xrefs: 00007FF6482DA5B7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 1f35a80a99e6fd3e0fec7f91074f21a35dd5555525d88da8c92026e8bc2dde98
Instruction ID: ad22b46deb00aba31452a398a64704006a3d64df21f2e34b837f36f56da41545
Opcode Fuzzy Hash: 1f35a80a99e6fd3e0fec7f91074f21a35dd5555525d88da8c92026e8bc2dde98
Instruction Fuzzy Hash: D651A311E0D64251FE65BB75AA146BB27E1BF85BC4F484430DD4FC6791EE3CE8858388

Function 00007FF6482F6440 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

Failed to send SOCKS4 connect request., xrefs: 00007FF6482F67ED
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF6482F6946
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF6482F66AA
SOCKS4%s request granted., xrefs: 00007FF6482F6A06
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF6482F6973
Too long SOCKS proxy name, can't use!, xrefs: 00007FF6482F6607
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF6482F69AD
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF6482F68E1
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF6482F65AB
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF6482F6506
SOCKS4: too long host name, xrefs: 00007FF6482F6806
SOCKS4 connection to %s not supported, xrefs: 00007FF6482F670C
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF6482F689A
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF6482F69E4
[, xrefs: 00007FF6482F69D4
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF6482F672B
SOCKS4 communication to %s:%d, xrefs: 00007FF6482F651F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: d637e8b93964d19652cbde8d3f989b517b3b87a2f501727801d216937b0aa004
Instruction ID: 958f00f070261b727cd6aee8536219bef7bdb92426b9ef8f116931d3298019a8
Opcode Fuzzy Hash: d637e8b93964d19652cbde8d3f989b517b3b87a2f501727801d216937b0aa004
Instruction Fuzzy Hash: 34E1F16290C2C28AEB55BB35D2403BA7BA1FB49784F088136DB4E87795DF3CE544D788

Function 00007FF6482C5470 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C55CE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482C55FC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482C560A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C5644
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C5695
memset.VCRUNTIME140 ref: 00007FF6482C54C3

Part of subcall function 00007FF6482C4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341

Part of subcall function 00007FF6482C6310: memcpy.VCRUNTIME140 ref: 00007FF6482C6486

Part of subcall function 00007FF6482C1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C5802
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482C582E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482C583C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C5877
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C58CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C59B1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6482C59C9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6482C59D6

Strings

value, xrefs: 00007FF6482C5536, 00007FF6482C576E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 023b6053358200f424848e61aa4fa9e49c9a7dc309aec37bbb2a978c88a57a66
Instruction ID: 3d4c95737ceb83a6c4cece0cc60835d6707693840d62a9996c6c2f5468739bca
Opcode Fuzzy Hash: 023b6053358200f424848e61aa4fa9e49c9a7dc309aec37bbb2a978c88a57a66
Instruction Fuzzy Hash: 4CF1D822A0CA8285EB11FB74E5443BE6760FB857A4F145331EAAD43AEADF3CD185C744

Function 00007FF6482FB1E0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6482FB4C7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6482FB537
CertFreeCertificateContext.CRYPT32 ref: 00007FF6482FB575
CertFreeCertificateContext.CRYPT32 ref: 00007FF6482FB588

Strings

schannel: failed to setup confidentiality, xrefs: 00007FF6482FB272
http/1.1, xrefs: 00007FF6482FB33B
schannel: failed to setup replay detection, xrefs: 00007FF6482FB256
schannel: failed to store credential handle, xrefs: 00007FF6482FB42C
schannel: failed to retrieve remote cert context, xrefs: 00007FF6482FB5A7
schannel: failed to setup sequence detection, xrefs: 00007FF6482FB23A
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF6482FB328
ALPN, server did not agree to a protocol, xrefs: 00007FF6482FB355
schannel: failed to setup stream orientation, xrefs: 00007FF6482FB2B0
schannel: failed to retrieve ALPN result, xrefs: 00007FF6482FB2FB
schannel: failed to setup memory allocation, xrefs: 00007FF6482FB291

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 003eef28260a4f8df0df00670386984386231f818a0537bbf2c3299004cc96c5
Instruction ID: b85d409371579f7043ab8f96303b5e2f06db062d53f9d5539263def5726d2c29
Opcode Fuzzy Hash: 003eef28260a4f8df0df00670386984386231f818a0537bbf2c3299004cc96c5
Instruction Fuzzy Hash: 3AB19261A0CA8285EB61BB35DA103BA2392FF94B94F484032DE4DC7794DF3CD945D788

Function 00007FF6482F1A00 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6482F1AB8
strchr.VCRUNTIME140 ref: 00007FF6482F1ACF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F1B1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F1CE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F1D36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F1D3F

Strings

Authorization:, xrefs: 00007FF6482F1C71
Cookie:, xrefs: 00007FF6482F1C8B
%s, xrefs: 00007FF6482F1CCC
Connection:, xrefs: 00007FF6482F1C31
Transfer-Encoding:, xrefs: 00007FF6482F1C58
Content-Type:, xrefs: 00007FF6482F1BBF, 00007FF6482F1BE5
Content-Length:, xrefs: 00007FF6482F1C0B
1.1, xrefs: 00007FF6482F1A1B
Host:, xrefs: 00007FF6482F1B99

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 7e1ad2abd64872e1a6c8b3d4c2903b2d40eb7b32a9edbe3065d4335cf41a8063
Instruction ID: 2010daeb5e43c4813cb0a14463b1f1ef6e66ed9979847e32e8111066a1bae6d8
Opcode Fuzzy Hash: 7e1ad2abd64872e1a6c8b3d4c2903b2d40eb7b32a9edbe3065d4335cf41a8063
Instruction Fuzzy Hash: 8C91A521A0C68281FB63BB31D6503BA6792AF64B84F894031CF4DD7685EE2DE541E389

Function 00007FF64831D000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF64830FD2F), ref: 00007FF64831D02D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF64830FD2F), ref: 00007FF64831D04F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF64830FD2F), ref: 00007FF64831D060
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF64830FD2F), ref: 00007FF64831D08E

Strings

../, xrefs: 00007FF64831D0F9
/../, xrefs: 00007FF64831D15B
/./, xrefs: 00007FF64831D11C
/.., xrefs: 00007FF64831D192

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: 190f5f5efba5df30148cf3e06b309bf7ce750d830b12a83570053c044d9442d2
Instruction ID: 2c1d227e8e756b25a547fa66cb467069a8dbd6d6908e7c3f19259bd3dceefe03
Opcode Fuzzy Hash: 190f5f5efba5df30148cf3e06b309bf7ce750d830b12a83570053c044d9442d2
Instruction Fuzzy Hash: F371B421E0C69241FBA3BBB1A500279BFA0AB57FA4F0C4131CA6D866D1DE3CF456C309

Function 00007FF6482DF4D0 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF534
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF568
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF64F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF65C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF6A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF71F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF740
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF761
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DF782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF819
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DF822

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction ID: 8d23c88251524fda09d18ef336654e791bd308e65d7a3643b8ae8993b56dff69
Opcode Fuzzy Hash: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction Fuzzy Hash: FAB17C36A0EB8296EA65AF65E64036A37E1FF44B14F184135CF8D87B50DF3CE4649388

Function 00007FF648317C01 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648317C32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483182AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483182E8

Strings

-----END CERTIFICATE-----, xrefs: 00007FF648318237
%s, xrefs: 00007FF6483182D6
TRUE, xrefs: 00007FF648317C24
-----BEGIN CERTIFICATE-----, xrefs: 00007FF64831818C
FALSE, xrefs: 00007FF648317C1D
Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7
Cert, xrefs: 00007FF6483182BE

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 855c74e2298b12dfae87e416f71bfb0fd242813ebbe9111dfcebbe4282bd71ec
Instruction ID: 5b54d09a10edfa69e5d10abe48a66b7610654a480d536f837a0d8286ec1b6ac0
Opcode Fuzzy Hash: 855c74e2298b12dfae87e416f71bfb0fd242813ebbe9111dfcebbe4282bd71ec
Instruction Fuzzy Hash: F571C767E0D6C155EB53BBB994042BA7FA0EF46B48F5C4432CA4D83362DE2CD54AD309

Function 00007FF648311C70 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311D32
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311D6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311DBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311E72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311E7B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311E86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311F71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311F85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648311FFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831200F

Part of subcall function 00007FF648312400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6483142EA,?,?,00000000,00007FF648310D25), ref: 00007FF648312410
Part of subcall function 00007FF648312400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6483142EA,?,?,00000000,00007FF648310D25), ref: 00007FF648312421
Part of subcall function 00007FF648312400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6483142EA,?,?,00000000,00007FF648310D25), ref: 00007FF648312433

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF64831201C
WDigest, xrefs: 00007FF648311D1C, 00007FF648311E34

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: 59aae337aff638c80ea522d502be7416802ba366a363efdf939df804e7f274dd
Instruction ID: b3e6c27b653b1ab6ac2a720a466f61754a209611c74e9c9628abb5a5349f0f73
Opcode Fuzzy Hash: 59aae337aff638c80ea522d502be7416802ba366a363efdf939df804e7f274dd
Instruction Fuzzy Hash: 27B13A72A0CB4686EB11BBB5E8802AD77A0FB48B98F481135DE4D87B58DF3CE945C744

Function 00007FF6483189C0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318AD3

Strings

dh(p), xrefs: 00007FF648318C2F
rsa(n), xrefs: 00007FF648318AE0
dsa, xrefs: 00007FF648318B35
rsa(e), xrefs: 00007FF648318B0B
rsaEncryption, xrefs: 00007FF648318A05
%lu, xrefs: 00007FF648318AA8
dsa(pub_key), xrefs: 00007FF648318BE2
RSA Public Key, xrefs: 00007FF648318ABF
dsa(p), xrefs: 00007FF648318B6D
dh(g), xrefs: 00007FF648318C60
dhpublicnumber, xrefs: 00007FF648318BF6
RSA Public Key (%lu bits), xrefs: 00007FF648318A8E
dh(pub_key), xrefs: 00007FF648318C76
dsa(g), xrefs: 00007FF648318BCC
dsa(q), xrefs: 00007FF648318B9C

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: ee4d974dc3b3459793741b3c071e06878cee760591840d70200e270625e77535
Instruction ID: a1224e6a352e006cd68d0dd98b61afa8b8ce1a637c6264bb0ec20968194f9761
Opcode Fuzzy Hash: ee4d974dc3b3459793741b3c071e06878cee760591840d70200e270625e77535
Instruction Fuzzy Hash: 89716FA1B0D74642EA12FBB1A5401F96790FF88B80F584132DE4D8778AEF3CE641C688

Function 00007FF64830ED9C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F008
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F060
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F06D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F16F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F1BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F1D6

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: e50ef931bf97fd6978a02dacd3bdcb8e3fa39a162dbfd03a69ca58af84868c80
Instruction ID: 0126a33cb9a451a78cef6db86d9ce95952d746a2d68c7b0929d2e532904127ef
Opcode Fuzzy Hash: e50ef931bf97fd6978a02dacd3bdcb8e3fa39a162dbfd03a69ca58af84868c80
Instruction Fuzzy Hash: E6A1B112E0D28245FB67BBB195103796BE0AF47B85F0C8471EE8EC67C9DE2DE4059318

Function 00007FF6482FD080 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6482FD0D8

Strings

CAPABILITY, xrefs: 00007FF6482FD4A0
STORE, xrefs: 00007FF6482FD30A
NOOP, xrefs: 00007FF6482FD41F
PREA, xrefs: 00007FF6482FD114
UID, xrefs: 00007FF6482FD407
Unexpected continuation response, xrefs: 00007FF6482FD51E
FETCH, xrefs: 00007FF6482FD24C, 00007FF6482FD362
EXPUNGE, xrefs: 00007FF6482FD3D7
EXAMINE, xrefs: 00007FF6482FD3A7
SELECT, xrefs: 00007FF6482FD38F
LIST, xrefs: 00007FF6482FD2BC
LSUB, xrefs: 00007FF6482FD3EF
, xrefs: 00007FF6482FD0E1
SEARCH, xrefs: 00007FF6482FD1EC, 00007FF6482FD3BF

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 5e11bfa2a84c0bb5aa158c4cf855aa4d81f042b1f6a2de6bc2e49222ceafe7f8
Instruction ID: 99d3138f4e684d9ac2ccdd88cab10fe5f22f6c461efa787eeb3f265dc6e034c7
Opcode Fuzzy Hash: 5e11bfa2a84c0bb5aa158c4cf855aa4d81f042b1f6a2de6bc2e49222ceafe7f8
Instruction Fuzzy Hash: D8D1C121E0C24342FBA27F35D6442BA6792AF21754F885032DB5DC65C5EF6CF842E389

Function 00007FF6483019D0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648301AF0

Strings

Received only partial file: %I64d bytes, xrefs: 00007FF648301DFE
No data was received!, xrefs: 00007FF648301E2C
ABOR, xrefs: 00007FF648301BEB
Remembering we are in dir "%s", xrefs: 00007FF648301B88
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF648301DC6
partial download completed, closing connection, xrefs: 00007FF648301D23
server did not report OK, got %d, xrefs: 00007FF648301D5E
control connection looks dead, xrefs: 00007FF648301CE2
Failure sending ABOR command: %s, xrefs: 00007FF648301C11

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: a239f058e62c514e76706a9140ba831bcd74617e94364339e7ba736567eb66f4
Instruction ID: bd77f46c9b5c98644430a10261635e7872d9abb6b218df6e44772b7ce3f7727a
Opcode Fuzzy Hash: a239f058e62c514e76706a9140ba831bcd74617e94364339e7ba736567eb66f4
Instruction Fuzzy Hash: 0DD1D322A0C68646EA66BFB591403FE6251FB43394F480236DB6D836C6DF7CE885C348

Function 00007FF6482CC031 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482C4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341

Part of subcall function 00007FF6482C6310: memcpy.VCRUNTIME140 ref: 00007FF6482C6486

Part of subcall function 00007FF6482C1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC0E0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CC10E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CC11C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC156
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC1B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC333
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC37D

Strings

value, xrefs: 00007FF6482CC04F, 00007FF6482CC1D8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 9efa30662b9e0125733c549c7ddb0404d6325bb906536454243b4d6c7a755523
Instruction ID: 2cbffb61b76804622eff703d5b68dbf99aface1eef408e3d7a1bae684b1eede8
Opcode Fuzzy Hash: 9efa30662b9e0125733c549c7ddb0404d6325bb906536454243b4d6c7a755523
Instruction Fuzzy Hash: 43A19562A1CA8581EB01BBB8E5443BE6361FB457B4F041331EA6D83AD9DF7CE081D744

Function 00007FF6482DA010 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA07D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DA09D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DA0D1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DA0F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA115
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA126
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DA148
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA1FF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DA214

Strings

ignoring failed cookie_init for %s, xrefs: 00007FF6482DA152
Set-Cookie:, xrefs: 00007FF6482DA186
none, xrefs: 00007FF6482DA092

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: 992fbeba35ba7d9cfd174204178d183b8fb1cad6507cabc141d8163f4fd3fce8
Instruction ID: 64a125436893816ec5ef8b06b95ee9bd990c9f6ca686d1dee80394f2ee119bc0
Opcode Fuzzy Hash: 992fbeba35ba7d9cfd174204178d183b8fb1cad6507cabc141d8163f4fd3fce8
Instruction Fuzzy Hash: 3E61C322A0D78291EA55BB359604BBB2BD4FF85B84F484035DE8E87781DF3DE485D388

Function 00007FF6482D2500 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6482D2522
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D252A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D2549
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D2555
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D2564
strrchr.VCRUNTIME140 ref: 00007FF6482D25B5
strrchr.VCRUNTIME140 ref: 00007FF6482D25D6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D25EF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D25FA
GetLastError.KERNEL32 ref: 00007FF6482D2603
SetLastError.KERNEL32 ref: 00007FF6482D260F

Strings

Unknown error %d (%#x), xrefs: 00007FF6482D2597

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 7b9888dc63a3e7c9f678162156a496c77b2712124fc0888817af1d5cf78b4351
Instruction ID: a6861ed167b6228fcbec78a410349f7dd0ae33e48943c3ed4cbb1a3a69f5784f
Opcode Fuzzy Hash: 7b9888dc63a3e7c9f678162156a496c77b2712124fc0888817af1d5cf78b4351
Instruction Fuzzy Hash: 49318121A0C74285FA1A7FB1AA2427E6AD1EF84F80F4C0435DE4E87795DE3CF8018398

Function 00007FF648309D20 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF648309D8B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648309EB5

Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5757
Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5763

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648309E6F

Part of subcall function 00007FF6482D5690: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D56A0

Strings

XDISPLOC, xrefs: 00007FF648309E8B
USER,%s, xrefs: 00007FF648309DB0
TTYPE, xrefs: 00007FF648309E45
NEW_ENV, xrefs: 00007FF648309ED1
Syntax error in telnet option: %s, xrefs: 00007FF648309FC6
%hu%*[xX]%hu, xrefs: 00007FF648309F39
%127[^= ]%*[ =]%255s, xrefs: 00007FF648309E30
BINARY, xrefs: 00007FF648309F5E
Unknown telnet option %s, xrefs: 00007FF648309FAD

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: 1fef72c7444546989d73c0875fbfa1f9dd609a4fb55574ababa5f96400690454
Instruction ID: b2a30f5a15742bef5452b4310ff3aae356df5bfc19f4a33a564b289408bc96c0
Opcode Fuzzy Hash: 1fef72c7444546989d73c0875fbfa1f9dd609a4fb55574ababa5f96400690454
Instruction Fuzzy Hash: 2C714B32A0CAC695FB22BF64D5417EA6360FF86788F884032DE8D87259EF78D545C784

Function 00007FF64830CE20 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF64830CF93
sendto.WS2_32 ref: 00007FF64830D04C
WSAGetLastError.WS2_32 ref: 00007FF64830D05A

Strings

tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF64830D004
Received ACK for block %d, expecting %d, xrefs: 00007FF64830CFE5
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF64830CE8D
tftp_tx: internal error, event: %i, xrefs: 00007FF64830CE78

