Edit tour

Windows Analysis Report
oMBUxRQ4cj.exe

Overview

General Information

Sample name:	oMBUxRQ4cj.exe renamed because original name is a hash value
Original sample name:	be1bc9129a29112cf1d62b178517de03.exe
Analysis ID:	1538234
MD5:	be1bc9129a29112cf1d62b178517de03
SHA1:	d93ce38e29d5643fdda4d786a0194fbed04c68b9
SHA256:	ff4475b9917de9cdd66f95df8f764433961e992a28942b595933ecf0a8c82db8
Tags:	64exetrojan
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found API chain indicative of debugger detection

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

oMBUxRQ4cj.exe (PID: 2640 cmdline: "C:\Users\user\Desktop\oMBUxRQ4cj.exe" MD5: BE1BC9129A29112CF1D62B178517DE03)

conhost.exe (PID: 2892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5972 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1644 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 432 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6644 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1440 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4288 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1868 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1532 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6084 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4824 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3876 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6516 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6968 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4836 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6148 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2172 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6660 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4308 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5876 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4288 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1440 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1532 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 1632 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6180 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2780 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1360 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4836 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1892 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2672 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 432 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2612 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 2472 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6396 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 3680 cmdline: C:\Windows\system32\WerFault.exe -u -p 2640 -s 992 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: oMBUxRQ4cj.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for sample

Source: oMBUxRQ4cj.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A19F3D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF7E5A19F3D
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A19300 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7E5A19300
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A19230 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF7E5A19230
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A1C220 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7E5A1C220
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A1C1C0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF7E5A1C1C0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A1C210 CryptHashData,	0_2_00007FF7E5A1C210
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A363F0 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF7E5A363F0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7E5A3CE40
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3EF30 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7E5A3EF30
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A35AD0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF7E5A35AD0

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF7E59FF0E0
Source: oMBUxRQ4cj.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF7E5A28B00

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: oMBUxRQ4cj.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant ESP\x64\Release\EpicGames.pdb source: oMBUxRQ4cj.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E59F1530 rand,rand,rand,SetConsoleTitleA,_invalid_parameter_noinfo_noreturn,GetConsoleWindow,GetWindowLongPtrA,SetWindowLongPtrA,SetLayeredWindowAttributes,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,URLDownloadToFileA,system,system,Sleep,exit,URLDownloadToFileA,system,system,Sleep,exit,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7E59F1530

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: oMBUxRQ4cj.exe	String found in binary or memory: http://185.101.104.122/esphvciforabronkz.exe
Source: oMBUxRQ4cj.exe	String found in binary or memory: http://185.101.104.122/esphvciforabronkz.exeC:
Source: oMBUxRQ4cj.exe	String found in binary or memory: http://185.101.104.122/esphvcionbronkz.exe
Source: oMBUxRQ4cj.exe	String found in binary or memory: http://185.101.104.122/esphvcionbronkz.exeC:
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: oMBUxRQ4cj.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: oMBUxRQ4cj.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/64
Source: oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/um
Source: oMBUxRQ4cj.exe, 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmp, oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E5A3CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7E5A3CE40

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59F1530	0_2_00007FF7E59F1530
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A0F590	0_2_00007FF7E5A0F590
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A19F3D	0_2_00007FF7E5A19F3D
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A06980	0_2_00007FF7E5A06980
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A08980	0_2_00007FF7E5A08980
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A07CC0	0_2_00007FF7E5A07CC0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A1C5D0	0_2_00007FF7E5A1C5D0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A315B0	0_2_00007FF7E5A315B0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A00600	0_2_00007FF7E5A00600
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A29520	0_2_00007FF7E5A29520
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A30580	0_2_00007FF7E5A30580
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59E955D	0_2_00007FF7E59E955D
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A09840	0_2_00007FF7E5A09840
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A12890	0_2_00007FF7E5A12890
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59E973B	0_2_00007FF7E59E973B
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59ED250	0_2_00007FF7E59ED250
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A2D220	0_2_00007FF7E5A2D220
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A153E0	0_2_00007FF7E5A153E0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A03330	0_2_00007FF7E5A03330
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3EEC0	0_2_00007FF7E5A3EEC0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3CE40	0_2_00007FF7E5A3CE40
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59EDDE0	0_2_00007FF7E59EDDE0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59E1000	0_2_00007FF7E59E1000
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A19FFC	0_2_00007FF7E5A19FFC
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A1A005	0_2_00007FF7E5A1A005
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A35AD0	0_2_00007FF7E5A35AD0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A249F0	0_2_00007FF7E5A249F0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59F8990	0_2_00007FF7E59F8990
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A17CC0	0_2_00007FF7E5A17CC0
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59EABFD	0_2_00007FF7E59EABFD
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E59EEB70	0_2_00007FF7E59EEB70

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A08DB0 appears 46 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E59F3030 appears 49 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A05970 appears 378 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A0A410 appears 34 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A05AF0 appears 323 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A40236 appears 47 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A0A330 appears 33 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A00240 appears 70 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A08E80 appears 35 times
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: String function: 00007FF7E5A0A2A0 appears 37 times

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2640 -s 992

Source: classification engine

Classification label: mal60.evad.winEXE@68/22@1/2

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E59F2640 GetLastError,_errno,FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF7E59F2640