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 50e73455d7e3a75b11b53e943120c7777fc9fe00b525068e7abcedd1a1672a85
Instruction ID: 1c0c63a4c2d94779f763529ed8ddccec2210e7ddaf17e5aea7e8bba39710a1b7
Opcode Fuzzy Hash: 50e73455d7e3a75b11b53e943120c7777fc9fe00b525068e7abcedd1a1672a85
Instruction Fuzzy Hash: C5B16D7260C682C6EB66AF79D4407A937A0FB8AF89F484132DE4D8B758DF38E441C754

Function 00007FF64830C200 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF64830C378
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF64830C393
sendto.WS2_32 ref: 00007FF64830C3FA
sendto.WS2_32 ref: 00007FF64830C4B1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF64830C4E9

Strings

Received last DATA packet block %d again., xrefs: 00007FF64830C445
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF64830C4F1
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF64830C272
tftp_rx: internal error, xrefs: 00007FF64830C24E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 082182b0c608b5dd753e2c0b4bfb06eb638cf906bf23a4cf43ef42e9b11363e8
Instruction ID: b987be33e474967f0560bc997d0a6b761b26849ebf2c3e520e9d509b8d9a481c
Opcode Fuzzy Hash: 082182b0c608b5dd753e2c0b4bfb06eb638cf906bf23a4cf43ef42e9b11363e8
Instruction Fuzzy Hash: 7A914A3661C681C6D752EF79D4503A93BA0FB89F88F488132DA4D8B758DF39E406C754

Function 00007FF6482E3DF0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3E2D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3EAF
strchr.VCRUNTIME140 ref: 00007FF6482E3F2E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6482E3F5C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3F7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3F8F

Strings

Invalid IPv6 address format, xrefs: 00007FF6482E3F17
%25, xrefs: 00007FF6482E3EA5
No valid port number in connect to host string (%s), xrefs: 00007FF6482E3FBB
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF6482E3EB9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: 0d1e06a6d0f9712c3ca27df683fb699d76da4af6e053dfbf71b887b8ca41c8f6
Instruction ID: c6fd392c6afe37b11547c3310799092176e221641aafc66b64e628e6fe05781f
Opcode Fuzzy Hash: 0d1e06a6d0f9712c3ca27df683fb699d76da4af6e053dfbf71b887b8ca41c8f6
Instruction Fuzzy Hash: 4E51F561A0C69345EB26BB3A95683BB67E1AF01B95F4C4031DA4D866C1DE3DE4468388

Function 00007FF6482D9E00 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9E3E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9E5E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482D9E90
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482D9EAD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9ECB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D9EDC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482D9EFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6482D4050), ref: 00007FF6482D9FAF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6482D4050), ref: 00007FF6482D9FC5

Strings

Set-Cookie:, xrefs: 00007FF6482D9F36
none, xrefs: 00007FF6482D9E53

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: c845ef27a6eb0f70cfb5e5d8d0ec943c7a71320ffd18cdb9581be7247b181f35
Instruction ID: d64b6bf984a073c423d3ae7d0f6309300bd834aa593931527d888117f03fe645
Opcode Fuzzy Hash: c845ef27a6eb0f70cfb5e5d8d0ec943c7a71320ffd18cdb9581be7247b181f35
Instruction Fuzzy Hash: B351E421A0C79255FA67BB316A102BB6AD0AF45B80F584434EE8E837D1DF3CE445C388

Function 00007FF6482EB9D0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482EBD66

Strings

Successfully compiled trailers., xrefs: 00007FF6482EBAAA
Moving trailers state machine from initialized to sending., xrefs: 00007FF6482EBA11
Unable to allocate trailing headers buffer !, xrefs: 00007FF6482EBA43
Read callback asked for PAUSE when not supported!, xrefs: 00007FF6482EBBC9
Signaling end of chunked upload after trailers., xrefs: 00007FF6482EBDB0
read function returned funny value, xrefs: 00007FF6482EBC0B
%zx%s, xrefs: 00007FF6482EBC87
operation aborted by trailing headers callback, xrefs: 00007FF6482EBB5D
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF6482EBCFA
operation aborted by callback, xrefs: 00007FF6482EBB3D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: 6c3bbffbfaa8afe039b59d5f2ad093e3cc1498ca40d8528e7d0893ab42bc7699
Instruction ID: 3fa0e47d3ac7de2bbbe8bce916997944e1024840a88d1c3eecf96b4440cf8753
Opcode Fuzzy Hash: 6c3bbffbfaa8afe039b59d5f2ad093e3cc1498ca40d8528e7d0893ab42bc7699
Instruction Fuzzy Hash: D4A18F32A0CA8681E751FF71DA403FA2391EB85B94F480531DE5E9B295EF7CE541C398

Function 00007FF6482FD9E0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FDB10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FDB26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FDB89

Strings

Mime-Version, xrefs: 00007FF6482FDC16
Cannot APPEND without a mailbox., xrefs: 00007FF6482FDBB4
Cannot APPEND with unknown input file size, xrefs: 00007FF6482FDC87
SELECT %s, xrefs: 00007FF6482FDB75
Mime-Version: 1.0, xrefs: 00007FF6482FDC31
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF6482FDCBD
Cannot SELECT without a mailbox., xrefs: 00007FF6482FDB3F
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF6482FD9F8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 2bc415dddcf2fbc5f9affb62417552fc3cfeb8ceedfac8cd1da88004e01584b9
Instruction ID: 29eb02c52f74efb6191b49d69343a3c1bd468bf215a839e7d40c0adfb5f9702f
Opcode Fuzzy Hash: 2bc415dddcf2fbc5f9affb62417552fc3cfeb8ceedfac8cd1da88004e01584b9
Instruction Fuzzy Hash: B0913E61B0CA4286FB65BB31D6903BB2392EF65B84F544035DF4E87685DF6CE844E388

Function 00007FF6482C1FB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482C2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2469
Part of subcall function 00007FF6482C2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C24A8

Part of subcall function 00007FF6482C4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341

Part of subcall function 00007FF6482C3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C3BF6

Part of subcall function 00007FF6482C5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5E61

Part of subcall function 00007FF6482C3C30: memcpy.VCRUNTIME140 ref: 00007FF6482C3C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2121
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2171
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C21C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2202
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2254
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2293
__std_exception_copy.VCRUNTIME140 ref: 00007FF6482C22E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2337

Strings

parse_error, xrefs: 00007FF6482C2011
parse error, xrefs: 00007FF6482C203B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: 796c5f3307eb32e0ad6337efd212abd60be5357c1e3d7b385b4cd24bde934b85
Instruction ID: 2d675cb0cb6b9a4e87e4061f78b1364384fbbd5429caee8f1909e0fc77deaf3f
Opcode Fuzzy Hash: 796c5f3307eb32e0ad6337efd212abd60be5357c1e3d7b385b4cd24bde934b85
Instruction Fuzzy Hash: 41B18262A08B4585FB11EBB4E5443AE3761EB847A8F145621EA6D43AEADF7CE0C0C344

Function 00007FF6482EE160 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EE1F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EE238
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EE2D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EE2EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EE30B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EE35A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6482EE3AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EE3DF

Strings

Shuffling %i addresses, xrefs: 00007FF6482EE1DA
:%u, xrefs: 00007FF6482EE36E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 1c6b2c5cffc96e1f2faa13328d5cbc488b8c058bf72ff2addcdcbf0fc35252f0
Instruction ID: 014d183ca9f039de2ba331ebe282447c3c4e6ff794c6cc0f75493d55742844aa
Opcode Fuzzy Hash: 1c6b2c5cffc96e1f2faa13328d5cbc488b8c058bf72ff2addcdcbf0fc35252f0
Instruction Fuzzy Hash: 11719D76A0CA8281EB61BF31E6447BA63A1FB48B94F444532DE4E87794EF3CE445C348

Function 00007FF6482EBDD0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EBE4A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EBE65
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EBEE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EBF6C

Strings

Switch to %s, xrefs: 00007FF6482EBFF7
Maximum (%ld) redirects followed, xrefs: 00007FF6482EBF37
Issue another request to this URL: '%s', xrefs: 00007FF6482EBF77
Switch from POST to GET, xrefs: 00007FF6482EC036
GET, xrefs: 00007FF6482EBFDE
HEAD, xrefs: 00007FF6482EBFD7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: eedddef45915e7ee78f04db88568bb3b1bf7b9df837a40408026672cc07be263
Instruction ID: 1e895fb0cae9685f210c65b25b8d02c5813cec5618314e860c2ab75b0678fd87
Opcode Fuzzy Hash: eedddef45915e7ee78f04db88568bb3b1bf7b9df837a40408026672cc07be263
Instruction Fuzzy Hash: 0D719062A0C68380E760BB79D5403BE27E1EB85B94F5C0535DE4D8BA99CF3DD881839D

Function 00007FF6482E0F70 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E0FED
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E100A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E101E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E103A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E1057
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E107A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E108E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10C8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10DC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E10F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E113F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E114C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E1175

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 31be3772069e500a7aef819516f3faf0ac6f02a24d8bfe9d18ec5130e08255e8
Instruction ID: cf9ef304fde84d8cdf9837916d50cd62908266d4135e5c81780e2a07d5046cdc
Opcode Fuzzy Hash: 31be3772069e500a7aef819516f3faf0ac6f02a24d8bfe9d18ec5130e08255e8
Instruction Fuzzy Hash: 0D51D672A0DA8291EB14BF71D9902FE23A0FF84F95F0C4031DE4E8B655CE3C948583A8

Function 00007FF64830F1F1 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F16F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F26D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F2D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F2EE

Part of subcall function 00007FF64830E240: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830E250

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F316
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F32D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F39F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F3B4

Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F4FC
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F506
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F510
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F51A
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F524
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F52E
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F538
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F542
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F54C
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F556
Part of subcall function 00007FF64830F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F560

Strings

:, xrefs: 00007FF64830F217
,, xrefs: 00007FF64830F234

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction ID: 84d778d00088087c3520cf9f8f0e6cf6cfb6282ceb764ac96fc55391a32455ed
Opcode Fuzzy Hash: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction Fuzzy Hash: A0518016E0CB8642F722BB7595102B96350FB57B88F08D230DE8D9668AEF6CF5C48304

Function 00007FF6482E1C60 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6482E1C98
strchr.VCRUNTIME140 ref: 00007FF6482E1CBF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1D74
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1DBB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1DCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1DD5
memcpy.VCRUNTIME140 ref: 00007FF6482E1DF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1E07
memcpy.VCRUNTIME140 ref: 00007FF6482E1E24
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1E39
memcpy.VCRUNTIME140 ref: 00007FF6482E1E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E1E66

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction ID: ece297c814237a490bf50649f9e08c861de9cc3671e1e99c8373874e8e8f90ca
Opcode Fuzzy Hash: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction Fuzzy Hash: 19517C25B0DB8585EA66BF35A6142BA6291FF48BC5F4C4431DE8E97B44EF3CE805834C

Function 00007FF6482E3B80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF6482E3D09

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 97b97c4f9b03deb6ba4f315342eb381be36a29c9834092b213fdfb9fd5abec28
Instruction ID: 55fdd0956b331d41e455bbc76938194ebc2fc5af6c0ac057b9610304420c6e5b
Opcode Fuzzy Hash: 97b97c4f9b03deb6ba4f315342eb381be36a29c9834092b213fdfb9fd5abec28
Instruction Fuzzy Hash: 60718D22A0CB8286EB65BB39D6583BB67A0FB85745F080035DB8D87790DF3DE854C358

Function 00007FF6482E3B29 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E3C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E3C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF6482E3D09

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 06bdd3633e5708c44053d2bde8a132e77b6d53fc0ee967ead5b8041a6449c34a
Instruction ID: 987d440260adb04ac399a3819a139442942aa10dc48cc618acc80ae4a6c45cd6
Opcode Fuzzy Hash: 06bdd3633e5708c44053d2bde8a132e77b6d53fc0ee967ead5b8041a6449c34a
Instruction Fuzzy Hash: 6D619F62A0CB8286E716BB79D5683BB6BA0FB44B45F094035CB8D87750DF3CE495C748

Function 00007FF6482E84A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6482F450A), ref: 00007FF6482E851F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6482F450A), ref: 00007FF6482E8571
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6482F450A), ref: 00007FF6482E8595
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6482F450A), ref: 00007FF6482E85E5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6482F450A), ref: 00007FF6482E8628

Strings

Digest, xrefs: 00007FF6482E84AB
%sAuthorization: Digest %s, xrefs: 00007FF6482E8605
Proxy-, xrefs: 00007FF6482E85FB
%.*s, xrefs: 00007FF6482E857E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: 991cca11e921deaf2fb3f742e1aed303678f25a5ce7169caec8dc6d57ca1d1d1
Instruction ID: cbdb35247888845a931438fb2b1831cf9e1b2b0a4e2e911187d4dbc613480740
Opcode Fuzzy Hash: 991cca11e921deaf2fb3f742e1aed303678f25a5ce7169caec8dc6d57ca1d1d1
Instruction Fuzzy Hash: 0041BF2260CB8692EA21BF21E5403AA77A0FB84B84F480035DE8D87B94DF3CD556D348

Function 00007FF6482D1E72 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
%s - %s, xrefs: 00007FF6482D2299
SEC_E_CANNOT_PACK, xrefs: 00007FF6482D1E72

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 597226f125e326fc4276559fb01c1fdade4893ea3d3427af41880d6c60d103f9
Instruction ID: f4685fca91273e51ba27f57b732c12bb18a003ad3232f0ffc102009a6ffa8009
Opcode Fuzzy Hash: 597226f125e326fc4276559fb01c1fdade4893ea3d3427af41880d6c60d103f9
Instruction Fuzzy Hash: D6316D22A0C6C185F722BB70A5143EEB7A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1E66 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
%s - %s, xrefs: 00007FF6482D2299
SEC_E_CANNOT_INSTALL, xrefs: 00007FF6482D1E66

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: da84ee425c665103f0509870f9862496ac41dbffd059b21d0e085cc4c39f0c10
Instruction ID: a2f02440209e9a328d18d555aa3e92329468062ec3604619c7583fcf7bd9719d
Opcode Fuzzy Hash: da84ee425c665103f0509870f9862496ac41dbffd059b21d0e085cc4c39f0c10
Instruction Fuzzy Hash: 05314D22A0C6C185F722BB70A5543EE77A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1E5A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
%s - %s, xrefs: 00007FF6482D2299
SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF6482D1E5A

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: d6c51fbaba7f869f43a916abab987e5ed6b2a07158bb5033ab135ee3800e9c5b
Instruction ID: b11d0e19a831c02b40548ac1e8c0c3b28e64412f2a732e6603e748792d240163
Opcode Fuzzy Hash: d6c51fbaba7f869f43a916abab987e5ed6b2a07158bb5033ab135ee3800e9c5b
Instruction Fuzzy Hash: 28316D22A0C6C185F722BB70A5143EE77A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1E4E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
%s - %s, xrefs: 00007FF6482D2299
SEC_E_BAD_PKGID, xrefs: 00007FF6482D1E4E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: f85a2a735a9d920cdfcb51d5e4cf70fc8eb07e7097d1353a9d283ee2013f9742
Instruction ID: d4a0b212cbf6ed545aebf19bfeba1ae7e91c4de3834a519a1ed79f2bb341fe14
Opcode Fuzzy Hash: f85a2a735a9d920cdfcb51d5e4cf70fc8eb07e7097d1353a9d283ee2013f9742
Instruction Fuzzy Hash: 58316D22A0C6C185F722BB70A5143EE77A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1E42 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
%s - %s, xrefs: 00007FF6482D2299
SEC_E_BAD_BINDINGS, xrefs: 00007FF6482D1E42

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: fed2a8485bd53f2b9fc33547e3bf34e68c56676f5b9d2557088d6d2309b96134
Instruction ID: e003c078ba67151cc7ae5898d273d9ccb4f8817fd87bd7990a3571066ce2e388
Opcode Fuzzy Hash: fed2a8485bd53f2b9fc33547e3bf34e68c56676f5b9d2557088d6d2309b96134
Instruction Fuzzy Hash: 45314D22A0C6C185F722BB70A5543EE77A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1E8A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
%s - %s, xrefs: 00007FF6482D2299
SEC_E_CERT_UNKNOWN, xrefs: 00007FF6482D1E8A

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: e079303a299a1b80ca10b30e1ba550ec69c8fd7568ac497db52d7815dacb691d
Instruction ID: f7e9206d7c22ee8573cb96386cc6bf83f5a1de708328931356c7754059a11ea1
Opcode Fuzzy Hash: e079303a299a1b80ca10b30e1ba550ec69c8fd7568ac497db52d7815dacb691d
Instruction Fuzzy Hash: 95316D22A0C6C185F722BB70A5143EEB7A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1E7E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
SEC_E_CERT_EXPIRED, xrefs: 00007FF6482D1E7E
%s - %s, xrefs: 00007FF6482D2299

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: 034b749fa52bb0e83432a6375c736f1c388a10f79a58ee50a6da77af21e3aa5c
Instruction ID: 72af230334434b46df51fe3385607e6fa442a06bf566fced13b4cb96ad1d3533
Opcode Fuzzy Hash: 034b749fa52bb0e83432a6375c736f1c388a10f79a58ee50a6da77af21e3aa5c
Instruction Fuzzy Hash: 7F314D22A0C6C185F722BB70A5543FE77A4FF85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482D1D8E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF6482D1DE9
strchr.VCRUNTIME140 ref: 00007FF6482D1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D22C5
GetLastError.KERNEL32 ref: 00007FF6482D22CE
SetLastError.KERNEL32 ref: 00007FF6482D22DA

Strings

%s (0x%08X), xrefs: 00007FF6482D1D95
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF6482D1D8E
%s - %s, xrefs: 00007FF6482D2299

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: d12fab4b8c6893375368121d2eff4d50167fa0c363ab1c99d00b3eb034989995
Instruction ID: ba62875fb219e78d98818e7e6dad189330cc314e29d7bb1e6014865b52f6f943
Opcode Fuzzy Hash: d12fab4b8c6893375368121d2eff4d50167fa0c363ab1c99d00b3eb034989995
Instruction Fuzzy Hash: 9E317C22A0C7C186FB22BBB0E5143EE77A4FB85740F480536EA9D82A95DF3CE544C758

Function 00007FF6482DA970 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF6482DA3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482E10B9), ref: 00007FF6482DA993
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA9E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA9F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DA9FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DAA38

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction ID: d244c2d16d58cdf680c7e57de5ee0633ed5187ca0bb87a3efcb682fa1e3e7e73
Opcode Fuzzy Hash: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction Fuzzy Hash: 2D21EC76A0DA5191DB11BF72E94456967B0FB88F94F094031DE8E83B54DE3CE885D384

Function 00007FF64831E240 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E30A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E358
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E3BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831E4F9

Part of subcall function 00007FF6483122A0: strchr.VCRUNTIME140(00000000,?,?,00007FF64831185F), ref: 00007FF6483122E6
Part of subcall function 00007FF6483122A0: strchr.VCRUNTIME140(00000000,?,?,00007FF64831185F), ref: 00007FF6483122F6
Part of subcall function 00007FF6483122A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF64831185F), ref: 00007FF648312320
Part of subcall function 00007FF6483122A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312355
Part of subcall function 00007FF6483122A0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831237A
Part of subcall function 00007FF6483122A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831239C

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831E584

Strings

Kerberos, xrefs: 00007FF64831E2D3, 00007FF64831E375
GSSAPI, xrefs: 00007FF64831E243
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF64831E403

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 765f7b10c892f1fb1e6010970bd4640316ed08fb1ae60ff5c030ea6a027f76d4
Instruction ID: 812213e85c47669d92c15532bd11b8eb3b8a3b0d1e052c49c0d9535718b5e341
Opcode Fuzzy Hash: 765f7b10c892f1fb1e6010970bd4640316ed08fb1ae60ff5c030ea6a027f76d4
Instruction Fuzzy Hash: 5EA15C72A0CB558AEB51EFB5E4402AD7BA5FB48B88F080035DE4D93B58EF39E845C744

Function 00007FF6482C73F9 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF6482C7797
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF6482C7947

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 3ff7f47f9996d535c6382d0025158cafa12b24fe735b2f180ded5116634d41eb
Instruction ID: acd30725605beba65ec152a5a2e1c98424fe4566dbfff0654b1d0294f7e1cad1
Opcode Fuzzy Hash: 3ff7f47f9996d535c6382d0025158cafa12b24fe735b2f180ded5116634d41eb
Instruction Fuzzy Hash: F9B16C6290CA8189E765BF38D64027D3B71FB16B58F644531CA5E822DADF3CE885C398

Function 00007FF6482D91B5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D91FA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D921A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D926B

Part of subcall function 00007FF6482DAA80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DAA86

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9371

Strings

Added, xrefs: 00007FF6482D960D
FALSE, xrefs: 00007FF6482D934B
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 328f28ee43acbe02e3b55e4857f65d3be118cca83605d292f44299386820e1f1
Instruction ID: 16c5f06c0c2100c4f930f9cca31d0bba8b1539f792b44c3c9d435544c669c9e9
Opcode Fuzzy Hash: 328f28ee43acbe02e3b55e4857f65d3be118cca83605d292f44299386820e1f1
Instruction Fuzzy Hash: B4915721A0D79685FF72B73596443BB6BE4EF45754F480035EA8E82792DF2CE484C394

Function 00007FF6482F24B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F257C

Strings

Digest, xrefs: 00007FF6482F2614
Ignoring duplicate digest auth header., xrefs: 00007FF6482F262D
Authentication problem. Ignoring this., xrefs: 00007FF6482F26BD
Bearer, xrefs: 00007FF6482F2698
NTLM, xrefs: 00007FF6482F25AC
Negotiate, xrefs: 00007FF6482F2526
Basic, xrefs: 00007FF6482F2671

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 2edee1d6d6b9369a94ec35f2711a8e3ce3417dfda42f4832661bacb91708de52
Instruction ID: d255afe2443378d0b2cd8aea3480e7dbd825a6e336b05902ae109feefea1e689
Opcode Fuzzy Hash: 2edee1d6d6b9369a94ec35f2711a8e3ce3417dfda42f4832661bacb91708de52
Instruction Fuzzy Hash: 25712B6190C28256FB19BB3296502BB7AC2EF22785F484034DF5ACB6C2DF3CE454D798

Function 00007FF6482D92C3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D92C6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9371

Strings

__Host-, xrefs: 00007FF6482D92FD
Added, xrefs: 00007FF6482D960D
__Secure-, xrefs: 00007FF6482D92E0
FALSE, xrefs: 00007FF6482D934B
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 8bdde5ae7f6a45b5a7f26c8991cb0c6dd01dc0cbdf0c72bd889af76c7a23e672
Instruction ID: 0f5ddbaf3a9ee78efb71441cd64edefe9a29dc97f8fcf5896f7146320d01f979
Opcode Fuzzy Hash: 8bdde5ae7f6a45b5a7f26c8991cb0c6dd01dc0cbdf0c72bd889af76c7a23e672
Instruction Fuzzy Hash: 41714261A0D79645FF72BB35E2443BB6BD0EF45754F084036EA8E86692DF2CE484C398

Function 00007FF6482E3FF0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E40CC
strchr.VCRUNTIME140 ref: 00007FF6482E4100
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6482E4120
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E41A4

Strings

anonymous, xrefs: 00007FF6482E4000
%s%s%s, xrefs: 00007FF6482E408F
Connecting to port: %d, xrefs: 00007FF6482E41C0
Connecting to hostname: %s, xrefs: 00007FF6482E417B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: ae296eaaf9617ce67e340360966fd7ce56b0ec3a65961541972d05b3815a59bf
Instruction ID: a24986534fd37c027d53475e8a81f7ae37bd902441bf9a5a7e7d11dce131eb1f
Opcode Fuzzy Hash: ae296eaaf9617ce67e340360966fd7ce56b0ec3a65961541972d05b3815a59bf
Instruction Fuzzy Hash: FC51B522A0CED294EA21BB75E9403BA2790FB41B94F484135DE9D8BB85CF3DD545C388

Function 00007FF6482D4067 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

FLUSH, xrefs: 00007FF6482D40F3
SESS, xrefs: 00007FF6482D40B3
Set-Cookie:, xrefs: 00007FF6482D4188
RELOAD, xrefs: 00007FF6482D4115
ALL, xrefs: 00007FF6482D4073

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 9b66fc2e34baff06f096cbca24ff7e3129ac13fcb66a14bdd11d473ac3b2e9fc
Instruction ID: c9a1af1e86d54557ddd882f12d63850abdea062608e09e01a17b85ebc4228987
Opcode Fuzzy Hash: 9b66fc2e34baff06f096cbca24ff7e3129ac13fcb66a14bdd11d473ac3b2e9fc
Instruction Fuzzy Hash: D4415F20B0CA4251F924BB359B512BB56D5AF94BC0F585031DE0EC7792DF3DE89593C8

Function 00007FF648306371 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF648306383
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830639E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6483063CA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483063EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483064CC

Strings

Wildcard - Parsing started, xrefs: 00007FF648306467

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 7821651418ac284b7fe37018b700e1dd8bffd1ee22ba97486258aa5e4425af75
Instruction ID: 49c2af9a933ff7490e9df7f99359da7daff6972964e659854692e39340020eb7
Opcode Fuzzy Hash: 7821651418ac284b7fe37018b700e1dd8bffd1ee22ba97486258aa5e4425af75
Instruction Fuzzy Hash: AC515C32A0CB82C5EB16FFA5E4541B826A5EB86B90F494035CA4E9B358EF3CE455D314

Function 00007FF648316A9C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648316AC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
FALSE, xrefs: 00007FF648316AB8
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: 595424baaf0bc46a46dd7db77f120e4f57f80110cac3368c3dfe95d5b267a38e
Instruction ID: b03ca0da4b87b43b80f6544886201516d044c857720175de73d3d36ae312a6de
Opcode Fuzzy Hash: 595424baaf0bc46a46dd7db77f120e4f57f80110cac3368c3dfe95d5b267a38e
Instruction Fuzzy Hash: DF419166A0D78244EB12BBB594442FA6BA1BF05B88F4C0835DE4E8B756DF3CE544C348

Function 00007FF64830F4F0 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F4FC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F506
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F510
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F51A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F524
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F52E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F538
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F542
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F54C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F556
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64830E522,?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830F560

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction ID: 4b9fb510bfa796e5bb75cdfad6962af2b5e3d4725d7085030afd52848dcff34b
Opcode Fuzzy Hash: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction Fuzzy Hash: 4901B2A6A18901D2EB15BFB6EC940382330FF88F59B181031CE4E86624DE3CDC99D348

Function 00007FF64831A500 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF64831A5A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831A5B9
memcpy.VCRUNTIME140 ref: 00007FF64831A6F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831A754
memcpy.VCRUNTIME140 ref: 00007FF64831A771

Strings

cached response data too big to handle, xrefs: 00007FF64831A7F1
response reading failed, xrefs: 00007FF64831A791
Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF64831A6D1
8, xrefs: 00007FF64831A7A3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: ac4d52a539b15f27428fc5d89cc48acd8341c1d8d3da493b39954d9423c2a7b7
Instruction ID: 7996c2c2530dd46fc4205dd3a6d251343818c368772dd221c15a509025b96337
Opcode Fuzzy Hash: ac4d52a539b15f27428fc5d89cc48acd8341c1d8d3da493b39954d9423c2a7b7
Instruction Fuzzy Hash: FC81C362A0CB8285DA55FBB6E5403AA2BA0FB45B85F484531DF8E87B41DF3CE5E1C344

Function 00007FF64831794C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831798F
memcpy.VCRUNTIME140 ref: 00007FF6483179B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317A88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317BC2

Strings

Expire Date: %s, xrefs: 00007FF648317AE7
Expire Date, xrefs: 00007FF648317ACD
Public Key Algorithm, xrefs: 00007FF648317B78
Public Key Algorithm: %s, xrefs: 00007FF648317B92

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 6c311b3fbb936d4f8b460a342f698634143a57b26a858afa4ef3053f5e110cbc
Instruction ID: d1b5b3f4a2f6dc65024d6c7493a7ddb4989cea0f726ce12d7b78feca948e9a44
Opcode Fuzzy Hash: 6c311b3fbb936d4f8b460a342f698634143a57b26a858afa4ef3053f5e110cbc
Instruction Fuzzy Hash: 1161E652A0D68245EB1ABBB585141F92B92FB05B94F0C4936CE5F8B7D9DF3CE1498308

Function 00007FF648316DD6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316E0F
memcpy.VCRUNTIME140 ref: 00007FF648316E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 54122bf5e3d3342fd2a96bae5bdd9d8b9827785846c702c0f1603b4f91230c77
Instruction ID: cb20e2a12f315ef7de29e2d336f74adc90ca4ebcf5e8b6cf281b54ebdf210644
Opcode Fuzzy Hash: 54122bf5e3d3342fd2a96bae5bdd9d8b9827785846c702c0f1603b4f91230c77
Instruction Fuzzy Hash: 49610352A0D79245EF1ABBF585142B92B92BB05FC4F0C4535DE1F8B786EE3CE9498308

Function 00007FF648310E80 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF6482F44E8), ref: 00007FF648311010
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF6482F44E8), ref: 00007FF648311047
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF6482F44E8), ref: 00007FF64831106E

Strings

%sAuthorization: NTLM %s, xrefs: 00007FF648311028, 00007FF6483110D4
Proxy-, xrefs: 00007FF64831101E, 00007FF6483110CA
NTLM, xrefs: 00007FF648310E86
HTTP, xrefs: 00007FF648310E96

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: 33b6c4fc7c206a8ba251b097363a5618546007abb926c668e6bcb56dbfa46066
Instruction ID: 26d67cbc16d7db17d968569d8b381d8507d8de07841d034d009609cc3c06330e
Opcode Fuzzy Hash: 33b6c4fc7c206a8ba251b097363a5618546007abb926c668e6bcb56dbfa46066
Instruction Fuzzy Hash: 5E615E32A0CB8685E7A2EFA5E8443AAB7A5FB44F84F084036DA8D87754DF3CD545C705

Function 00007FF648307B10 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482DAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DAB64

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648307C2D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648307C85
memcpy.VCRUNTIME140 ref: 00007FF648307CAA

Strings

Unable to read the CSeq header: [%s], xrefs: 00007FF648307B82
Session:, xrefs: 00007FF648307B9E
CSeq:, xrefs: 00007FF648307B2D
: %ld, xrefs: 00007FF648307B51
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF648307C3E
Got a blank Session ID, xrefs: 00007FF648307BD7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 6e76f70bd5b8103ca8f58d44c944ae791c305b292061b6a87a6ed5ada98c8c51
Instruction ID: f42e84606285aa6928ce1514e66ab575809a3427718dee90c5fc6dcef1a8e87e
Opcode Fuzzy Hash: 6e76f70bd5b8103ca8f58d44c944ae791c305b292061b6a87a6ed5ada98c8c51
Instruction Fuzzy Hash: A141D261A0CA8282EA16BBB595403FA6790EF47BC4F4C4131EA9EC73C9DF2DE405C358

Function 00007FF64831BC20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831BCB8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831BD14
strchr.VCRUNTIME140 ref: 00007FF64831BEFC
strchr.VCRUNTIME140 ref: 00007FF64831BF6A

Strings

0123456789-, xrefs: 00007FF64831BF63
<DIR>, xrefs: 00007FF64831BE40
APM0123456789:, xrefs: 00007FF64831BEF5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: b87fbd036890b47f9b0cd1bab2e43e5707946047c1b405ef22310b67469fa962
Instruction ID: 43a5b31b77fe3c66936bf45c3dbc936eb7c473c930791a4eb3694b23ee5c9fe0
Opcode Fuzzy Hash: b87fbd036890b47f9b0cd1bab2e43e5707946047c1b405ef22310b67469fa962
Instruction Fuzzy Hash: 82B14936A0CA468AEB26BF75D0503396BA0FB54F48F1C4435CA8E877A5DF78E451C784

Function 00007FF6482ED370 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482ED3CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482ED4CE
WSAIoctl.WS2_32 ref: 00007FF6482ED627
setsockopt.WS2_32 ref: 00007FF6482ED64F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482ED746

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF6482ED4E0
We are completely uploaded and fine, xrefs: 00007FF6482ED6BA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: ee81accd4b847cd42e6af56fc2334136a251d3c0f8ce0672d0cf2a3ae3100591
Instruction ID: 7fe683ec1816e9cd7f119380d4df8d3cd96c22347857328d84a3988d14cd0c4b
Opcode Fuzzy Hash: ee81accd4b847cd42e6af56fc2334136a251d3c0f8ce0672d0cf2a3ae3100591
Instruction Fuzzy Hash: 57B17F32A0DB8685EB65BF39D2443FA2390EB44B98F080135DE5D8A789DF3CA495C758

Function 00007FF64830DEF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830DF37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830E0CF

Part of subcall function 00007FF6482FC080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6482E340F), ref: 00007FF6482FC0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830DFCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830E10D

Strings

%s?%s, xrefs: 00007FF64830DF29
Failed sending Gopher request, xrefs: 00007FF64830E0D5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 429b144afca1d25600d0a197d5eccfa2b60d4d1d99bd5ac6cdc2e9354a3dc877
Instruction ID: 7fccdb53bc29de262f1d0769d42871568021ad6d19801bd1eb77957c40373ccd
Opcode Fuzzy Hash: 429b144afca1d25600d0a197d5eccfa2b60d4d1d99bd5ac6cdc2e9354a3dc877
Instruction Fuzzy Hash: 8C51A861B0CA4282F612BBB6A8401BA6390FF46BE4F584331DE5DC7BD9DE3CD5428748

Function 00007FF6482CAB70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CC333

Strings

value, xrefs: 00007FF6482CC1D8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 8139019e80c5ec88f17aeb8915c878c5d1d47a621de3c7b0d0edb2625798ab54
Instruction ID: 073e9445faca289882d0146b07afafa6747889605c04cb031fedf2a61bb151ac
Opcode Fuzzy Hash: 8139019e80c5ec88f17aeb8915c878c5d1d47a621de3c7b0d0edb2625798ab54
Instruction Fuzzy Hash: 1A61A222A1CA8585EB11EBB4E5443FE2361FB457A4F041331EA6D87AD9DF7CE081D344

Function 00007FF6482C94D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CA9DD
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CAA0B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6482CAA19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CAA53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CAAA4

Strings

value, xrefs: 00007FF6482CA949

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 595543e97e4f44316877afba9dfb2750bd3319d5226b2b7634a77da9004cd7a0
Instruction ID: 9ca1076868c6598e5f454c712b4d7a0c376b09244b8a1af04bae39fd3d531270
Opcode Fuzzy Hash: 595543e97e4f44316877afba9dfb2750bd3319d5226b2b7634a77da9004cd7a0
Instruction Fuzzy Hash: AB61B172A1CA8595EB11EBB4E9453FE2361EB457A4F100331EA6D82ADADF7CD0C1C344

Function 00007FF648306BC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF648306BF6
_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF648306C4B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF648306CBC
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF648306CC9
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF648306DDB

Strings

Can't open %s for writing, xrefs: 00007FF648306C5B
Can't get the size of %s, xrefs: 00007FF648306CD2

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 13e5b1f758b492002390f4d21743b9d9be13eeb5f45215b79f59d9c128932a50
Instruction ID: 6cc1764f0899d22f39d7e995b9efda5ddc166cb2c7516a84d02b548614a46a6e
Opcode Fuzzy Hash: 13e5b1f758b492002390f4d21743b9d9be13eeb5f45215b79f59d9c128932a50
Instruction Fuzzy Hash: 7351946170CB4682EA26BB75E8103FA6391FB86BD4F484435DA4ED7399EE7CE4418348

Function 00007FF64830EE30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF64830EE40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 0729c3e4434bc5675d099d01015e06993560b35443a2945d2449c0f814ce84fd
Instruction ID: 6f40a270f36352a19da882ec21c7d11396a578f7f92a5bd0178dd642802d830d
Opcode Fuzzy Hash: 0729c3e4434bc5675d099d01015e06993560b35443a2945d2449c0f814ce84fd
Instruction Fuzzy Hash: 5751CE12E0D2C245FA63BBB190143B92A91AF47B94F0C8171EE9E867C9DE3DE449D358