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2892:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2640

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\34082a48-cc79-4c4c-9f15-ad727fd95d3a

Jump to behavior

Source: oMBUxRQ4cj.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oMBUxRQ4cj.exe

ReversingLabs: Detection: 57%

Source: oMBUxRQ4cj.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\oMBUxRQ4cj.exe "C:\Users\user\Desktop\oMBUxRQ4cj.exe"
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2640 -s 992
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: oMBUxRQ4cj.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: oMBUxRQ4cj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: oMBUxRQ4cj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: oMBUxRQ4cj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: oMBUxRQ4cj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: oMBUxRQ4cj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: oMBUxRQ4cj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: oMBUxRQ4cj.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: oMBUxRQ4cj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant ESP\x64\Release\EpicGames.pdb source: oMBUxRQ4cj.exe

Source: oMBUxRQ4cj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: oMBUxRQ4cj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: oMBUxRQ4cj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: oMBUxRQ4cj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: oMBUxRQ4cj.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E5A08660 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7E5A08660

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

API coverage: 4.3 %

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-47619

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E5A3FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7E5A3FD4C

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E5A400E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7E5A400E8

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E5A08660 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7E5A08660

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3FEF4 SetUnhandledExceptionFilter,	0_2_00007FF7E5A3FEF4
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E5A3FD4C
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A3F9F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E5A3F9F4

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe

Code function: 0_2_00007FF7E5A3FF64 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E5A3FF64

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A14A60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF7E5A14A60
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A07630 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF7E5A07630
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A2B750 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7E5A2B750
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A2B4F1 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7E5A2B4F1
Source: C:\Users\user\Desktop\oMBUxRQ4cj.exe	Code function: 0_2_00007FF7E5A249F0 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF7E5A249F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oMBUxRQ4cj.exe	58%	ReversingLabs	Win64.Trojan.Lazy
oMBUxRQ4cj.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/64	oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/esphvciforabronkz.exe	oMBUxRQ4cj.exe	false		unknown
http://185.101.104.122/esphvcionbronkz.exeC:	oMBUxRQ4cj.exe	false		unknown
http://upx.sf.net	Amcache.hve.38.dr	false	URL Reputation: safe	unknown
https://keyauth.win/api/1.1/um	oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/esphvciforabronkz.exeC:	oMBUxRQ4cj.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html	oMBUxRQ4cj.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	oMBUxRQ4cj.exe	false		unknown
https://keyauth.win/api/1.2/	oMBUxRQ4cj.exe, 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmp, oMBUxRQ4cj.exe, 00000000.00000002.2284970904.00000239EB29C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/esphvcionbronkz.exe	oMBUxRQ4cj.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538234
Start date and time:	2024-10-20 21:09:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oMBUxRQ4cj.exe renamed because original name is a hash value
Original Sample Name:	be1bc9129a29112cf1d62b178517de03.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@68/22@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.189.173.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: oMBUxRQ4cj.exe

Simulations

Behavior and APIs

Time	Type	Description
15:10:25	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.0.5	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.12317.30120.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.7929.18094.exe	Get hash	malicious	Unknown	Browse
	FREE TEST.exe	Get hash	malicious	Unknown	Browse
	zara_slotted_cracked.exe	Get hash	malicious	Unknown	Browse
	1YJgPEJr4V.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Frozen_Slotted.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.TrojanX-gen.12317.30120.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Download.exe	Get hash	malicious	LummaC	Browse	104.21.53.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.0.5
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	104.26.0.5
	ojSv9FmOwn.lnk	Get hash	malicious	Unknown	Browse	104.26.0.5
	a1OueQJq4d.exe	Get hash	malicious	DCRat	Browse	104.26.0.5
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.26.0.5
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.26.0.5
	N2ER4ZENF1.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	N2ER4ZENF1.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.14681.29745.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.18133.14409.exe	Get hash	malicious	Discord Rat	Browse	104.26.0.5