Function 00007FF64830EE06 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EE13
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: a8f65ed0a19ceec9d11366574aeb1cfd595ab54779fa0fea19c01c3edba6243c
Instruction ID: efdfa2b140d8b4c387e1241d81f82820a1d3912dfb187b1eaedf53088560410d
Opcode Fuzzy Hash: a8f65ed0a19ceec9d11366574aeb1cfd595ab54779fa0fea19c01c3edba6243c
Instruction Fuzzy Hash: 1941CE12E0D2C245FA23BBB1A0143B92B91AF47794F0C4171EE9E867C9DE3DE449D318

Function 00007FF648316B6E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648316B71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: bbb5a7a9f1b646046fe03c8c4798a3fb899d3ca6497a6504817b76176552b82e
Instruction ID: 4dab841f5c6f06fe8d76309849ef36ba6d18aba94995e5e71346fc4f6860ffed
Opcode Fuzzy Hash: bbb5a7a9f1b646046fe03c8c4798a3fb899d3ca6497a6504817b76176552b82e
Instruction Fuzzy Hash: 2A317E62E0D78244EB12BBF594441F92BA1BF06B88F4C0835DE0E9B756EF3CA5449348

Function 00007FF6482C1BA0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482C1D6A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C1E2D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C1E7B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C1EBB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C1F0A

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: ed39c7d1c51f3db297fe99c6e755470af78e6e1de6504059e5262683a49ffbc1
Instruction ID: e4b1542a521b92155803819df928c9faa5758b234a41bda5b0fee85b8c3fc041
Opcode Fuzzy Hash: ed39c7d1c51f3db297fe99c6e755470af78e6e1de6504059e5262683a49ffbc1
Instruction Fuzzy Hash: A9B1B022B1CB4685EB11FBB4E6013BE2361AB447A4F444631DE6C936C6DF3CE195D388

Function 00007FF648316C5D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

GMT, xrefs: 00007FF648316D0E
Serial Number: %s, xrefs: 00007FF648316F6C
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF648316D81
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 83c56e755e620055c0fa3659b43fafff221207177ab0696b05b148a0a566e44a
Instruction ID: a1407d546a1c2017250b2d323d855f2190b11bedf25f57d0b6a5384f938f24c0
Opcode Fuzzy Hash: 83c56e755e620055c0fa3659b43fafff221207177ab0696b05b148a0a566e44a
Instruction Fuzzy Hash: E261EDA2A0D69244EB12BBF199041F96FA5FB05B84F4C4436DA4D87B55EF3CE944C348

Function 00007FF648317F55 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317F98
memcpy.VCRUNTIME140 ref: 00007FF648317FBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318092
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: bb8f0aea14a187f571e5c0d63ffc4fdd4b91024d0d33eb01ebf09ce82b63cb64
Instruction ID: eb826b9f17c79a465a7b56ee06ff9f3d5b9f624c53b431239a60a5d17119e4d5
Opcode Fuzzy Hash: bb8f0aea14a187f571e5c0d63ffc4fdd4b91024d0d33eb01ebf09ce82b63cb64
Instruction Fuzzy Hash: AD514512A0D68642EE1ABBB595542BA2B91FF45FD0F0C0536CA5F87BD5DE3CE0459308

Function 00007FF6482DEEA0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DEEE6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DEF12
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482DEF3E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction ID: fe011ae8c281dc3393a9cbc62c1ec64e93cff87c0972cc583d00a03858337eb3
Opcode Fuzzy Hash: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction Fuzzy Hash: 21515E26A1EB8086EB95EF65F18012977E4FF48B84B081135EF9D43B49EF38D8A19744

Function 00007FF648316B97 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

GMT, xrefs: 00007FF648316BF6
Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF648316C49
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 718e0edb844c39f72f5a5453fececd066911b5f4b0fc70f80471252c26b35449
Instruction ID: 0c2f3e5426990904a00abaad69fb3e5aab1afa0eb68a7de5a250ba9a65532bef
Opcode Fuzzy Hash: 718e0edb844c39f72f5a5453fececd066911b5f4b0fc70f80471252c26b35449
Instruction Fuzzy Hash: CE518062A0DB8284EB12BBF594401F97BA1BB45F88F4C4435DA4D9B796EF3CE944C348

Function 00007FF648317954 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831798F
memcpy.VCRUNTIME140 ref: 00007FF6483179B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317BC2

Strings

Expire Date: %s, xrefs: 00007FF648317AE7
Expire Date, xrefs: 00007FF648317ACD
Public Key Algorithm, xrefs: 00007FF648317B78
Public Key Algorithm: %s, xrefs: 00007FF648317B92

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 2ceff9df3f33277577f0104260bbffde3566e5b22424af7c496f0e4332a6a445
Instruction ID: 5417ecaf3fc18c54da418a929f54846121bc09f1e55304371159a8d00eb31a48
Opcode Fuzzy Hash: 2ceff9df3f33277577f0104260bbffde3566e5b22424af7c496f0e4332a6a445
Instruction Fuzzy Hash: 8A41B366A0D78244EF16BBB195041F96BA2BF05BC4F4C4935CE0D8B79AEF3CE5448348

Function 00007FF6482D9990 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D99F8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 734636d28ebe92a552abe8424702d892e2a077f184f451bb8255f658a3df093b
Instruction ID: b0b06626a66628aed4026b38a6616285e3d59aa3e06f671bf0a42d6135a1710e
Opcode Fuzzy Hash: 734636d28ebe92a552abe8424702d892e2a077f184f451bb8255f658a3df093b
Instruction Fuzzy Hash: 5C0135A6619A4192DB16BF72ED940286360FF88F95B081031DD8E97B64CE3CD899D344

Function 00007FF648313F20 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482DBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DBC36
Part of subcall function 00007FF6482DBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DBC46
Part of subcall function 00007FF6482DBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DBC54
Part of subcall function 00007FF6482DBC00: memset.VCRUNTIME140 ref: 00007FF6482DBC8F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648313FE9
memcpy.VCRUNTIME140 ref: 00007FF648314004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831401E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: acd390c1a12e34a85b50b4d437532fee1f9e274726e5f98373e38d2a703eb18b
Instruction ID: ac38fc2ad5266d592a299c6c716dcff6b89799ca8f7994a3bd3b2308322c5811
Opcode Fuzzy Hash: acd390c1a12e34a85b50b4d437532fee1f9e274726e5f98373e38d2a703eb18b
Instruction Fuzzy Hash: 52915C61B0D74242EA96BEB6955037A6AD1BF45FC4F0C4034DE5DCBB85EF2CE4528348

Function 00007FF6482E8FE0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E910F

Strings

I64, xrefs: 00007FF6482E9105, 00007FF6482E916F
I32, xrefs: 00007FF6482E90E5, 00007FF6482E9145
Internal error removing splay node = %d, xrefs: 00007FF6482E8FF2

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 9e80ba9495084d9940152a93fe6650defdac990b8f6d3432b4772d1b7d51b77b
Instruction ID: d72b4764cb6cc89a64aa8f9af10f77a8c44cd5232856792fcf170a72fc659cb8
Opcode Fuzzy Hash: 9e80ba9495084d9940152a93fe6650defdac990b8f6d3432b4772d1b7d51b77b
Instruction Fuzzy Hash: DCA1C372A1C65186EB21BF34E4547BE7BA4FB49B48F494136CA8D83254DF3CD208C788

Function 00007FF6482F8EB0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F90DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F911F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F9147
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F9189

Strings

schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF6482F8F2E
schannel: ApplyControlToken failure: %s, xrefs: 00007FF6482F8FB8
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF6482F90A3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 20c94608d0b51b5192543fb49e03ba8152e3f7264e32a9afe7f9e7dcf3f4099a
Instruction ID: 4415b743128a26d3dcdacbddd04d8cafa23357d90dbcbdc4848025a943a9d9b7
Opcode Fuzzy Hash: 20c94608d0b51b5192543fb49e03ba8152e3f7264e32a9afe7f9e7dcf3f4099a
Instruction Fuzzy Hash: 3F915832608F8186EB11EF66E8906AE37A5FB88B88F440535DF4D87BA4DF38D445DB44

Function 00007FF6482D917C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9182
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9371

Strings

Added, xrefs: 00007FF6482D960D
FALSE, xrefs: 00007FF6482D934B
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 90133f61e9f3a2972452251f6a672964b389b412b9e8e14f35b27df89e8546ac
Instruction ID: e9b770c1ab426075ee5391ea7f794dd07057a275ca86f4eafbfdded117c36bb4
Opcode Fuzzy Hash: 90133f61e9f3a2972452251f6a672964b389b412b9e8e14f35b27df89e8546ac
Instruction Fuzzy Hash: 0E614561A0D79645FF72BB35A2443BB6BE4EF44754F084036EB8E82692DF2CE484C394

Function 00007FF6482D9319 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D931C

Part of subcall function 00007FF6482F76F0: strchr.VCRUNTIME140 ref: 00007FF6482F7726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9371

Strings

Added, xrefs: 00007FF6482D960D
FALSE, xrefs: 00007FF6482D934B
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 62dffb43bf084e46f221ed9f2adcc8f6b7e67df89a3940d09ae168eab1eb17b1
Instruction ID: c314aea85fc7d7c4c86f1ebfb2e547278cb34d874d8147a9d8a356aef2380d26
Opcode Fuzzy Hash: 62dffb43bf084e46f221ed9f2adcc8f6b7e67df89a3940d09ae168eab1eb17b1
Instruction Fuzzy Hash: D1614461A0D79645FF72BB35A2443BB6BE4EF44754F084035EB8E82692DF2CE484C394

Function 00007FF6482C5DD0 Relevance: 10.6, APIs: 7, Instructions: 146COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5E61
memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5EA5
memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5F42

Part of subcall function 00007FF64831F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6482C43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF64831F20A

memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5F74
memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5F8F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482C5FAC

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction ID: bd5e7890c8919c11c38df9ccf93baa6cdc81f265db25ac676753e34f75b53d24
Opcode Fuzzy Hash: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction Fuzzy Hash: 46519C32A08B8682EA09FF3596042BA2365FB15BD4F544A31DE6D573D2CF78E195C388

Function 00007FF6483002C0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830030A
memcpy.VCRUNTIME140 ref: 00007FF648300421
memcpy.VCRUNTIME140 ref: 00007FF648300492
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483004BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483004D0

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF648300320

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 983475b5252fee3b519ee8893d5ff2ec22a28cab796edf3ac853c7e78d6e9305
Instruction ID: 2033746f98b2c16d4761099812df1155168d7ff7710203f66fdece126e9cc752
Opcode Fuzzy Hash: 983475b5252fee3b519ee8893d5ff2ec22a28cab796edf3ac853c7e78d6e9305
Instruction Fuzzy Hash: C251AD6261878196EA26BBB5A5106EAB7A0FB0A788F480035CF8D87755CF3CE154C708

Function 00007FF648303400 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF6483034C3

Strings

RETR response: %03d, xrefs: 00007FF648303458
bytes, xrefs: 00007FF6483034B9
Getting file with size: %I64d, xrefs: 00007FF648303575
Maxdownload = %I64d, xrefs: 00007FF64830355C, 00007FF6483035FB
, xrefs: 00007FF648303467
Data conn was not available immediately, xrefs: 00007FF6483035B7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 6e3d0a3c5aa691337795dccfca836fcde4962f08d3d7d525d14d9e7aa75dc6f1
Instruction ID: f0b8a94ec6b616ddadf883224858e755802d0d6a782717daf892e6f1435af064
Opcode Fuzzy Hash: 6e3d0a3c5aa691337795dccfca836fcde4962f08d3d7d525d14d9e7aa75dc6f1
Instruction Fuzzy Hash: 2951F762A0D78642FB26F7BDA4442B96390EB47774F4C0231DE9D866D9DF7CE4828704

Function 00007FF648317DCB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

GMT, xrefs: 00007FF648317E7E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF648317EEF
Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: 486b11a5dbf6f6220d0470a4a60f1b5c1fbc44e62c4a92e0fa326115e51303ef
Instruction ID: 2120bd5d104351a192627e347cb57f81adbb427339ffb0b41ad031f41ee8d131
Opcode Fuzzy Hash: 486b11a5dbf6f6220d0470a4a60f1b5c1fbc44e62c4a92e0fa326115e51303ef
Instruction Fuzzy Hash: C051C462A0C6C685EA12BBB5A4441F9BBA4FB45F84F5C0432DA8D83759CF3CE945C348

Function 00007FF6483031D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF648303376

Part of subcall function 00007FF64831A500: memcpy.VCRUNTIME140 ref: 00007FF64831A5A8
Part of subcall function 00007FF64831A500: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831A5B9

Strings

QUOT string not accepted: %s, xrefs: 00007FF64830339F
FTP response aborted due to select/poll error: %d, xrefs: 00007FF648303384
We got a 421 - timeout!, xrefs: 00007FF6483033B5
FTP response timeout, xrefs: 00007FF6483033E3
*, xrefs: 00007FF648303344

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 7f1b63b8f03d3fdbfa67beb3f169362ae6ab96c88611e78a276ff859e2cc5821
Instruction ID: 8f79d21100aa0cf7e32369eaf762b8b8e39b0f60356f65c3e9a36753c3f89f49
Opcode Fuzzy Hash: 7f1b63b8f03d3fdbfa67beb3f169362ae6ab96c88611e78a276ff859e2cc5821
Instruction Fuzzy Hash: 1D518F21B0C68285FF66BAB9D6407FA1290BF47B94F488179DE4DC72D9EE2CE4458348

Function 00007FF6482E8420 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312144
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831216A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312178

Strings

Digest, xrefs: 00007FF6482E8448
stale, xrefs: 00007FF6483120CF
true, xrefs: 00007FF6483120E4

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 29f2d144675f23a553318cadf2dbd3e2c172a0bf61d37d97765e181fdbbf1ba6
Instruction ID: 107a5dd33e28c422864cb1d43904f95a31d4809c8bf9c8f9b4c655a19717e247
Opcode Fuzzy Hash: 29f2d144675f23a553318cadf2dbd3e2c172a0bf61d37d97765e181fdbbf1ba6
Instruction Fuzzy Hash: 09517F22A0CA8292EB22FB71E9503B977A0FF45F84F484131EA9D876C1DF2CE555C748

Function 00007FF64830BFB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF64830C010
memcpy.VCRUNTIME140 ref: 00007FF64830C036
memchr.VCRUNTIME140 ref: 00007FF64830C133

Strings

Received too short packet, xrefs: 00007FF64830C062
Internal error: Unexpected packet, xrefs: 00007FF64830C0D8
TFTP error: %s, xrefs: 00007FF64830C150

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: b5abf7ddbc41a4e4313125dd5a2000d1c180a3dd02d87012433adc899920b445
Instruction ID: b44c6a2e7af767b0f91a4e29076503471f9a94984e4e7ed23ff5691ac91187f0
Opcode Fuzzy Hash: b5abf7ddbc41a4e4313125dd5a2000d1c180a3dd02d87012433adc899920b445
Instruction Fuzzy Hash: C051CF72A0C68285EB6ABB75D5103BA6390FB46B85F084132DE4EC7789DE3CE446CB44

Function 00007FF6482C2370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482C6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6482C23CB), ref: 00007FF6482C6E4E
Part of subcall function 00007FF6482C6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6482C23CB), ref: 00007FF6482C6E5C
Part of subcall function 00007FF6482C6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6482C23CB), ref: 00007FF6482C6E72

Part of subcall function 00007FF6482C3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C3BF6

Part of subcall function 00007FF6482C5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF6482C1DBA), ref: 00007FF6482C5E61

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2469
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C24A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C24F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C2544

Strings

at line , xrefs: 00007FF6482C23BC
, column , xrefs: 00007FF6482C23F9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: 57100d119804690e628be863f834d55bd5b6b334a7ff37d4b486aad42ae39a7f
Instruction ID: eb0e0c25ac4189ab179579308efcc48cc277e0b656aa752216a57a6ec5e32833
Opcode Fuzzy Hash: 57100d119804690e628be863f834d55bd5b6b334a7ff37d4b486aad42ae39a7f
Instruction Fuzzy Hash: 7F517E62F08A8586FB15EBB4E5443AD3321EB44BE8F005225DE6D53ADADE38D485D388

Function 00007FF6482C4A00 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4A93
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4AE7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4B0E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4B36
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4B83
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF6482C314B,?,?,?,00007FF6482C3104), ref: 00007FF6482C4B90

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction ID: d9f1f1da05368b7e9e10371e09c20cd051e955d4707c95deaae89cff443cd9b6
Opcode Fuzzy Hash: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction Fuzzy Hash: CD51573260CE4181EB21AB69D69037AABA0FB85F95F15C631CE5E837A5CF3DD446834C

Function 00007FF648310B30 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6482F44C6), ref: 00007FF648310C8D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6482F44C6), ref: 00007FF648310CA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648310CB5

Strings

%sAuthorization: Negotiate %s, xrefs: 00007FF648310C6E
Proxy-, xrefs: 00007FF648310C5D
Negotiate, xrefs: 00007FF648310B36, 00007FF648310C12
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF648310BE1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: 41c08fb2ae54d73b9aad3b1fb28f7d5162b95befd8a93294c5f9c0ba9144d006
Instruction ID: 453a0d98f210678aabcca32fe91dd2ef0856a5457e009cd58b56eace2defe4bf
Opcode Fuzzy Hash: 41c08fb2ae54d73b9aad3b1fb28f7d5162b95befd8a93294c5f9c0ba9144d006
Instruction Fuzzy Hash: 6F51C072A0C69296FB12FBB5D4A02B92B90FB40B94F4C4032DA8DC7685DF3DE455C758

Function 00007FF64830EE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 995a1957d159ea99697b42c3a6b6bf0ff12af625b36380b0b66350f6ea9b707c
Instruction ID: a69b1c529f0594af6a3851d6512f39db17246b827f383944fa132b1d515b4a1a
Opcode Fuzzy Hash: 995a1957d159ea99697b42c3a6b6bf0ff12af625b36380b0b66350f6ea9b707c
Instruction Fuzzy Hash: 4141DC12E0D2C245FA63BBB1A0103B92A91AF47794F0C8171EEDE867C9DE3DE409D318