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oMBUxRQ4cj.exe_5fd8cc97a3ec791a464adc62fb4cece4561dc271_c6605313_0bdab154-a71e-4fa1-b277-03f59eb49450\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9997635471468678
Encrypted:	false
SSDEEP:	192:wkVZ6JBIa087bBhjXVmUzuiFNZ24lO8r/:5VZsBIh8HBhjRzuiFNY4lO8r
MD5:	65026FE2EBCBA283802F4548630553BD
SHA1:	0B6A8381293F2552BDE5CD3322799D7887753146
SHA-256:	46BC0C03149EDB2FF0B857295E3117D894785B5022FF05DAA092A1D506006A8B
SHA-512:	33FCAC690AA00BD8A58D7F1F6E9E8D3AFB27A0D9E1BDB73980DEB88E2DBAD933F35DD7D1B07962A295CCFB5AA1CE6576E64E5654B4ECBA9DFAB35B6AB13A45DF
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.2.5.0.0.6.3.8.7.8.8.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.2.5.0.0.6.8.2.5.3.8.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.d.a.b.1.5.4.-.a.7.1.e.-.4.f.a.1.-.b.2.7.7.-.0.3.f.5.9.e.b.4.9.4.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.2.c.e.6.d.c.-.0.c.0.c.-.4.8.f.7.-.9.a.c.b.-.4.9.0.5.4.1.b.3.d.0.f.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.o.M.B.U.x.R.Q.4.c.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.5.0.-.0.0.0.1.-.0.0.1.4.-.5.f.e.0.-.b.a.a.8.2.3.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.0.e.3.2.1.1.c.0.a.5.c.7.c.7.7.2.6.9.2.f.d.4.a.0.f.7.3.f.3.4.6.0.0.0.0.f.f.f.f.!.0.0.0.0.d.9.3.c.e.3.8.e.2.9.d.5.6.4.3.f.d.d.a.4.d.7.8.6.a.0.1.9.4.f.b.e.d.0.4.c.6.8.b.9.!.o.M.B.U.x.R.Q.4.c.j...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3693.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 19:10:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	105668
Entropy (8bit):	1.617780144724441
Encrypted:	false
SSDEEP:	384:39JCtrkh2e0syFkNDDaRuKGhDRTJmr2BCL2FP:3Ogh2e07eNDGRuKGhwS
MD5:	E968245385494CB5473E50D44FAB66E3
SHA1:	76E07427B8D9ECCEEA2650B594D22F168A44A8AC
SHA-256:	38FBCBA8BBDA4D03A7300CC9BD6A4DC39AF039918D2F3A1D840D406FFE9B22F2
SHA-512:	AEC366B9754151827DD6384075C201A800087145449A45CC1F8F70AF5FEC85783EC805EF7E1BC35DDA5276DBE8606CF77A7C9E231EF2DB31702876E7CCEDEFF7
Malicious:	false
Preview:	MDMP..a..... ........U.g............$...............,............J..........T.......8...........T...........p'..Tu.......................!..............................................................................eJ......T"......Lw......................T.......P....U.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3740.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	3.7158043317306677
Encrypted:	false
SSDEEP:	192:R6l7wVeJiy/H6YEITcP45Yg+hgmfhQ2NprO89bqXzoSf6Om:R6lXJvP6YEsWgGgmfhQ23qXzVfK
MD5:	0E67A4CB40F73B6B89A9E80CC936151D
SHA1:	7DD557F53A3ABA49DCE5054FE8AB81773A8A55B2
SHA-256:	B6CD3D29AB7C4872387529C1EA7C8879099CF04D874F5D7076AE3491F8DAD63E
SHA-512:	0E1898EDC19C8E50AC38BC0C2F32E6869ECD079D43F5083F59F29AAF074AB3BD6E40FCD07A8E524F65F51B48B269C7D88E549AEBD1E159A83C248A77339A3914
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER379F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.476988878789837
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9adWpW8VY5Ym8M4J0/FBUmyq85zWXtYxmXeBd:uIjf6I75s7VhJ5mVicXMd
MD5:	041635DFB4262E437F867A3129EB6348
SHA1:	CE4941921E4C5676833862BBF63C57F9ED275F5A
SHA-256:	CF441C735C424C1A20456EA5A5CC41B6C678D3E1EE9CB3F7209B000B8452E2C6
SHA-512:	EE38F42B0E42BDD5BCE29F119AE157F2813D729A1969FBB4E6FE9D04CE4DF46E3346EF8A14AE00EE191FD673BC6675E551136151507B9DE32ADEF083414788E9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552132" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421637273868838
Encrypted:	false
SSDEEP:	6144:jSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnN70uhiTw:uvloTMW+EZMM6DFyd03w
MD5:	1A4F2ADD61F4F137162A34F03CED6C08
SHA1:	5723F4B227CA9AC218083AFE5685388CB35106FD
SHA-256:	FA19D4379AF2B1ADF627FE11EADF1FF66BD2DE54ADEA7CF6495C73A9805ED6E7
SHA-512:	CA49C921D9FD5F7FDD2F81F881B39E6310613341D8E8B45681B2F7118C44E905EA915BFEA556264EA9C2D5A8B580EF555E32B0484580BAE22E13E6EB80D2DD5F
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....##..............................................................................................................................................................................................................................................................................................................................................o...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.4231219861016315
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	oMBUxRQ4cj.exe
File size:	506'368 bytes
MD5:	be1bc9129a29112cf1d62b178517de03
SHA1:	d93ce38e29d5643fdda4d786a0194fbed04c68b9
SHA256:	ff4475b9917de9cdd66f95df8f764433961e992a28942b595933ecf0a8c82db8
SHA512:	f28d9631d0d4f0ab5f648b4fd9913ddf1336c5b898513266456e9aeb81a69b3c339e6fa53b6af52e8edecc30f6971fc6ce4f66e97acb38149ea3a2deb168da4d
SSDEEP:	6144:xy8S4ZP3rneV8giiDYviaN4TuNy+m4W70Lzxw2T942uHde9VWWTpQmCgTf1:xDpVtfkYvi3qNRWYLz2m+P4m5mC6f1
TLSH:	96B46D56A7A807E9D1A7D03CC547C603E7B6B4991310DBDB43A0CA791F63BE16E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005f9d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670FD9F7 [Wed Oct 16 15:21:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE81C900A58h
dec eax
add esp, 28h
jmp 00007FE81C900347h
int3
int3
jmp 00007FE81C900D08h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000178Bh]
dec eax
mov ecx, ebx
call dword ptr [000016F2h]
call dword ptr [00001774h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001770h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001764h]
test eax, eax
je 00007FE81C9004D9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018E12h]
call 00007FE81C90069Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EF9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E89h], eax
dec eax
mov eax, dword ptr [00018EE2h]
dec eax
mov dword ptr [00018D53h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E57h], eax
mov dword ptr [00018D2Dh], C0000409h
mov dword ptr [00018D27h], 00000001h
mov dword ptr [00000031h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fda8	0x5fe00	e7d9058d6d0aa09d44a484d3d7e87298	False	0.5327243929269883	data	6.33613026455228	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	fe643e4dd3fa906f1244164bcbf97042	False	0.37974330357142855	data	5.577966141982146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	227ce6cadd4904b7716198186655da5c	False	0.2138671875	data	2.4411408781631465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	50e902fb009b515c9924ff6238b5e51d	False	0.48175048828125	data	5.776998787420237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	39326fb49822ad82593e9e49b5e608b8	False	0.5123697916666666	data	4.849267575521713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:10:02.040790081 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:02.040867090 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:02.040980101 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:02.054287910 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:02.054323912 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:02.871313095 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:02.871520996 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:02.937979937 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:02.938029051 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:02.938487053 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:02.942677975 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:02.983427048 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:03.128381014 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:03.128540993 CEST	443	49708	104.26.0.5	192.168.2.5
Oct 20, 2024 21:10:03.128626108 CEST	49708	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:10:26.469109058 CEST	49708	443	192.168.2.5	104.26.0.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:10:02.027272940 CEST	52687	53	192.168.2.5	1.1.1.1
Oct 20, 2024 21:10:02.034897089 CEST	53	52687	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 21:10:02.027272940 CEST	192.168.2.5	1.1.1.1	0xec0a	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 21:10:02.034897089 CEST	1.1.1.1	192.168.2.5	0xec0a	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:10:02.034897089 CEST	1.1.1.1	192.168.2.5	0xec0a	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:10:02.034897089 CEST	1.1.1.1	192.168.2.5	0xec0a	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.26.0.5	443	2640	C:\Users\user\Desktop\oMBUxRQ4cj.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 19:10:02 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-20 19:10:02 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 31 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.1&name=loader principal&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\oMBUxRQ4cj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\oMBUxRQ4cj.exe"
Imagebase:	0x7ff7e59e0000
File size:	506'368 bytes
MD5 hash:	BE1BC9129A29112CF1D62B178517DE03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:09:59
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff656ab0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff656ab0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6968, Parent PID: 6516