Function 00007FF64830EE77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: ca10f7099a8e11b7cfc61e554ba5e926ab0c0bb5474b4376fd2f4e3479e7f3e1
Instruction ID: b6e95b6378dead30ea97acd138426e489d59658e3e7f530cebf3707c0a15b999
Opcode Fuzzy Hash: ca10f7099a8e11b7cfc61e554ba5e926ab0c0bb5474b4376fd2f4e3479e7f3e1
Instruction Fuzzy Hash: B841DD12E0E2D245FA63BBB1A0143B92A91AF47794F0C8171EE9E867C9DE3DE445D318

Function 00007FF64830EDF8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 83e1fb0100f905c57ab9f068d43ff6605369474d9e078fffc21d34a0778c98eb
Instruction ID: 4c43c8faaf4d1b64864f9f01e92bcd83674cdef87dbbb5d07d7db7ed73266a71
Opcode Fuzzy Hash: 83e1fb0100f905c57ab9f068d43ff6605369474d9e078fffc21d34a0778c98eb
Instruction Fuzzy Hash: 9F41EE12E0D2D245FA23BBB1A0143B92A919F07794F0C8171EE9E877C9DE3DE405D318

Function 00007FF64830EE22 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 4ce7970afd5a9239f65debad424b97acd0ba8e2cc2fc0e723198cdc55f5ca029
Instruction ID: 49f7f06848c226551d5ac353adc3d01969ef24dca6df303ce1aff774d4323f64
Opcode Fuzzy Hash: 4ce7970afd5a9239f65debad424b97acd0ba8e2cc2fc0e723198cdc55f5ca029
Instruction Fuzzy Hash: 3E41CE12E0E2D245FA63BBB1A0143B92A919F47794F0C8171EE9E877C9DE3DE445D318

Function 00007FF64830EDDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: e40c05a633061906cd65db25f240a886dccca3a985eefeb9232968f34b6f1054
Instruction ID: bc5e8a1ab977de608ed8cdae65b9e65d3e52094c5808aa87770b32d3a0b8ec14
Opcode Fuzzy Hash: e40c05a633061906cd65db25f240a886dccca3a985eefeb9232968f34b6f1054
Instruction Fuzzy Hash: E341EE12E0D2D245FA23BBB1A0143B92A919F07794F0C8171EE9E877C9DE3DE405D318

Function 00007FF64830EDEA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 9d88bebb43b2fbc7647fe023011e1ba91fe3620b1f9d8eca84b5e207088da114
Instruction ID: 0bde46b34906986a1ff09e0764477e00b535f67d49fb56b4b4552be128a78e59
Opcode Fuzzy Hash: 9d88bebb43b2fbc7647fe023011e1ba91fe3620b1f9d8eca84b5e207088da114
Instruction Fuzzy Hash: F941CE12E0D2D245FA63BBB1A0143B92A91AF47794F0D8171EE9E877C9DE3DE405D318

Function 00007FF64830EEAD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830F0FB

Strings

%%%02x, xrefs: 00007FF64830EFA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: a37f3f224fc798ce1b298b1525752757f579e6cf70c552f4d4f4674165861193
Instruction ID: c5f825afaa798550d443fc8a6ff4d4e4206c2c89cd8209dec97a62e2196f2391
Opcode Fuzzy Hash: a37f3f224fc798ce1b298b1525752757f579e6cf70c552f4d4f4674165861193
Instruction Fuzzy Hash: D141CE12E0D2D245FA63BBB1A0143B92A919F47794F0C8171EE9E877C9DE3DE445D318

Function 00007FF64830CB00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF64830CB18
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF64830CC81

Strings

Connection time-out, xrefs: 00007FF64830CB3B
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF64830CC5C
gfff, xrefs: 00007FF64830CB8C
gfff, xrefs: 00007FF64830CBF8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 5603a38b167ad5d39fbdc1c17dec4cf10488a2e3eb711140c002149bca51ea0d
Instruction ID: fc8172a4cfcc2e48a22461ca7124143a3f60b6886974b7f9f38cc9967689a7f4
Opcode Fuzzy Hash: 5603a38b167ad5d39fbdc1c17dec4cf10488a2e3eb711140c002149bca51ea0d
Instruction Fuzzy Hash: CE411872B2861986DB20EF7AE04066833A0F789F88F545031DE0CC7788DE3DE542CB44

Function 00007FF6482F3F90 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6482F4076
strchr.VCRUNTIME140 ref: 00007FF6482F4089
strchr.VCRUNTIME140 ref: 00007FF6482F409B

Strings

Expect: 100-continue, xrefs: 00007FF6482F40F8
Expect:, xrefs: 00007FF6482F401E
Expect, xrefs: 00007FF6482F3FF7
100-continue, xrefs: 00007FF6482F40B6

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 066994a40ad3c2aec7f29a05448feede43c7ce5909703161cc52556192049a5a
Instruction ID: c245f839cd80ea5f5d8f845f94ddfb38ca27680063e9500a782a0bbd7ba0a7a1
Opcode Fuzzy Hash: 066994a40ad3c2aec7f29a05448feede43c7ce5909703161cc52556192049a5a
Instruction Fuzzy Hash: C5412B21B0CB8285FA55FB36A5000FA63D1EFA5B84F4C1034EB4E87786EE6DE445D788

Function 00007FF6482EC360 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482EC4AA

Strings

Cannot rewind mime/post data, xrefs: 00007FF6482EC4E0
seek callback returned error %d, xrefs: 00007FF6482EC3FE
necessary data rewind wasn't possible, xrefs: 00007FF6482EC4B5
ioctl callback returned error %d, xrefs: 00007FF6482EC46F
the ioctl callback returned %d, xrefs: 00007FF6482EC455

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 636c29a6ac46b64cd287b79ad26834ec061afeb8b3ebe0566f26f826e7c36bbb
Instruction ID: f0aca3bdc637d4d0afcc72d235181e21e23c60833ac66070fb26255d9073b231
Opcode Fuzzy Hash: 636c29a6ac46b64cd287b79ad26834ec061afeb8b3ebe0566f26f826e7c36bbb
Instruction Fuzzy Hash: 15419566A1C68242FB55BF7A95453FA1391EF84B94F4C2031DE0D8B799DE3DE480878C

Function 00007FF648317D0E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

GMT, xrefs: 00007FF648317D64
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF648317DA4
Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 2d839c62f561e1cb6da38a300fc64ca3975719bf1c477f748898bce26a61f6bd
Instruction ID: 748ff2b27540da4a7ecf0702033d760068ce8df97bfa3b61ca2459c0e4f8a031
Opcode Fuzzy Hash: 2d839c62f561e1cb6da38a300fc64ca3975719bf1c477f748898bce26a61f6bd
Instruction Fuzzy Hash: BF41A122A0CA8691EB12BBB5E4401FAB7A1FB45B84F5C0432DA4D8775ADF3CE545C348

Function 00007FF648316AD1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

%s%lx, xrefs: 00007FF648316B26
Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 43aff7a05e90a007a98c231397dc463d57d0ef91e1f3fe74e4c719b20d4e5bc1
Instruction ID: 88b197e12183e077a90e9286c9ba09e8830870b676eb254e279e7d9878350220
Opcode Fuzzy Hash: 43aff7a05e90a007a98c231397dc463d57d0ef91e1f3fe74e4c719b20d4e5bc1
Instruction Fuzzy Hash: AD416D52A1D78245EE12BBF694441F96BA1AF06B88F4C4835DE0E8B786EF3CE5449348

Function 00007FF6482FFE10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FFE4D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FFEBE

Strings

., xrefs: 00007FF6482FFEB7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: f91b2f7d14dfdf7098ab5232583014ba284079e117e41f318c1d2d3077799d1f
Instruction ID: 59356af1e48e7cc441f19367f394b16ce848d7bb37b74b5525102a8406de4a8b
Opcode Fuzzy Hash: f91b2f7d14dfdf7098ab5232583014ba284079e117e41f318c1d2d3077799d1f
Instruction Fuzzy Hash: 1E41B122A0CB8682E721FB31AA4027A7292FB59B90F584131EF0D876D5DF3CE441D788

Function 00007FF648316DDE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316E0F
memcpy.VCRUNTIME140 ref: 00007FF648316E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: d8f8e0a4a0e375cd5f204021ae47b3fac140e17fff0a1bf2cfc304c0a5c5ad0c
Instruction ID: ddeabc2b622ecba253ece4075bf28f958c12936edc8f29a82dead8687ea6e2b8
Opcode Fuzzy Hash: d8f8e0a4a0e375cd5f204021ae47b3fac140e17fff0a1bf2cfc304c0a5c5ad0c
Instruction Fuzzy Hash: 0241A262A0D78244EF16BBB595442F96BA2BF05FC8F4C4835DD0E9B756EF3CA9448308

Function 00007FF648310430 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482FBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBF68
Part of subcall function 00007FF6482FBF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBF8E
Part of subcall function 00007FF6482FBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBFAF
Part of subcall function 00007FF6482FBF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483104CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648310518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648310521

Strings

%s%s_netrc, xrefs: 00007FF6483104E4
%s%s.netrc, xrefs: 00007FF64831048F
HOME, xrefs: 00007FF648310469

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: ce33ce03b15b08335ee075b48f2ac132f7423bfbe585d713eb93ca792406d6ff
Instruction ID: 5e57346307c713ad035281f1133d21d8181924541419374521612f73f64fe87e
Opcode Fuzzy Hash: ce33ce03b15b08335ee075b48f2ac132f7423bfbe585d713eb93ca792406d6ff
Instruction Fuzzy Hash: 34319525A0CB5181EA12FBB6F8500A6B6A0BF48FD4F4C4132ED8C87B55EF3CE4459748

Function 00007FF648317F5D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317F98
memcpy.VCRUNTIME140 ref: 00007FF648317FBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: ea8e12948d5eba480ab9cceb9eaed845a41fc177baa4ac14c91b0ce5b74563bd
Instruction ID: cb16d6a937db31a143045c1c119af2782943ceb2746b266b0dbc877adcbb67f2
Opcode Fuzzy Hash: ea8e12948d5eba480ab9cceb9eaed845a41fc177baa4ac14c91b0ce5b74563bd
Instruction Fuzzy Hash: D231E262B0DB8241EE12BB76A5442BA6790FF85FD4F0C0432CE1D87B95EE3CE0058308

Function 00007FF6482FE936 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482DAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482DAB64

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FE974
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482FE986

Strings

Select failed, xrefs: 00007FF6482FEA18
Mailbox UIDVALIDITY has changed, xrefs: 00007FF6482FE9BE
OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF6482FE958

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 3aaf3bd9c98613ab1b966e3da1ed5605299526585c756a4ca27d5f183527908c
Instruction ID: d817c92883405aeb664d1378f5a1901bde7c8e87e5ac7a89827080de8fa9a488
Opcode Fuzzy Hash: 3aaf3bd9c98613ab1b966e3da1ed5605299526585c756a4ca27d5f183527908c
Instruction Fuzzy Hash: 30316129E0C64295EAA6BB30D2501BF2352FF64B94F944432CF4E8B655DF2CE851E3C9

Function 00007FF648317068 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831709C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Strings

TRUE, xrefs: 00007FF64831708A
FALSE, xrefs: 00007FF648317091
Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 1f487dde392c3a3120692d44dd57c5843b08388db113ca8ef60605f3459bfef1
Instruction ID: 28e0171e41cc1064d2f1ad1e640f49bb955342a206c13d15ea1617d3d1418063
Opcode Fuzzy Hash: 1f487dde392c3a3120692d44dd57c5843b08388db113ca8ef60605f3459bfef1
Instruction Fuzzy Hash: 12216262A0D7C245EB22BB75A4442FA6761FB05B98F4C4431CA4E8776ADF3CE584C349

Function 00007FF648317CE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648317CE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: e1078ee6254317aa7f302fe12d14b7c1b0a0c2898ed5fbaf491c85de4fe40530
Instruction ID: fd90949bd4f9624cf28f55ad080c43343ce8b5ea4cb7facab3d38b3fbb8b356c
Opcode Fuzzy Hash: e1078ee6254317aa7f302fe12d14b7c1b0a0c2898ed5fbaf491c85de4fe40530
Instruction Fuzzy Hash: 80218166A0CA8292EA62FBB5A4442FA63A0FF85B84F480432DE4E97715DF3CD445C748

Function 00007FF6482E5570 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E5584
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E559A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E55AE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E55C2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E55D6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E55EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E55FE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482E5612

Part of subcall function 00007FF64830E510: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E562B,?,?,00000000,00007FF6482E1073,?,?,00000000,00007FF6482E15F5), ref: 00007FF64830E525

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction ID: 13524ae43341ac2320cd8eca22c2d284d25f8a2a0a5180a9808be70f5b2adc40
Opcode Fuzzy Hash: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction Fuzzy Hash: C8113F76508F81D1D701AF75ED940EC33A4FBC9FDAB180135DE8E8FA589F38949A9214

Function 00007FF6482DF050 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF061
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF071
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF07F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF08D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF09B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E2856), ref: 00007FF6482DF0C5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction ID: 1f42abb023610388592d0b1e7b22a5d194245ad5e2af6dfda04426b88be7cbd5
Opcode Fuzzy Hash: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction Fuzzy Hash: B8019276508B01D2D705AF71E9D413C73B8FB88FA9B141125CE8E82B18CF38D8A9D344

Function 00007FF6482CEE20 Relevance: 9.3, APIs: 6, Instructions: 273COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482CEF1C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482CEF9D
memcpy.VCRUNTIME140 ref: 00007FF6482CEF2F

Part of subcall function 00007FF64831F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6482C43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF64831F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482CEFAA
memcmp.VCRUNTIME140 ref: 00007FF6482CF03D
memcmp.VCRUNTIME140 ref: 00007FF6482CF0C1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcmpmemcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 2846809682-0
Opcode ID: 69c2e6193ddaa38194f47971ac0935eb94a2df83c2e04eaa05abd7d51751e23c
Instruction ID: e3632b849aed650f7b76a492ab2548696ccc206e6abde4dfbeb40b828b54a64b
Opcode Fuzzy Hash: 69c2e6193ddaa38194f47971ac0935eb94a2df83c2e04eaa05abd7d51751e23c
Instruction Fuzzy Hash: 3CA1E122A0CA8586EA14BF25D6442BA67A0FB48FD4F584531DFAD877C6DF7CD091C348

Function 00007FF6482E2120 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6482E299B), ref: 00007FF6482E2137
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6482E299B), ref: 00007FF6482E2168

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: c13eb664660336fd0cc8a44c18222f56f9417570d696fd593da57c98a09dd568
Instruction ID: 244da6a558c70a6abe600e2894601d7fb8f75e7fcffc6cf37152c1ea62004c5a
Opcode Fuzzy Hash: c13eb664660336fd0cc8a44c18222f56f9417570d696fd593da57c98a09dd568
Instruction Fuzzy Hash: 7E919C26609BC189E755AF3895403FD37A0FB55B28F080236DFAC4B3D6CF29A5A4C725

Function 00007FF6483173DC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831741F
memcpy.VCRUNTIME140 ref: 00007FF648317445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Strings

Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: 320c2bfa95c58a3e1609ac9c22957941cfe5e410ed8167142616c93d932a3e4d
Instruction ID: 94958213c3132fdaf44c3e76297d2d3fb7470a2fecc069840afdfd436f828728
Opcode Fuzzy Hash: 320c2bfa95c58a3e1609ac9c22957941cfe5e410ed8167142616c93d932a3e4d
Instruction Fuzzy Hash: EC412851A0D2C246EF1AB7B585542B92F92EB15F94F0C4635CA2F877D9DF3CE1458308

Function 00007FF6482C4EB0 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF6482C3C25,?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C4FA3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF6482C3C25,?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C4FB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF6482C3C25,?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C4FEA
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF6482C3C25,?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C4FF4
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF6482C3C25,?,?,?,?,?,00007FF6482C1D8B), ref: 00007FF6482C5002
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482C5031

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: a0251d31b2e56c634ffd3971ee331e0c2d19140fef6248804dc9cc2118053b84
Instruction ID: 507c757135a86bf0b899adbcf92ecc646841be586586a88785b333903c04db00
Opcode Fuzzy Hash: a0251d31b2e56c634ffd3971ee331e0c2d19140fef6248804dc9cc2118053b84
Instruction Fuzzy Hash: 4541D72170DA8285EE15BB36A60427FA791BB04BE4F584631DF6D877DACF3CE0418348

Function 00007FF6483122A0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF64831185F), ref: 00007FF6483122E6
strchr.VCRUNTIME140(00000000,?,?,00007FF64831185F), ref: 00007FF6483122F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF64831185F), ref: 00007FF648312320
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648312355
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831237A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64831239C

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 701b562d305d28b033affdddbf65d7e14a7e199027673d6d929ac0e14e4089d7
Instruction ID: 921e6845db6281958462cb269202972c427d2b36a5702b6a5cb7c9ee81c70a1f
Opcode Fuzzy Hash: 701b562d305d28b033affdddbf65d7e14a7e199027673d6d929ac0e14e4089d7
Instruction Fuzzy Hash: F5318521A0DB8186EE56FF72A5502797B90EF49B90F0C5A35DE8E83795DF3CE0818348

Function 00007FF648316D9F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 2fd35b2195533c0d331094ca4293c55f542b21112d758763103316afcab7a770
Instruction ID: ba1066a3b02f70cb5de0178e87633c5577f17f452444ccc686a5a352f34edbf9
Opcode Fuzzy Hash: 2fd35b2195533c0d331094ca4293c55f542b21112d758763103316afcab7a770
Instruction Fuzzy Hash: CA419162B0D78244EB12BBB194441F96BA1BB05FC8F4C4836DE0E9B756DF3CE5448348

Function 00007FF648317C40 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

%s%lx, xrefs: 00007FF648317C9D
Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 9fc0538b7c30dbcaa3927dab1fb2c74c56b0476ae2a7839a957097e179856c7b
Instruction ID: 2a44a8c2a98468e39ec3ec44cd87b45cc1816c681ac628d0c19ae5c321557851
Opcode Fuzzy Hash: 9fc0538b7c30dbcaa3927dab1fb2c74c56b0476ae2a7839a957097e179856c7b
Instruction Fuzzy Hash: 5331A266B0C68646EE22BBB5A4442FA67A0FF45F84F5C0432DE4E87B56DE2DE044C748

Function 00007FF648316B41 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 635089f868349817a7395d826d5566bd80108ba5fabe08628d655c3201992dc9
Instruction ID: abc3fba540fafaf09ba7bd84d34300e7cbe8ab07aa7b86be1418659fc7c37e1c
Opcode Fuzzy Hash: 635089f868349817a7395d826d5566bd80108ba5fabe08628d655c3201992dc9
Instruction Fuzzy Hash: DA315E62A1D78244EB16BBF594401F96BA1BF05B88F4C4835DE0E8B796EF3CE5449348

Function 00007FF648307CD0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648307CE1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648307D4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648307D5F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction ID: ddf6922c905fef5c6489b00571ba1ecf67e693eb1b854ad8b02759a1f7b24a5c
Opcode Fuzzy Hash: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction Fuzzy Hash: BC318F32A0CB8982EB52AB74E4503BD67A0EB87B88F1C4030DE4C87799DF7ED5958704

Function 00007FF648316B7F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF648318800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: c27b730ff3cde937318ceaca94d7d2e2050f88c6b36777fabcdc2f85280fb528
Instruction ID: 05c54b5971ef2dc4e44613a99add03286ad6cfe6a32d98a54a493519486f222c
Opcode Fuzzy Hash: c27b730ff3cde937318ceaca94d7d2e2050f88c6b36777fabcdc2f85280fb528
Instruction Fuzzy Hash: 37316F62E0D78244EB12BBB594441F92BA1BF06B88F4C1835DE0E9B756EF3CE5449348

Function 00007FF648316B59 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64831A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648316F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317023

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Serial Number: %s, xrefs: 00007FF648316F6C
Signature Algorithm: %s, xrefs: 00007FF648317011
Serial Number, xrefs: 00007FF648316F52
Signature Algorithm, xrefs: 00007FF648316FF7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 228067bf5d3222deb49f6ad5301e89e894cbfdd00d5943fb9e2fc26564e16a64
Instruction ID: 2e4170f6b752e8a138523f7714eb39bfd5d73bcd076b5e44366681b913ba027b
Opcode Fuzzy Hash: 228067bf5d3222deb49f6ad5301e89e894cbfdd00d5943fb9e2fc26564e16a64
Instruction Fuzzy Hash: 07316F62A0D78244EF12BBB594441F92BA1BF06B88F4C0835DE0E9B756EF3CE5449348

Function 00007FF648305963 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830597F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483059FB

Strings

SITE NAMEFMT 1, xrefs: 00007FF6483059DC
OS/400, xrefs: 00007FF6483059C9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 8c691ee043a9838d7f606555e5d370af31043bb70f99fac059963eb7e74f2456
Instruction ID: becb7a1e76960e93f4e48128688b6129c07189ec19080e2a48712a76214aca77
Opcode Fuzzy Hash: 8c691ee043a9838d7f606555e5d370af31043bb70f99fac059963eb7e74f2456
Instruction Fuzzy Hash: 00318222A0C6C285F772BBB5E4503B92790AB47754F484031CE8DE7789DE3CE586D718

Function 00007FF6482DB070 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6482DB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6482DB0B7
CloseHandle.KERNEL32 ref: 00007FF6482DB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6482DB0E6
closesocket.WS2_32 ref: 00007FF6482DB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6482DB11D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction ID: 18f3103a53ec56d414920caec019e687010c9e9c85eac8192afef13ce9f435cd
Opcode Fuzzy Hash: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction Fuzzy Hash: 15212936608A4186E660BF62E69026A67A0FF89B91F144031CF8E83B54CF3DE8A58744

Function 00007FF6482D92A8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482F77A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F77C1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9371

Strings

Added, xrefs: 00007FF6482D960D
FALSE, xrefs: 00007FF6482D934B
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 82631bb3135a2ad10e17f086c294e470c804b6d2ccea4246878ff724b50622f8
Instruction ID: bdac4887d3ec58bd9474715522ad821f9cd9ebfacc491ecfc838fe1dfc5040f7
Opcode Fuzzy Hash: 82631bb3135a2ad10e17f086c294e470c804b6d2ccea4246878ff724b50622f8
Instruction Fuzzy Hash: 29615661A0D79645FF72BB35A2443BB6BD0EF44754F084036EB8E82692DF2CE884C394

Function 00007FF6482D919D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482F76F0: strchr.VCRUNTIME140 ref: 00007FF6482F7726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D9371

Strings

Added, xrefs: 00007FF6482D960D
FALSE, xrefs: 00007FF6482D934B
Replaced, xrefs: 00007FF6482D9601
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF6482D9617

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: c2ab3cbf1cffc3fc9e4ce8172e99c2bf4d11b967c886fdd51e25c4ea2097fbec
Instruction ID: be90b25293b3316e7a24ccea7ccae1d2c47aed30d78456145ded779c77935c9f
Opcode Fuzzy Hash: c2ab3cbf1cffc3fc9e4ce8172e99c2bf4d11b967c886fdd51e25c4ea2097fbec
Instruction Fuzzy Hash: 41615461A0D79645FF72BB35A2443BB6BE4EF44754F094036EB8E82692DF2CE484C394

Function 00007FF6482F21A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F23AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482F23C5

Strings

Forcing HTTP/1.1 for NTLM, xrefs: 00007FF6482F2269
The requested URL returned error: %d, xrefs: 00007FF6482F234E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 0e0eaa027d3d22a4a8d4ec68c5691ab6803c475b566300ff1cb4639a436c852e
Instruction ID: 914f3ef83091a8f1dadd87b25b319d6e6fe20ae373aace080fe7dbf355ab7ee0
Opcode Fuzzy Hash: 0e0eaa027d3d22a4a8d4ec68c5691ab6803c475b566300ff1cb4639a436c852e
Instruction Fuzzy Hash: F951A671A0C6C281FB65BA3492503FF3792EB62B54F480136DB5DC6685CF2CE850E799

Function 00007FF64830F580 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F5F8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F62A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F69A

Part of subcall function 00007FF6482F7900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF6482DA92A,?,?,?,?,?,?,?,00007FF6482DA6F7), ref: 00007FF6482F7911

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64830F715

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF64830F5EE

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 843ade515a0bd07329736349e60a03f950eedd840701748e77495a0b5ca17848
Instruction ID: dae62119fc5905a81990e6597b419445372045cbc5e23ea4f935e72f87a4ecc1
Opcode Fuzzy Hash: 843ade515a0bd07329736349e60a03f950eedd840701748e77495a0b5ca17848
Instruction Fuzzy Hash: A041E412E0CAC955EB62BBB495103B93790EB07B94F4C9131EE8D876CADF2CE845C705

Function 00007FF6482EEF50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EEFBA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EF02B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6482EF08B

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00007FF6482EF0B2
:%u, xrefs: 00007FF6482EEFCE, 00007FF6482EF034

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: bbf1937340bcc8fdbdd27b3c25f67e9248a7e582816edac00452e4dfd5f9c886
Instruction ID: 8f98e9a40b022c7751311e5e0e43e05e2bfcd6f6fd8d812d23b2a87ef0b61be5
Opcode Fuzzy Hash: bbf1937340bcc8fdbdd27b3c25f67e9248a7e582816edac00452e4dfd5f9c886
Instruction Fuzzy Hash: 8941C262A1C68295EB61FB35E5403BA67A0FB85B88F484231EE4D877D9DF3CE505C348

Function 00007FF6482C4310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4341
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C4406
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF6482C445A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482C4461

Part of subcall function 00007FF64831F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6482C43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF64831F20A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF6482C4312

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 060c81ddfd111417c5091a61c3a1e0148c2aa5dfc69f83c4e14a55458c154890
Instruction ID: fd88966a38752207f70cb712a8df38a83a3d520f3bdbd393b99a836bb678df78
Opcode Fuzzy Hash: 060c81ddfd111417c5091a61c3a1e0148c2aa5dfc69f83c4e14a55458c154890
Instruction Fuzzy Hash: 7331E522B0DA8544FE19FB75964427A1241AB44FF4F680630DE3D47BDADE7CE4828388

Function 00007FF648306A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482FC080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6482E340F), ref: 00007FF6482FC0AE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF648306ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648306B1B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF648306B32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648306B4B

Strings

Couldn't open file %s, xrefs: 00007FF648306AF9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: f3f8fc9c30668e38bf7e1b4fc36f559d2a38759315c738994b48983c7e84d7f3
Instruction ID: ca997fa48c5b7f87a89085efc89e3d6fb8701272ee6e8f5a5c895e369d82b775
Opcode Fuzzy Hash: f3f8fc9c30668e38bf7e1b4fc36f559d2a38759315c738994b48983c7e84d7f3
Instruction Fuzzy Hash: 3F418161A0CB8581EB16BF75E40026AB7A1FB46B94F188131DA9D8769CEF7CE4418704

Function 00007FF6482E5D80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482E5DFE

Part of subcall function 00007FF6482D2500: GetLastError.KERNEL32 ref: 00007FF6482D2522
Part of subcall function 00007FF6482D2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482D252A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5E1C
recv.WS2_32 ref: 00007FF6482E5E47
WSAGetLastError.WS2_32 ref: 00007FF6482E5E59

Strings

Recv failure: %s, xrefs: 00007FF6482E5E85

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: 76a45e13e4a53d45da3cc6b1da66ccd2384b2d5048a0601096faee186a3d44d2
Instruction ID: 3b82a5e2b59132e862fb11d1161d4c5840961fda95061e4d8cae04e309b058be
Opcode Fuzzy Hash: 76a45e13e4a53d45da3cc6b1da66ccd2384b2d5048a0601096faee186a3d44d2
Instruction Fuzzy Hash: EB31BF72A19B4281EB11BF75EA413BA2360BB48FD8F984135DE1D87784DE3CD456C388

Function 00007FF6482EA510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EA599
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482EA62F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482EA657

Strings

identity, xrefs: 00007FF6482EA553, 00007FF6482EA5C3, 00007FF6482EA628
Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF6482EA645

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: df79667446998cfa9fe32aac958eaa7bfc2909eaa380d159321fe0720fedef74
Instruction ID: 13ded1fa573093f3c68ae22c9971f7f124ca6d88b94f421e9a700639bb664680
Opcode Fuzzy Hash: df79667446998cfa9fe32aac958eaa7bfc2909eaa380d159321fe0720fedef74
Instruction Fuzzy Hash: 5A41B021E0DA4291EF12BF35A640379A760EF65FE4F495231CE2E87784EF2CD5818348

Function 00007FF648319459 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319480
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483199AE

Strings

FALSE, xrefs: 00007FF648319475

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: e075efb9f471538cf5fea25a544e13b80d27f3e372c79109e91b7771380f9fd1
Instruction ID: 8e81fff4f015ca7e35232956047533a5cb8d509e46492c4218f178e30c92077d
Opcode Fuzzy Hash: e075efb9f471538cf5fea25a544e13b80d27f3e372c79109e91b7771380f9fd1
Instruction Fuzzy Hash: 0131CF22E0C59645FB13FBB895443786F959B01FA8F8C0631CE9E81AD9CF2CA582C318

Function 00007FF648300DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648300E0B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648300E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648300EB6

Strings

RCPT TO:<%s>, xrefs: 00007FF648300E9B
RCPT TO:<%s@%s>, xrefs: 00007FF648300E8D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 310991105be6317898f4caa6c789cae6c9633f0561393eaf4ed82575c1179860
Instruction ID: 4abf4fd8455c417c28e8c92c3ce71ddacb2572b32a2d187ce0c1553d75a98207
Opcode Fuzzy Hash: 310991105be6317898f4caa6c789cae6c9633f0561393eaf4ed82575c1179860
Instruction Fuzzy Hash: B031B062A1CB8181EB02FB75E4502B9A7A0FB8AB94F4C4231EA9E437D5DF7CD541C344

Function 00007FF648318D00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648318D2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483191F6

Strings

TRUE, xrefs: 00007FF648318D1B
%s: %s, xrefs: 00007FF6483191E1
FALSE, xrefs: 00007FF648318D22

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 325b3fe2c30e5458511042f25abbcc62c3653c67faaa361f4360c8e5e1acd019
Instruction ID: c43ffd320bc15ae89c37987ddbc40185dfdb0bc8438287e8b736814055d78268
Opcode Fuzzy Hash: 325b3fe2c30e5458511042f25abbcc62c3653c67faaa361f4360c8e5e1acd019
Instruction Fuzzy Hash: 7C01C452A0C78281EA63BBB6A8443F56791BB05F94F8C0431CE4E83756CE3CD1858308

Function 00007FF648314330 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF648314290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF6483142B6
Part of subcall function 00007FF648314290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF6483142D7
Part of subcall function 00007FF648314290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF6483142F2
Part of subcall function 00007FF648314290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF648314300
Part of subcall function 00007FF648314290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF648314312

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483143B6

Strings

NTLM, xrefs: 00007FF64831436E, 00007FF648314420
HTTP, xrefs: 00007FF64831433A

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 39a23f78fe25a4d256fce5b592c7a67188582c1c21e97960aec82a00448847b9
Instruction ID: 145a49bcfc75ac220576675e0525535c4d610e33443cceb19babff03be8f5db9
Opcode Fuzzy Hash: 39a23f78fe25a4d256fce5b592c7a67188582c1c21e97960aec82a00448847b9
Instruction Fuzzy Hash: 9D616A3260DB8682EB61AF65E4406AE77A5FB88B84F184435DE8D83B68DF3CD454CB44

Function 00007FF648301A3B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648301AF0

Strings

ABOR, xrefs: 00007FF648301BEB
Remembering we are in dir "%s", xrefs: 00007FF648301B88
control connection looks dead, xrefs: 00007FF648301CE2
Failure sending ABOR command: %s, xrefs: 00007FF648301C11

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 466439d91d0d7739ce5d2f9dc11d5886e8c0a76dfe12478b16c418ff8186dc87
Instruction ID: 8958a7ceadf42d1a82ecec6d90da4c27830803345a0bf9e2ab688197a69fa7f4
Opcode Fuzzy Hash: 466439d91d0d7739ce5d2f9dc11d5886e8c0a76dfe12478b16c418ff8186dc87
Instruction Fuzzy Hash: A351B762A0D68241EA66FBB491503FE6791FF43364F480235DBAD876C6DF7CE8818349

Function 00007FF648319D35 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319D78
memcpy.VCRUNTIME140 ref: 00007FF648319D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319E6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319EBF

Strings

TRUE, xrefs: 00007FF648319EC9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 2de0af5476a8bee818dfaffc51287aacab6865fda698d13ebbfacdef7cd6ec0c
Instruction ID: fc16a4297f894178b0f624c931f018ce78607586010d0589eddeb923312192a2
Opcode Fuzzy Hash: 2de0af5476a8bee818dfaffc51287aacab6865fda698d13ebbfacdef7cd6ec0c
Instruction Fuzzy Hash: 0C414562A0D69241FB0BA67589143782B92EB45FE8F484631CE6EC77C9CD6CD0958358

Function 00007FF648319049 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831908C
memcpy.VCRUNTIME140 ref: 00007FF6483190B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483191F6

Strings

%s: %s, xrefs: 00007FF6483191E1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 3c73917e9a3ff9f287237219b96bb395f56d01fc929189d139cfd492ab4b7b15
Instruction ID: df63dd3e09e1f03dd8c1510b27c46689337448d55c684f52e5960122e537a32d
Opcode Fuzzy Hash: 3c73917e9a3ff9f287237219b96bb395f56d01fc929189d139cfd492ab4b7b15
Instruction Fuzzy Hash: F041AC11A0D2D146FA2BBAB655183B55B81EB41FE4F4C4636CF6F87BC9CD2CD0859308

Function 00007FF648317253 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Strings

GMT, xrefs: 00007FF64831730E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF648317381
Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 3cc400d705c7ae2362500cf1e020bece85d41da4efc320729d18f1b821df95dc
Instruction ID: 81ae60aaa7571924bc70e3d6ca8f295cedee12a6ca09ad98f0561d66cec9cbbf
Opcode Fuzzy Hash: 3cc400d705c7ae2362500cf1e020bece85d41da4efc320729d18f1b821df95dc
Instruction Fuzzy Hash: B751E462A0D6D245EB62BBB495041F97FA5FB05B80F4C8432DA8D87B59CF3CE546C348

Function 00007FF6482FE450 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482F77A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482F77C1

memcpy.VCRUNTIME140 ref: 00007FF6482FE5C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482FE5CF

Strings

Failed to parse FETCH response., xrefs: 00007FF6482FE4AE
Found %I64d bytes to download, xrefs: 00007FF6482FE522
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF6482FE58D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 2666265653ab1ec3e10e930bd31a71e0d180f8da04622154dd8d31111f66fc27
Instruction ID: 1fdd5c25d1cc58ce0d947b6f8fb0525c22976ede6bf45173172de95016226f30
Opcode Fuzzy Hash: 2666265653ab1ec3e10e930bd31a71e0d180f8da04622154dd8d31111f66fc27
Instruction Fuzzy Hash: 1A51D066A0CBC282EA65FF75D6402FAA391FB55B94F440036DB8D87A85DF7CE001D388

Function 00007FF648317190 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Strings

GMT, xrefs: 00007FF6483171EC
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF64831723F
Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: fd687db5ce81c312168de4ee473c0d8d84d0a0caf4907a782c0026f3af3b1231
Instruction ID: c120468562fae97eb0dfa58a35668b480a321f7dd430d044bfc353ed5db23681
Opcode Fuzzy Hash: fd687db5ce81c312168de4ee473c0d8d84d0a0caf4907a782c0026f3af3b1231
Instruction Fuzzy Hash: A531A562A0D7C285EB22BBB194401F9AB51FB05F84F8C5431CA4D9B65ADF3CE545C348

Function 00007FF648317F1E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 3f3671f86eae8f62d8e3edd40d962123579afd74f946693b7929a666f81304e6
Instruction ID: 14e18ddb0aee76cfbc49b8dad3013eac5f3652ed26e8e21d608f2ce54d6b0800
Opcode Fuzzy Hash: 3f3671f86eae8f62d8e3edd40d962123579afd74f946693b7929a666f81304e6
Instruction Fuzzy Hash: A021B162B0CAC286EA11AB76E8442EA77A0FB49BD4F0C0532DE5D87795DF3CD145C708

Function 00007FF648301F90 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64830205B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302074
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302088

Strings

Failure sending QUIT command: %s, xrefs: 00007FF648301FE3
QUIT, xrefs: 00007FF648301FBF