General

Target ID:	15
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6148, Parent PID: 4836

General

Target ID:	17
Start time:	15:10:00
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6660, Parent PID: 2172

General

Target ID:	19
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5876, Parent PID: 4308

General

Target ID:	21
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff656ab0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 1440, Parent PID: 4288

General

Target ID:	23
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff656ab0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:10:01
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1632, Parent PID: 2640

General

Target ID:	25
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6180, Parent PID: 1632

General

Target ID:	26
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1360, Parent PID: 2780

General

Target ID:	28
Start time:	15:10:04
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:10:05
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:10:05
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6130f0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:10:05
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 432, Parent PID: 2672

General

Target ID:	32
Start time:	15:10:05
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff656ab0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:10:05
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 2472, Parent PID: 2612

General

Target ID:	34
Start time:	15:10:06
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff656ab0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:10:06
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6d42e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:10:06
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2640 -s 992
Imagebase:	0x7ff627b90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	87

Executed Functions

Function 00007FF7E5A0F590 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0F668
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0F675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0F748
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0F7CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0F873
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0F90A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0F9D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0FA0D
strchr.VCRUNTIME140 ref: 00007FF7E5A0FB87
strchr.VCRUNTIME140 ref: 00007FF7E5A0FB9A
strchr.VCRUNTIME140 ref: 00007FF7E5A0FBAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0FCB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0FD23
memcpy.VCRUNTIME140 ref: 00007FF7E5A0FD4A
strchr.VCRUNTIME140 ref: 00007FF7E5A0FD5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0FD72
strstr.VCRUNTIME140 ref: 00007FF7E5A0FFA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A100E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A10259

Part of subcall function 00007FF7E5A08DB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A08E23

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1030C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A10391
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A105EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A10600
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1060F

Part of subcall function 00007FF7E5A11960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A119BA

strchr.VCRUNTIME140 ref: 00007FF7E5A10BC7
strchr.VCRUNTIME140 ref: 00007FF7E5A10BDA
strchr.VCRUNTIME140 ref: 00007FF7E5A10BEC

Part of subcall function 00007FF7E5A11960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A119DA
Part of subcall function 00007FF7E5A11960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A119E3

strchr.VCRUNTIME140 ref: 00007FF7E5A10E3F
strchr.VCRUNTIME140 ref: 00007FF7E5A10E52
strchr.VCRUNTIME140 ref: 00007FF7E5A10E64

Part of subcall function 00007FF7E5A13F90: strchr.VCRUNTIME140 ref: 00007FF7E5A14076
Part of subcall function 00007FF7E5A13F90: strchr.VCRUNTIME140 ref: 00007FF7E5A14089
Part of subcall function 00007FF7E5A13F90: strchr.VCRUNTIME140 ref: 00007FF7E5A1409B

Strings

Content-Type, xrefs: 00007FF7E5A0FA77, 00007FF7E5A10DAD
;type=%c, xrefs: 00007FF7E5A10011
POST, xrefs: 00007FF7E5A0F715
Expect, xrefs: 00007FF7E5A10B64, 00007FF7E5A10DD9
%s, xrefs: 00007FF7E5A10B43
ftp://%s:%s@%s, xrefs: 00007FF7E5A103BB
Content-Range, xrefs: 00007FF7E5A1023E
Range, xrefs: 00007FF7E5A100C2
Transfer-Encoding, xrefs: 00007FF7E5A0FB1D
Expect:, xrefs: 00007FF7E5A10B85, 00007FF7E5A10DFA
%s%s, xrefs: 00007FF7E5A107A0
Host: %s%s%s, xrefs: 00007FF7E5A0FE2D
Could only read %I64d bytes from the input, xrefs: 00007FF7E5A10215
Failed sending PUT request, xrefs: 00007FF7E5A10A39
1.1, xrefs: 00007FF7E5A102FE
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF7E5A10298
If-Modified-Since, xrefs: 00007FF7E5A1085D
1.0, xrefs: 00007FF7E5A102F0
PUT, xrefs: 00007FF7E5A0F708
Cookie, xrefs: 00007FF7E5A0F992
User-Agent, xrefs: 00007FF7E5A0F72D
Proxy-Connection: Keep-Alive, xrefs: 00007FF7E5A1048F, 00007FF7E5A104A4
?%s, xrefs: 00007FF7E5A103FB
Last-Modified, xrefs: 00007FF7E5A1084B
Could not seek stream, xrefs: 00007FF7E5A10158
%s?%s, xrefs: 00007FF7E5A0F765
Proxy-Connection, xrefs: 00007FF7E5A10463
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF7E5A108E4
Failed sending POST request, xrefs: 00007FF7E5A10A99, 00007FF7E5A10CDD
Content-Length: 0, xrefs: 00007FF7E5A10A60
Content-Length, xrefs: 00007FF7E5A109A4, 00007FF7E5A10AF9, 00007FF7E5A10D7E
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF7E5A0FC8C
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF7E5A10274
Host:, xrefs: 00007FF7E5A0FD81
ftp, xrefs: 00007FF7E5A0FF79
Transfer-Encoding:, xrefs: 00007FF7E5A0FB3E
OPTIONS, xrefs: 00007FF7E5A0F6FB
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7E5A105CB
Content-Length: %I64d, xrefs: 00007FF7E5A109BB, 00007FF7E5A10B10, 00007FF7E5A10D95
Failed sending HTTP request, xrefs: 00007FF7E5A10D36
Accept: */*, xrefs: 00007FF7E5A10075
http, xrefs: 00007FF7E5A0FF0B
chunked, xrefs: 00007FF7E5A0FBC6
%x, xrefs: 00007FF7E5A10F65
100-continue, xrefs: 00007FF7E5A10C06, 00007FF7E5A10E86
Accept-Encoding: %s, xrefs: 00007FF7E5A0F9E2
Content-Range: bytes %s/%I64d, xrefs: 00007FF7E5A102A6
GET, xrefs: 00007FF7E5A0F722
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF7E5A10DC1
Cookie: , xrefs: 00007FF7E5A106FE, 00007FF7E5A10774
Range: bytes=%s, xrefs: 00007FF7E5A100EE
Host: %s%s%s:%d, xrefs: 00007FF7E5A0FE72
File already completely uploaded, xrefs: 00007FF7E5A101F9
Referer: %s, xrefs: 00007FF7E5A0F93E
%s , xrefs: 00007FF7E5A10323
HEAD, xrefs: 00007FF7E5A0F6D1
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF7E5A1116E
Failed sending HTTP POST request, xrefs: 00007FF7E5A1106B
If-Unmodified-Since, xrefs: 00007FF7E5A10854
Transfer-Encoding: chunked, xrefs: 00007FF7E5A0FC7F
Referer, xrefs: 00007FF7E5A0F923
Host, xrefs: 00007FF7E5A0FCB9
multipart/form-data, xrefs: 00007FF7E5A0FABA
Invalid TIMEVALUE, xrefs: 00007FF7E5A10813
Host:%s, xrefs: 00007FF7E5A0FDB6
0, xrefs: 00007FF7E5A10FB6, 00007FF7E5A110B5
Accept, xrefs: 00007FF7E5A10063
;type=, xrefs: 00007FF7E5A0FF9E
Accept-Encoding, xrefs: 00007FF7E5A0F9B1
%s%s=%s, xrefs: 00007FF7E5A10719

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 47623950a0bbe64e698ed1ebe928e22b03c269fb12d880581cf83119aadb09f5
Instruction ID: e204057595be48d693c45dcfeb770108bcfa2bb89a2df2719a671df6c025598e
Opcode Fuzzy Hash: 47623950a0bbe64e698ed1ebe928e22b03c269fb12d880581cf83119aadb09f5
Instruction Fuzzy Hash: 0103C261F0868A86FB54AB319560BB9AFA0BF45F88F844037CE4D97695DF3CE445C322

Function 00007FF7E5A19F3D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A1A098
strchr.VCRUNTIME140 ref: 00007FF7E5A1A0C4
strchr.VCRUNTIME140 ref: 00007FF7E5A1A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1A122
strchr.VCRUNTIME140 ref: 00007FF7E5A1A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1A24A

Strings

Microsoft Unified Security Protocol Provider, xrefs: 00007FF7E5A1A63F
LocalMachineEnterprise, xrefs: 00007FF7E5A1A20B
schannel: unable to allocate memory, xrefs: 00007FF7E5A1A5BC, 00007FF7E5A1A847
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF7E5A1A54F
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7E5A1A4D9
schannel: ALPN, offering %s, xrefs: 00007FF7E5A1A775
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF7E5A1A137
http/1.1, xrefs: 00007FF7E5A1A753
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF7E5A19FCB
CurrentService, xrefs: 00007FF7E5A1A175
LocalMachineGroupPolicy, xrefs: 00007FF7E5A1A1EC
Services, xrefs: 00007FF7E5A1A197
LocalMachine, xrefs: 00007FF7E5A1A153
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF7E5A1A2B0
schannel: Failed to read cert file %s, xrefs: 00007FF7E5A1A5F9
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF7E5A1A622
http/1.1, xrefs: 00007FF7E5A1A767
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF7E5A1A504
CurrentUser, xrefs: 00007FF7E5A1A112
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF7E5A1A6B5
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7E5A1A733
CurrentUserGroupPolicy, xrefs: 00007FF7E5A1A1CD
Users, xrefs: 00007FF7E5A1A1B6

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: d89aac1099c6e6052993711684499b2b5f7c8b83f93c3e0272dea94e26d5bd3d
Instruction ID: a4d013adc49d0ea37f32b23495834c54dd422168298bf255ac1ab3e0b20c6d97
Opcode Fuzzy Hash: d89aac1099c6e6052993711684499b2b5f7c8b83f93c3e0272dea94e26d5bd3d
Instruction Fuzzy Hash: 6442C361B0874A85EB24AF65E960BB9AB90FF44F94F804137CA1E87790DF3CE544C762

Function 00007FF7E59F1530 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7E59F155A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7E59F1596
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7E59F15C2
SetConsoleTitleA.KERNEL32 ref: 00007FF7E59F1640
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F1679
GetConsoleWindow.KERNELBASE ref: 00007FF7E59F1685
GetWindowLongPtrA.USER32 ref: 00007FF7E59F1696
SetWindowLongPtrA.USER32 ref: 00007FF7E59F16AC
SetLayeredWindowAttributes.USER32 ref: 00007FF7E59F16C0
GetStdHandle.KERNEL32 ref: 00007FF7E59F16D0
SetConsoleTextAttribute.KERNELBASE ref: 00007FF7E59F16DC
GetStdHandle.KERNEL32 ref: 00007FF7E59F16E7
SetConsoleTextAttribute.KERNELBASE ref: 00007FF7E59F16F3
GetStdHandle.KERNEL32 ref: 00007FF7E59F170A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1716

Part of subcall function 00007FF7E59F0680: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7E59E11FA), ref: 00007FF7E59F075F

Part of subcall function 00007FF7E59F1A70: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF7E59F1728), ref: 00007FF7E59F1A94
Part of subcall function 00007FF7E59F1A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF7E59F1728), ref: 00007FF7E59F1AB5

GetStdHandle.KERNEL32 ref: 00007FF7E59F1739
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1745
GetStdHandle.KERNEL32 ref: 00007FF7E59F175C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1768
GetStdHandle.KERNEL32 ref: 00007FF7E59F177F
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F178B
GetStdHandle.KERNEL32 ref: 00007FF7E59F17A2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F17AE
GetStdHandle.KERNEL32 ref: 00007FF7E59F17C5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F17D1
GetStdHandle.KERNEL32 ref: 00007FF7E59F17E8
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F17F4
GetStdHandle.KERNEL32 ref: 00007FF7E59F1817
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1823
GetStdHandle.KERNEL32 ref: 00007FF7E59F183A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1846
GetStdHandle.KERNEL32 ref: 00007FF7E59F185D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1869
GetStdHandle.KERNEL32 ref: 00007FF7E59F188C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F1898
GetStdHandle.KERNEL32 ref: 00007FF7E59F18AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F18BB
GetStdHandle.KERNEL32 ref: 00007FF7E59F18D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7E59F18DE
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF7E59F18FB
URLDownloadToFileA.URLMON ref: 00007FF7E59F194F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F195B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F1968
Sleep.KERNEL32 ref: 00007FF7E59F1973
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F197B
URLDownloadToFileA.URLMON ref: 00007FF7E59F19CD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F19D9
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F19E6
Sleep.KERNEL32 ref: 00007FF7E59F19F1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F19F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F1A32