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 9e2898ffa19f01991377d6d59213df6619a0cd1843f01d6f143049391753621f
Instruction ID: ee5ebe3d9ebe34e722c054cd7bebca0cbf9cea3ee9d73c61fff23bd8403f324f
Opcode Fuzzy Hash: 9e2898ffa19f01991377d6d59213df6619a0cd1843f01d6f143049391753621f
Instruction Fuzzy Hash: 37316B32A0C78281EB52FFB195802BA37A4FB46B88F5C4131DA4D87659CF3CE455C359

Function 00007FF6482F8B90 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E4F70), ref: 00007FF6482F8BC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E4F70), ref: 00007FF6482F8BDA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E4F70), ref: 00007FF6482F8BEF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E4F70), ref: 00007FF6482F8C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E4F70), ref: 00007FF6482F8C25
memcpy.VCRUNTIME140(?,?,?,00007FF6482E4F70), ref: 00007FF6482F8C59

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction ID: a42f8549e98dde76f298fb84d823da18317754d69ed9d857a8035804d134d796
Opcode Fuzzy Hash: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction Fuzzy Hash: D621A1B1A0D78286E715BF21991022AA7A1FB58B90F484235DF9D97794DF3CD440E744

Function 00007FF648307E00 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648307E31
strchr.VCRUNTIME140 ref: 00007FF648307E5D
strchr.VCRUNTIME140 ref: 00007FF648307E74
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648307E93

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction ID: 77847084de68f6ad72b046a4cc6293ca77e09c09e55c77eaf7a31f51eb4c1585
Opcode Fuzzy Hash: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction Fuzzy Hash: 79217472B1AB8581EB86EB75D4543A823D1EB46B94F0C0134DE0D8BB48EF3DD991C728

Function 00007FF6483173E4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831741F
memcpy.VCRUNTIME140 ref: 00007FF648317445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Strings

Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 931404bb7ef4e7a24fca340e42252142a84ad0bfd55e92b62d93b7e113a9c3aa
Instruction ID: 86d5e37156f57e22f164c1a69b84e807447f14154a6dc2f35f0570d3550885e2
Opcode Fuzzy Hash: 931404bb7ef4e7a24fca340e42252142a84ad0bfd55e92b62d93b7e113a9c3aa
Instruction Fuzzy Hash: D421D091A0D38241EE26BBB285042F56B92AF19FD4F4C4931CD1E8BBDADF3CA5448308

Function 00007FF648317CB8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: b3f9ac1a51e1cb56c8a081f84247a427091f42702f2d27fe41e35f81361af7e0
Instruction ID: 867a8217f66a9b70b78159c6be22cf5c5eb2b08e04319dd61037d23b2ccfd4bc
Opcode Fuzzy Hash: b3f9ac1a51e1cb56c8a081f84247a427091f42702f2d27fe41e35f81361af7e0
Instruction Fuzzy Hash: 8421A166A0CA8692EA52FBB5E4442FA67A0FF85B84F480432DE4E87756DF3CD041C348

Function 00007FF648317CF6 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF648318800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: bc5e897e2579d7dd63d7d746884e3d6efa0bb8b49bbbd3ec929c441a6fa49155
Instruction ID: 868324e0c634d17aacaf7033003531d073785bec57efaa975686c0840cb5b606
Opcode Fuzzy Hash: bc5e897e2579d7dd63d7d746884e3d6efa0bb8b49bbbd3ec929c441a6fa49155
Instruction Fuzzy Hash: B7219266A0CA8292EA51FBB5E4442EA77A0FF85B84F480432DE4D87715DF3CD445C748

Function 00007FF648317CD0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64831A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483180F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648318139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831814C

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Signature, xrefs: 00007FF6483180CF
Signature: %s, xrefs: 00007FF6483180E7

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 655b0211d0849ab725f3121ffe595c78da798e7ae1bc27a02535ae4aa2ae173d
Instruction ID: 6f03d90d22914e8d369857f7d0085edddead757983c255a68a9de80a6e8c1767
Opcode Fuzzy Hash: 655b0211d0849ab725f3121ffe595c78da798e7ae1bc27a02535ae4aa2ae173d
Instruction Fuzzy Hash: 77219262A0CA8292EA51FBB5E4442EA67A0FF85B84F480432DE4E87715DF3CD445C748

Function 00007FF6482DAC00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6482DB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF6482DB0B7
CloseHandle.KERNEL32 ref: 00007FF6482DB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6482DB0E6
closesocket.WS2_32 ref: 00007FF6482DB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6482DB11D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction ID: 822937addf0598773ca914e0ef924c9ea9b9f4658300d845d705c8ee21c2dd9d
Opcode Fuzzy Hash: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction Fuzzy Hash: 2E112876A08A4186E760BF62E65026A77A0FF89B91F144131DF8E83B44CF3DE4A58748

Function 00007FF6482D2C40 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6482D2579), ref: 00007FF6482D2EDF

Strings

Host not found, xrefs: 00007FF6482D2EA8
Host not found, try again, xrefs: 00007FF6482D2ED5
No data record of requested type, xrefs: 00007FF6482D2EC3
Unrecoverable error in call to nameserver, xrefs: 00007FF6482D2ECC

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: f68edcbc337550e6e0110a99c69435a7bbb63833a9b97754134fee37ae0c7940
Instruction ID: ea3913e8421c800417ceac3de161ca411566f7d7ff6bcc9a68130e06c85cb7fc
Opcode Fuzzy Hash: f68edcbc337550e6e0110a99c69435a7bbb63833a9b97754134fee37ae0c7940
Instruction Fuzzy Hash: BB11E962E0C64281FA59F778E6542BA1AE0DF05780FCC6131C61E876D5CE6CF5D0A288

Function 00007FF6483199F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319EBF

Strings

TRUE, xrefs: 00007FF648319EC9
FALSE, xrefs: 00007FF648319A10

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: 2989acc13cbc0029e913620442beb60a4be3815a991f995df501513d7eb905cf
Instruction ID: 1aa53cf0b914c3b80c096fbc2978018f70885e15c3b9d7a378cce7a977c516a4
Opcode Fuzzy Hash: 2989acc13cbc0029e913620442beb60a4be3815a991f995df501513d7eb905cf
Instruction Fuzzy Hash: 3B41B0A2B0D25684FF17BAB594143BC2B96AB04F99F8C4D32CE5DC63C8DE3CA4448318

Function 00007FF64830BA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF64830BA81
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF64830BAC0
WSAGetLastError.WS2_32 ref: 00007FF64830BB18

Strings

TFTP response timeout, xrefs: 00007FF64830BADA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: 10473459a6f06ee798478f4de3f92d5a919a90df5b71999465cf698376751473
Instruction ID: 3be4bf0cd4be05c19eb46e3bff7e7d54c40e48b78e8af2f0eb56ce9d15a26c85
Opcode Fuzzy Hash: 10473459a6f06ee798478f4de3f92d5a919a90df5b71999465cf698376751473
Instruction Fuzzy Hash: D841903260CA4286EB61BFB5D5006AA2790EB86BA4F584231DE2DC77C9DF3CD4418744

Function 00007FF64831948E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483199AE

Strings

%s%lx, xrefs: 00007FF6483194F8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: fd4fe93a63d81f1eee54e4347bacdfe35ba4eeaea70399024db6a6f81961019a
Instruction ID: 58a49b1c4bef87f21777fcba9989f8b20f72071c26f1d5fd6cf2a48942e6a6c5
Opcode Fuzzy Hash: fd4fe93a63d81f1eee54e4347bacdfe35ba4eeaea70399024db6a6f81961019a
Instruction Fuzzy Hash: C931F221E0D5A645FB13FBB895443BC6F919B11F88F9C4931CA8EC2A9ACF2DE541C308

Function 00007FF6482E5AF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C15
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C30

Strings

..., xrefs: 00007FF6482E5B82
..., xrefs: 00007FF6482E5B98

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: f5d4120396a53f35d6a0aa358773e0a09f2099a20ff6d950d28a1d81d0b1d9cf
Instruction ID: 6441beb9d4cd0a9254713a643d09fa091b9dde3fe466ce6b506dbe31e347b1aa
Opcode Fuzzy Hash: f5d4120396a53f35d6a0aa358773e0a09f2099a20ff6d950d28a1d81d0b1d9cf
Instruction Fuzzy Hash: BA31E262A1CA8681EB60FB31E6043FA6391FB84B84F444131DA5D83794CF3DE545C7C8

Function 00007FF6482F4130 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482F3B69), ref: 00007FF6482F41BD

Strings

Rejected %zu bytes header (max is %d)!, xrefs: 00007FF6482F415B
Failed to alloc memory for big header!, xrefs: 00007FF6482F41C8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 7ed45b1ac631cbcc0d59fa2633569d3d6a32ded3c26f3460a93e82a47c38fae9
Instruction ID: 22c169be3580c67a64f62f8e5dc40763594a1349a3ffb9d35c3a959843d87be2
Opcode Fuzzy Hash: 7ed45b1ac631cbcc0d59fa2633569d3d6a32ded3c26f3460a93e82a47c38fae9
Instruction Fuzzy Hash: 72217F32B08A8586EB04EB26E5402AE6761FB49FC4F484032EF4D47B59DF3CD4A2C784

Function 00007FF6482D4313 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D43A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D43BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D43DB

Strings

:, xrefs: 00007FF6482D4396

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 9185cdd294420f20cdc6d51fd5518084f5bb34101a95b3ad8653fbf82a5b9ae8
Instruction ID: 0b7d703b7c41e05aab9623928260278cbae22ab73aa1eba32080599660b06a70
Opcode Fuzzy Hash: 9185cdd294420f20cdc6d51fd5518084f5bb34101a95b3ad8653fbf82a5b9ae8
Instruction Fuzzy Hash: 91212C2260DF8685EAA5BF25E6403AA77E0EF44B94F984131CE9D83794EF3CD4548788

Function 00007FF6482FDEE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF6482FDF67
%s%s, xrefs: 00007FF6482FDF13

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 95d0198f69160efcdf6ba9fdb2b660f0347d07b19df1605e49ce1a338d018f18
Instruction ID: 6a0a87e8ad6404b7bcbddc53c23e764c86af558873aaa1e11aae0f3abafcca39
Opcode Fuzzy Hash: 95d0198f69160efcdf6ba9fdb2b660f0347d07b19df1605e49ce1a338d018f18
Instruction Fuzzy Hash: 15119D21E0C64281EA55BB65E5405BA6361EF58BC4F480132EE0D87755DF3CE941D788

Function 00007FF6482D4498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482D43A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D43BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D43DB

Strings

:, xrefs: 00007FF6482D4396

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 7e334ca8de8e4567ccf13a3d1ed7df33fb9ad007e5fdceb3d50289511dc5c3dd
Instruction ID: 016d477e142c196aa9953cbc36e63a35331e1acbc3ac7c5572cdb4f0cf14b76f
Opcode Fuzzy Hash: 7e334ca8de8e4567ccf13a3d1ed7df33fb9ad007e5fdceb3d50289511dc5c3dd
Instruction Fuzzy Hash: 6F114F2260DF8585EAA5BF24E6403AA77E0EF447A4F584131CF9C83794EF3CD4548788

Function 00007FF64830A490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF64830A4CD
WSAGetLastError.WS2_32 ref: 00007FF64830A4D7

Strings

Sending data failed (%d), xrefs: 00007FF64830A4DD
SENT, xrefs: 00007FF64830A4F2

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: b305d28b117c5390196270bb9271faa1f7ae2e309369d4ece08cc852aadb9171
Instruction ID: 838654b6b786c9d6cf44daa3b745fc1c4d67880c9f8b8f429465d83324dd447b
Opcode Fuzzy Hash: b305d28b117c5390196270bb9271faa1f7ae2e309369d4ece08cc852aadb9171
Instruction Fuzzy Hash: AE01F132708B82C1DB11ABBAE8004A97B60FB89FC4B5D5171CB4D83715DE3CE941C788

Function 00007FF648317161 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648317164
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 0e1e215d465bdb65dc11ec78cd6772c2a7b85769cfe06162245f5a7cea0827dc
Instruction ID: ef76a864f678c3b5f5bf2d4f9f820294496bdf86cf27af78a1ad2ce76518a607
Opcode Fuzzy Hash: 0e1e215d465bdb65dc11ec78cd6772c2a7b85769cfe06162245f5a7cea0827dc
Instruction Fuzzy Hash: 9501A292E0D3C241FB16BBB195441F92B92BF06F84F8C4831DA0E8A756DF3CA544835D

Function 00007FF6482F2090 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6482F20F4
strchr.VCRUNTIME140 ref: 00007FF6482F2107
strchr.VCRUNTIME140 ref: 00007FF6482F2119
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F214B
memcpy.VCRUNTIME140 ref: 00007FF6482F2175

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction ID: 4de26bbb3c1bcd5a70867a2924ddcc5183c362f470b7692201bbaebe6ccc7179
Opcode Fuzzy Hash: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction Fuzzy Hash: 8621041160D69241EE56B73253202BAA6D3DF66BC4F4C8034EF8D8B7C6EF1CE406D248

Function 00007FF648314290 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF6483142B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF6483142D7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF6483142F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF648314300
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF648310D25), ref: 00007FF648314312

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction ID: 264df51d21284f99c050e2d0c13083ac8a225eaaa5a1293a3d941bff82b82889
Opcode Fuzzy Hash: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction Fuzzy Hash: 0C119236608B4182DB05BFB5E99013C73A5FF88F88B184125CE4E87B68CF38D895C344

Function 00007FF648319BAF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319EBF

Strings

GMT, xrefs: 00007FF648319C5E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF648319CD1
TRUE, xrefs: 00007FF648319EC9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 2314223a42b02a56667362992ea725fa1a111eb4508a0bdd26f329100ff1f141
Instruction ID: d8e2f01af0a7194594ea6419a317915e67255a1a262767883a99cc2ef50e637e
Opcode Fuzzy Hash: 2314223a42b02a56667362992ea725fa1a111eb4508a0bdd26f329100ff1f141
Instruction Fuzzy Hash: 1351D4B1F0D69644EB13BBB5A5442B96FA5EB05B88F884032CE8D8275CCF3CE445C348

Function 00007FF648318EC0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483191F6

Strings

GMT, xrefs: 00007FF648318F7E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF648318FEA
%s: %s, xrefs: 00007FF6483191E1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: b6ca05796940405e3fa667ad57ad962b43d171910b5195631f7c3f8b4d476eaa
Instruction ID: 62e2920feca007fc56ce1a1965fc838d0a7974c30cdd915600987ec8fe9b85e8
Opcode Fuzzy Hash: b6ca05796940405e3fa667ad57ad962b43d171910b5195631f7c3f8b4d476eaa
Instruction Fuzzy Hash: D741D261A1C69285EA62BBB5A5042B9BBA2FB45F90F4C4031DE8D83B55CF3CE546D30C

Function 00007FF6482CD4D0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6482CD198), ref: 00007FF6482CD5AE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6482CD198), ref: 00007FF6482CD5DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6482CD198), ref: 00007FF6482CD645

Part of subcall function 00007FF64831F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6482C43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF6482C1B49), ref: 00007FF64831F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482CD652

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: f485f46759ee3c819f91b3d763993f9dcf21cbb8076185c2af80993c6419b380
Instruction ID: 7899e7e98471e58faa00bfa71cc2ba81ae1ba6fce8799a23b70e74db4c8f1ccb
Opcode Fuzzy Hash: f485f46759ee3c819f91b3d763993f9dcf21cbb8076185c2af80993c6419b380
Instruction Fuzzy Hash: D141A07270AA4585EA14FF75D2442BE6361BB48BE4F688A31DB2D837C6DF2CE051D348

Function 00007FF64831AC70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF6482FE220,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF64831ACC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831AD4C

Strings

%s, xrefs: 00007FF64831AC95

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 1a2af4c6437707a263c2e04b6871f1d6755b0c65e1c6e58b2568f2a7d7757bd0
Instruction ID: bfd23a47a209ae4c0507b7346c183e2ba9d4684c466b7ad4a7e28227c2c45878
Opcode Fuzzy Hash: 1a2af4c6437707a263c2e04b6871f1d6755b0c65e1c6e58b2568f2a7d7757bd0
Instruction Fuzzy Hash: 08418332A0CB4582E651EB36F5501AAB7A1FB45B90F084234DF8E87BA5DF3CE4958748

Function 00007FF6482C4D50 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6482C4E2F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6482C4E6C
memcpy.VCRUNTIME140 ref: 00007FF6482C4E76
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6482C4EA3

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: e60ed55956e50edfbe7ea8bb8067bec7a55e8f8f967eba0faf20a733e55885ad
Instruction ID: be9d4711cd5576323ae7649958f1d85a3f68be2fb5fcb33a837c21f7b6ff61f1
Opcode Fuzzy Hash: e60ed55956e50edfbe7ea8bb8067bec7a55e8f8f967eba0faf20a733e55885ad
Instruction Fuzzy Hash: 5831022270DB8594EE14BF76A6042BA6351AB04BE0F980734DF6D477CACF7CE0918388

Function 00007FF648319AF5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319EBF

Strings

GMT, xrefs: 00007FF648319B49
TRUE, xrefs: 00007FF648319EC9
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF648319B9B

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: cf2825dc601f22ed468ee35b6bb29dedeb88632c42a2c12affe150d9ed24460d
Instruction ID: 75c8ec98e7c759f40f088969f1fb293713867aca462d0cc76738e034e9e0889f
Opcode Fuzzy Hash: cf2825dc601f22ed468ee35b6bb29dedeb88632c42a2c12affe150d9ed24460d
Instruction Fuzzy Hash: 9531C262B0DB8584EB13ABB5D5402A97B62FB45B98F8C8432CE4D87789CF3CE555C348

Function 00007FF6483061CD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648306204

Part of subcall function 00007FF6482E5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C15
Part of subcall function 00007FF6482E5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6482E5C30

Strings

Wildcard - START of "%s", xrefs: 00007FF64830620D
Wildcard - "%s" skipped by user, xrefs: 00007FF64830626D
%s%s, xrefs: 00007FF6483061D4