Strings

Iniciar Valorant ESP (HVCI DESLIGADO): , xrefs: 00007FF7E59F17FA
http://185.101.104.122/esphvcionbronkz.exe, xrefs: 00007FF7E59F1987
[ Selecione uma opcao: ], xrefs: 00007FF7E59F174B
cd C:\, xrefs: 00007FF7E59F1954, 00007FF7E59F19D2
.exe, xrefs: 00007FF7E59F1563
http://185.101.104.122/esphvciforabronkz.exe, xrefs: 00007FF7E59F1909
start C:\Windows\System32\SeuetingsHostialog.exe, xrefs: 00007FF7E59F19DF
start C:\Windows\System32\SeieHuSttinstialog.exe, xrefs: 00007FF7E59F1961
Selecione a opcao: , xrefs: 00007FF7E59F18E4
Iniciar Valorant ESP (HVCI HABILITADO): , xrefs: 00007FF7E59F186F
##########################################################, xrefs: 00007FF7E59F176E
C:\Windows\System32\SeieHuSttinstialog.exe, xrefs: 00007FF7E59F191A
##########################################################, xrefs: 00007FF7E59F1728
C:\Windows\System32\SeuetingsHostialog.exe, xrefs: 00007FF7E59F1998

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant ESP (HVCI DESLIGADO): $ Iniciar Valorant ESP (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SeieHuSttinstialog.exe$C:\Windows\System32\SeuetingsHostialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/esphvciforabronkz.exe$http://185.101.104.122/esphvcionbronkz.exe$start C:\Windows\System32\SeieHuSttinstialog.exe$start C:\Windows\System32\SeuetingsHostialog.exe
API String ID: 2233566951-2931392240
Opcode ID: 13f08ad738c38134cd58ba64b4e898b23d3fc82a5f16b95eb77ab26870e295f7
Instruction ID: 947192628a4aedd24d621e059a2c06e89d056627a74303dae89c2540a73e5d9d
Opcode Fuzzy Hash: 13f08ad738c38134cd58ba64b4e898b23d3fc82a5f16b95eb77ab26870e295f7
Instruction Fuzzy Hash: 24E15621F0864B86EB00BBA0D874AB8A761AF85F94F804236D51EC66F5DF3CE549C371

Function 00007FF7E5A08980 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF7E5A089A8
WSACleanup.WS2_32 ref: 00007FF7E5A089C3
GetModuleHandleA.KERNEL32 ref: 00007FF7E5A08A14
GetProcAddress.KERNEL32 ref: 00007FF7E5A08A40
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A08A5A
LoadLibraryA.KERNEL32 ref: 00007FF7E5A08A7D
GetProcAddress.KERNEL32 ref: 00007FF7E5A08A9A
LoadLibraryExA.KERNELBASE ref: 00007FF7E5A08AB0
GetSystemDirectoryA.KERNEL32 ref: 00007FF7E5A08AC6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A08ADE
GetSystemDirectoryA.KERNEL32 ref: 00007FF7E5A08AF2
LoadLibraryA.KERNEL32 ref: 00007FF7E5A08B60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A08B6C
GetProcAddress.KERNEL32 ref: 00007FF7E5A08B98
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08C21
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08C34
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08C43
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08C52
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08C62
VerifyVersionInfoA.KERNEL32 ref: 00007FF7E5A08C73
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7E5A08C8F

Strings

if_nametoindex, xrefs: 00007FF7E5A08B8E
LoadLibraryExA, xrefs: 00007FF7E5A08A2E
iphlpapi.dll, xrefs: 00007FF7E5A08A46
kernel32, xrefs: 00007FF7E5A089FB
AddDllDirectory, xrefs: 00007FF7E5A08A90

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: 372a1b11eae873ffce80445b4ce260fa558d07d99fefe9c51babf47caa90135e
Instruction ID: d7581dd5e1cd7ec6c95d54c2b7449d576e92811bf149a6e5bbe24b3a6117559f
Opcode Fuzzy Hash: 372a1b11eae873ffce80445b4ce260fa558d07d99fefe9c51babf47caa90135e
Instruction Fuzzy Hash: E791A221B1978B86EB60BB61A420BB9AB91FF89F84F844136C94D87754EF7CE0458721

Function 00007FF7E5A07CC0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E5A07D5C
socket.WS2_32 ref: 00007FF7E5A07DA5
htons.WS2_32 ref: 00007FF7E5A07E31
setsockopt.WS2_32 ref: 00007FF7E5A07E93
WSAGetLastError.WS2_32 ref: 00007FF7E5A07E9D
getsockopt.WS2_32 ref: 00007FF7E5A07F3F
setsockopt.WS2_32 ref: 00007FF7E5A07F6E
setsockopt.WS2_32 ref: 00007FF7E5A07FAD
WSAIoctl.WS2_32 ref: 00007FF7E5A0803A
WSAGetLastError.WS2_32 ref: 00007FF7E5A08044

Part of subcall function 00007FF7E5A14C90: ioctlsocket.WS2_32 ref: 00007FF7E5A14CA9

Part of subcall function 00007FF7E5A0D7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7E59F582F), ref: 00007FF7E5A0D7C7

connect.WS2_32 ref: 00007FF7E5A0816B
WSAGetLastError.WS2_32 ref: 00007FF7E5A08188

Part of subcall function 00007FF7E59F2500: GetLastError.KERNEL32 ref: 00007FF7E59F2522
Part of subcall function 00007FF7E59F2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F252A

Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C15
Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C30

Part of subcall function 00007FF7E5A065D0: closesocket.WS2_32 ref: 00007FF7E5A06613

Strings

Immediate connect fail for %s: %s, xrefs: 00007FF7E5A081B8
Trying %s:%ld..., xrefs: 00007FF7E5A07E3F
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF7E5A0822E
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF7E5A07FBA
Could not set TCP_NODELAY: %s, xrefs: 00007FF7E5A07EBA
@, xrefs: 00007FF7E5A07ED7
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF7E5A0804D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 4332ac8226c2ecdce437c53bd151d02491bb9bbcc8a49051d32adef8a4035693
Instruction ID: ea0e8483d3666759306bf5c28a3d94fd54ffff9b21b922b3d78c9777f0655cef
Opcode Fuzzy Hash: 4332ac8226c2ecdce437c53bd151d02491bb9bbcc8a49051d32adef8a4035693
Instruction Fuzzy Hash: 8EF1D271B1828A86E710AB35D464BBEAB90FF44F88F804036DA4DC7695DF7CE545CB22

Function 00007FF7E5A08660 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF7E5A324BA,?,?,?,?,00007FF7E5A089EB), ref: 00007FF7E5A08674
GetProcAddress.KERNEL32(?,?,00007FF7E5A324BA,?,?,?,?,00007FF7E5A089EB), ref: 00007FF7E5A08699
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF7E5A324BA,?,?,?,?,00007FF7E5A089EB), ref: 00007FF7E5A086AC

Strings

LoadLibraryExA, xrefs: 00007FF7E5A0868A
kernel32, xrefs: 00007FF7E5A0866D
AddDllDirectory, xrefs: 00007FF7E5A086F3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 230c0ed0a1b2d880a65c49ba9e4704915758f5ad6352508eade00287004d952d
Instruction ID: 359103fa047b4f43d9a3de21f54660026997f126d54d0f4a4ff2c8db50e855e2
Opcode Fuzzy Hash: 230c0ed0a1b2d880a65c49ba9e4704915758f5ad6352508eade00287004d952d
Instruction Fuzzy Hash: ED41E912B0964786FB05AF66A420639ABD1EF49FD5F884136CE0D83794DF3CD486C725

Function 00007FF7E5A14A60 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF7E5A14AA1
htonl.WS2_32 ref: 00007FF7E5A14ACE
setsockopt.WS2_32 ref: 00007FF7E5A14B05
bind.WS2_32 ref: 00007FF7E5A14B20
getsockname.WS2_32 ref: 00007FF7E5A14B3C
listen.WS2_32 ref: 00007FF7E5A14B51
socket.WS2_32 ref: 00007FF7E5A14B68
connect.WS2_32 ref: 00007FF7E5A14B87
accept.WS2_32 ref: 00007FF7E5A14B9E
send.WS2_32 ref: 00007FF7E5A14BEC
recv.WS2_32 ref: 00007FF7E5A14C0A
memcmp.VCRUNTIME140 ref: 00007FF7E5A14C25
closesocket.WS2_32 ref: 00007FF7E5A14C31

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 6e6282c668dcfc894862906e82aaace15aa8d0c260b38d1dd148d6634827d9ca
Instruction ID: d48eb5a31e90dcf14a13e31b4370b7713074347fe277a6f6d076f71574e2ed0d
Opcode Fuzzy Hash: 6e6282c668dcfc894862906e82aaace15aa8d0c260b38d1dd148d6634827d9ca
Instruction Fuzzy Hash: A3519F71708A4A82D710AF25E560A69B761EF84FB4F904336EA7E83AE4DF3CD4458711

Function 00007FF7E5A06980 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Connection time-out, xrefs: 00007FF7E5A06A69
Failed to connect to %s port %ld: %s, xrefs: 00007FF7E5A06EAE
Connection failed, xrefs: 00007FF7E5A06D66
connect to %s port %ld failed: %s, xrefs: 00007FF7E5A06BFD
After %I64dms connect time, move on!, xrefs: 00007FF7E5A06B45

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: e2eedc7052c941d1432b2a018d79d9ac4f8581cfbb25bdcbeb98e85e99d6e6c7
Instruction ID: ecfe1b8a802655a8ccda63789f442555679eac4b2dd3dca8ff42f3f7fe3b2a56
Opcode Fuzzy Hash: e2eedc7052c941d1432b2a018d79d9ac4f8581cfbb25bdcbeb98e85e99d6e6c7
Instruction Fuzzy Hash: 93E10461B1868A82EB14AB34D464BB9ABA0FF49B9CF844237DA5D877C1DF3CE451C311

Function 00007FF7E59E2AA0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E28A7
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2917
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2977
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E29C7
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2A17

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2C48

Part of subcall function 00007FF7E59E48C0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E4980

Part of subcall function 00007FF7E5A3F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7E59E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E5A3F20A

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2C98
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2CD7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2D25
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2D64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2E18
memcpy.VCRUNTIME140 ref: 00007FF7E59E2E3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2F13
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2F5A
ShellExecuteA.SHELL32 ref: 00007FF7E59E3052
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E305A
MessageBoxA.USER32 ref: 00007FF7E59E3090
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E30