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 8299427a5ad266f79722ea9ef5ffcf9a9fc35c8886571f6f63a6ff16aa18c0a4
Instruction ID: 8799540fa7f20a8f8b19c83182c302ea79c1d72c1be26212c1a60947d4b2107c
Opcode Fuzzy Hash: 8299427a5ad266f79722ea9ef5ffcf9a9fc35c8886571f6f63a6ff16aa18c0a4
Instruction Fuzzy Hash: 27414F36A0CB82C5E711FFB9D4541AD23A0EB46B85F494036DE4E9B39DEE3CD4458344

Function 00007FF648318E05 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483191F6

Strings

GMT, xrefs: 00007FF648318E59
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF648318EA9
%s: %s, xrefs: 00007FF6483191E1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: 5bf4d807dab3c4c4c80c6444e0c9514796da9ea9dd13b643f44312d4cc7cdbe3
Instruction ID: dcb3e6ce05757920ea50d8906f583cd6704976ab776a4b9ee6d1964c7447a48c
Opcode Fuzzy Hash: 5bf4d807dab3c4c4c80c6444e0c9514796da9ea9dd13b643f44312d4cc7cdbe3
Instruction Fuzzy Hash: C431B462A0CB8284E762BBB1E4446E97B91FB45B84F984431CE4D87746CF7CE545D30C

Function 00007FF648319D3D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319D78
memcpy.VCRUNTIME140 ref: 00007FF648319D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319EBF

Strings

TRUE, xrefs: 00007FF648319EC9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 1937b63237afc5f6f21e48b4429b9b86981b2e9b08ff3c4b24e74200198c31d2
Instruction ID: d621ac668b88409df7ea4d0a50eb2b36f21bbd9943a9bec40099d4c7b7f41a6e
Opcode Fuzzy Hash: 1937b63237afc5f6f21e48b4429b9b86981b2e9b08ff3c4b24e74200198c31d2
Instruction Fuzzy Hash: 7821AE66B0D74644EF07BABA9A043786B52AB44FE8F884532CD1E877D9DE7CE4818344

Function 00007FF6482E0240 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292
memcpy.VCRUNTIME140 ref: 00007FF6482E02CD

Part of subcall function 00007FF6482D5620: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D5635

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0302

Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5757
Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5763

Strings

%s:, xrefs: 00007FF6482E02AC

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 1b73f9cfeb138da4e2e179966cb669f2fdf5ab84fc2fa84ad0d24e29dda246a4
Instruction ID: 8ca97689e2a99ff14541b0daef3942241ca97a7796df4a63064bd52ff9289d3e
Opcode Fuzzy Hash: 1b73f9cfeb138da4e2e179966cb669f2fdf5ab84fc2fa84ad0d24e29dda246a4
Instruction Fuzzy Hash: C921A626A0CA8591DB01FF22EA401BB77A4FB54BE4F484132EE9D47795DF3CD4468388

Function 00007FF648319051 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831908C
memcpy.VCRUNTIME140 ref: 00007FF6483190B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483191F6

Strings

%s: %s, xrefs: 00007FF6483191E1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 6fde202d0c3394d4d3b152cbdee7f1931a83e8931206ff3ebd1cffdcec02409d
Instruction ID: 15f1f9a6278828177032120214aa9cf3ace3e7f7f5e4229bfc60e8f7897ef02a
Opcode Fuzzy Hash: 6fde202d0c3394d4d3b152cbdee7f1931a83e8931206ff3ebd1cffdcec02409d
Instruction Fuzzy Hash: BB21D151B0C78241EA67BBA6A9043B69691BB85FE4F4C4532CE1D87B89DE3CE4858308

Function 00007FF6483170AA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648317589

Strings

%s%lx, xrefs: 00007FF648317105
Start Date: %s, xrefs: 00007FF648317577
Start Date, xrefs: 00007FF64831755D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: a1b6b3256ead3aeb3d1a1e51bff87909139f67e609f50f31950d91eaa5aa90a4
Instruction ID: 8e34e2aa9321bdbb4a7e8c92cd580aeef0281b519e66557f16606fa79f7f9a63
Opcode Fuzzy Hash: a1b6b3256ead3aeb3d1a1e51bff87909139f67e609f50f31950d91eaa5aa90a4
Instruction Fuzzy Hash: 9B21C552B1D2C245EE22BBB595442F92B92AB06F84F8C5831DA0E8B786DF3DE144834C

Function 00007FF6482E92DD Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E910F

Strings

I64, xrefs: 00007FF6482E9105
I32, xrefs: 00007FF6482E90E5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 43a352a892712fe73208679e218960c350d0e5422f0842123306e9b92ba5ab5c
Instruction ID: f4c80256eee94fedc1c891c9638f246e9dd44bf40498ee01fffc88e7614621d6
Opcode Fuzzy Hash: 43a352a892712fe73208679e218960c350d0e5422f0842123306e9b92ba5ab5c
Instruction Fuzzy Hash: 3921C632A0D56246EB22BB31D5503BE7B94AB45F48F494132CB59C22C5DE1CE604C7D8

Function 00007FF648313130 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF648313E99,00000000,?,?,00007FF648313456), ref: 00007FF648313159
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF648313E99,00000000,?,?,00007FF648313456), ref: 00007FF648313190
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF648313E99,00000000,?,?,00007FF648313456), ref: 00007FF6483131A2
memcpy.VCRUNTIME140(?,?,?,00007FF648313E99,00000000,?,?,00007FF648313456), ref: 00007FF6483131CA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction ID: 3be2dfef3bfdbc11d6e08265a985696e9b515fccab3715b5b056b44ad9d85ce9
Opcode Fuzzy Hash: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction Fuzzy Hash: D0215E26609B8182DB45EF66E490229A7A0FB48FC8B488431DE9E47759DF3CD895C704

Function 00007FF6483024B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483024CD
strstr.VCRUNTIME140 ref: 00007FF64830250C
strstr.VCRUNTIME140 ref: 00007FF648302524

Strings

;type=, xrefs: 00007FF6483024FF, 00007FF64830251D

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 0222ecf549d9eab6eeb32d814db4a0ad4109cacb1d6406b327078b4eadc27f5b
Instruction ID: 6bfd808e34cf39d79e9a0ebd4c03196fc470eb30d95a8647fde280c8ffd9567c
Opcode Fuzzy Hash: 0222ecf549d9eab6eeb32d814db4a0ad4109cacb1d6406b327078b4eadc27f5b
Instruction Fuzzy Hash: E221C431A0C68281EB16EB74E4503A877A0FB5A784F0C4131DB9E8B7CADF2CE4918344

Function 00007FF6482FBF40 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBF68
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBF8E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBFAF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482E04B9,?,?,?,?,00007FF6482DF85B), ref: 00007FF6482FBFC0

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 4605cc5c122742bf078e2de82160463c2c23cd3f4f401cc025448c3935667395
Instruction ID: 6905ab9b5868c5c21b2685c265e09d36aecbd13c8bdb60ee732ef4574abf428f
Opcode Fuzzy Hash: 4605cc5c122742bf078e2de82160463c2c23cd3f4f401cc025448c3935667395
Instruction Fuzzy Hash: 96118A25B0D74242EA65BB72664023BA192FF58BC0F184535EE8D83BC4DE3CE4409B88

Function 00007FF64831D320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF64831D35D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831D36D
WideCharToMultiByte.KERNEL32 ref: 00007FF64831D39C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64831D3A9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction ID: 7e81f8a75d775e20a2fb2642b88c77183595ca4a1c709c6e7e189d6c34defecb
Opcode Fuzzy Hash: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction Fuzzy Hash: 0D115E31B0DB4186EB11AFA2B90012D7BA0FB88FD0B484438DF8987B14DF3CE9018784

Function 00007FF6482F1960 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482F19E3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF6482F1970

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction ID: e9ad69323c9e3bd7b32d1737b1cb7547d079288ac392d917c310f32179eb5f78
Opcode Fuzzy Hash: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction Fuzzy Hash: 4D018462B0964182FA167B65B9503BA6291EF94BF0F484230DFAD477D4DF3C9889D384

Function 00007FF6482DB130 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF6482DB0E2,?,?,?,00000000), ref: 00007FF6482DB141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB0E2,?,?,?,00000000), ref: 00007FF6482DB14A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482DB0E2,?,?,?,00000000), ref: 00007FF6482DB154
closesocket.WS2_32 ref: 00007FF6482DB172

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction ID: 3d5d4695b84957bc967bd5eb7d9ecd321068970f2eb6cd10785cf98d260b9dae
Opcode Fuzzy Hash: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction Fuzzy Hash: D7017112D1CB8283EB45FF71C9601782360FFE9F28B056325EE6D411A5AF68E5D48244

Function 00007FF6482E91D2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E9152

Strings

I64, xrefs: 00007FF6482E9105
I32, xrefs: 00007FF6482E90E5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: a47212c89471e80574d32abf2d57b142d35ca8e7c22bef0864889be9cf398db5
Instruction ID: 2a1c2b6036e7f890c7d820f2ed282e04f33679c86809762d23d76ab637787994
Opcode Fuzzy Hash: a47212c89471e80574d32abf2d57b142d35ca8e7c22bef0864889be9cf398db5
Instruction Fuzzy Hash: 1CF0A721B1D55341EB127B76D8547BA2B98AF5ABC4F0D5136C91EC63D4CE1CE704C398

Function 00007FF6482E91CA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6482E8FA8), ref: 00007FF6482E910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E9152

Strings

I64, xrefs: 00007FF6482E9105
I32, xrefs: 00007FF6482E90E5

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 99a124b7da873222bd242a2a80f7ee9b642aaf26a40535330719751bb5e961a6
Instruction ID: c5ec2457a9b277177f38f1543fc67375978d4fdb6bd25e92d2c1661ab177a21e
Opcode Fuzzy Hash: 99a124b7da873222bd242a2a80f7ee9b642aaf26a40535330719751bb5e961a6
Instruction Fuzzy Hash: E2F0A721B1D55341EB127B76D8547BA2B98AF5ABC4F0D5136C90EC63D4CE1CE704C398

Function 00007FF6483111C0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF6482E6576), ref: 00007FF6483111D4

Strings

%lx, xrefs: 00007FF6483114BA

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: c18ae29bb276a8ad680b31d530baec24a6480b71590a79a41d77ef7598f730cd
Instruction ID: 6431243e6595704f9c7fee209cdb5a32403635065ac66cac53c5f5516951415a
Opcode Fuzzy Hash: c18ae29bb276a8ad680b31d530baec24a6480b71590a79a41d77ef7598f730cd
Instruction Fuzzy Hash: 6A814C22A1C1D585EB6AAA7594502BE7FE0FB85F90F1C5235EA9EC26C2DE3CDC41C704

Function 00007FF6482FCEE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF6482FC8C3), ref: 00007FF6482FCFB2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF6482FC8C3), ref: 00007FF6482FD003

Strings

(){ %*], xrefs: 00007FF6482FCEFD

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction ID: 4645aa2af10a8336787ff68855bf2ead96c46dc43a8e11a2f4955bfd9498cab6
Opcode Fuzzy Hash: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction Fuzzy Hash: 7A316C1190D7AA54FF227B3452403766BC39F76B54F984236DB8E833C1CE2DA809E794

Function 00007FF6482E8CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E8D10
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E8D6B

Strings

, xrefs: 00007FF6482E8D23

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction ID: e77e672abe3d4bc12e404c66b92df1fec8ef0e473a30b12f12d64173207bf0eb
Opcode Fuzzy Hash: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction Fuzzy Hash: 20118172609B8182DB55AF35F25027973A0FB18FD4F484535DA9E97B98EF38D890C384

Function 00007FF6482E7010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF6482E708F
setsockopt.WS2_32 ref: 00007FF6482E70BE

Strings

@, xrefs: 00007FF6482E701F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction ID: 2c51882bd8c487df44478516de20e5432dd91350ca9e4d00b9e8d7b9a86de243
Opcode Fuzzy Hash: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction Fuzzy Hash: 94116071A0C2828AE720FF70E40067AB7A0FB90744F580030DB4887A94DFBDE589CB48

Function 00007FF6482E54C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E5505
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6482E552C

Strings

%I64d-, xrefs: 00007FF6482E5517

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: 1b09a0f9ec2cdcf79c216dadba7648dfc26f4f2795125d582cdf8d7fb230f003
Instruction ID: 20a8c095c3dede39218efa3002bf015f35ebfd822b18c0089bd76e71e5fefbaa
Opcode Fuzzy Hash: 1b09a0f9ec2cdcf79c216dadba7648dfc26f4f2795125d582cdf8d7fb230f003
Instruction Fuzzy Hash: 1111E172A1EA82C1EB15BB7895453FA23A2FB54B49F1C4035C90C8E265DE2C94968368

Function 00007FF648319AC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648319ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648319EBF

Strings

TRUE, xrefs: 00007FF648319EC9

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: ad9779da957951eca70e867832938f9a96f8dab6fd6b606cbe80922ad7a3ef30
Instruction ID: 351d4735b6a7b5ed7d1e6a886e73bd3382b3bd0640b5e434c9fed07b3dd65af8
Opcode Fuzzy Hash: ad9779da957951eca70e867832938f9a96f8dab6fd6b606cbe80922ad7a3ef30
Instruction Fuzzy Hash: 56019666A0D65544EF03BBB5E5002782B62AB04FA8F884832CE4E86798DE3CD4858314

Function 00007FF6482D8520 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482D87EA
memcpy.VCRUNTIME140 ref: 00007FF6482D891C
memcpy.VCRUNTIME140 ref: 00007FF6482D8938

Part of subcall function 00007FF6482EDDD0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482D66F3,?,?,00000000,00007FF6482E0FC2,?,?,00000000,00007FF6482E15F5), ref: 00007FF6482EDE0C

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: c4f4cead081543eee998664c6e26dde1d499f2edb648bd068f105d442ca860eb
Instruction ID: d813378d57fd056348b2adcd900d7133793f1c69ed44202f6bdca0a37a69458a
Opcode Fuzzy Hash: c4f4cead081543eee998664c6e26dde1d499f2edb648bd068f105d442ca860eb
Instruction Fuzzy Hash: A0C16C36B08A068AEB14AB75D5007AE37B1FB44BA8F444635CE2D977D8DF38E406D784

Function 00007FF648318DD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF648318DDF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6483191F6

Part of subcall function 00007FF6482E0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482E0292

Strings

%s: %s, xrefs: 00007FF6483191E1

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: 6fd051ae12b54f2a92270519f6d97962798999720b261752d85002a3e6645c6b
Instruction ID: 473a0e81bbe3dbfc1a6a2c938a969899c2e6842a40229434ebb2c4f5dfdf1655
Opcode Fuzzy Hash: 6fd051ae12b54f2a92270519f6d97962798999720b261752d85002a3e6645c6b
Instruction Fuzzy Hash: 46F0AF51A0C68281EA63B7B2A8447F55790BB45FD4F8C0432CE4E8775A8F3CD58A930C

Function 00007FF64831D270 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6483103A8), ref: 00007FF64831D2A1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6483103A8), ref: 00007FF64831D2B4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6483103A8), ref: 00007FF64831D2DB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6483103A8), ref: 00007FF64831D2E8

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction ID: 91eaba739294058091f6db5c51ad04e0fe41472b7ed56ac44460498c8dbbabd8
Opcode Fuzzy Hash: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction Fuzzy Hash: 0C112131B0C75282EB21ABAAF45002AB7A0EF89B94B5C4535DB9D87B58DE3CE5418744

Function 00007FF6482DBC00 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5757
Part of subcall function 00007FF6482D5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482DFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6482D1B61), ref: 00007FF6482D5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DBC36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DBC46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6482DBC54
memset.VCRUNTIME140 ref: 00007FF6482DBC8F

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction ID: 2f1c9fa661204da00dd350ac74d343a859a1d787a13c9ce63446c30b5873023f
Opcode Fuzzy Hash: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction Fuzzy Hash: 7C211A32E18B81A3E708EB32DB902A96360FB99740F559225EB9C43A11DF74F1F5C340

Function 00007FF64831AE10 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482FCC93), ref: 00007FF64831DDA6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482FCC93), ref: 00007FF64831DDC5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482FCC93), ref: 00007FF64831DDDF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6482FCC93), ref: 00007FF64831DDED

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction ID: 75dee168e69de7bd58b9491209dc36058f6b3e0fe0aa02642fcd3b34124767b0
Opcode Fuzzy Hash: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction Fuzzy Hash: 9E11F876A0DA4182EB55BFB5E89023C77A5FF94F84F184032CA4E82768CE3CD895C344

Function 00007FF648302C00 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302C5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302C7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF648302C8E

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction ID: 8eba3051129b6b757f50c24ca5257a8b5f1e21fa24c6e9041dbb1934743ca3ff
Opcode Fuzzy Hash: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction Fuzzy Hash: 8A112536608B80C6D741EF65E58026873A4F784F84F084036DE8E97728CF38E8A9C344

Function 00007FF6483121E0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E8405,?,?,00000000,00007FF6482E10C1,?,?,00000000,00007FF6482E15F5), ref: 00007FF6483121F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E8405,?,?,00000000,00007FF6482E10C1,?,?,00000000,00007FF6482E15F5), ref: 00007FF648312216
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E8405,?,?,00000000,00007FF6482E10C1,?,?,00000000,00007FF6482E15F5), ref: 00007FF648312224
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6482E8405,?,?,00000000,00007FF6482E10C1,?,?,00000000,00007FF6482E15F5), ref: 00007FF648312232

Memory Dump Source

Source File: 00000000.00000002.1822581234.00007FF6482C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6482C0000, based on PE: true

Associated: 00000000.00000002.1822570142.00007FF6482C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822613384.00007FF648321000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822629250.00007FF648338000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1822641543.00007FF648339000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6482c0000_G9e272AEyo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction ID: 8317499d64cd1904a63b1ca7f7cefdd619b745fc10bbf3fc8a52830a857c0bbf
Opcode Fuzzy Hash: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction Fuzzy Hash: EAF07476608B0192DB05AF76E99402873B4FB98F987194121CE9E87B68CF3CD8A5C344

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report G9e272AEyo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_G9e272AEyo.exe_38d8115434c1d6f4526792875acb23d414_949d7e63_24e1ab57-b402-426d-a902-b7bdba8ffb82\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3CEA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DD6.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E35.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
G9e272AEyo.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre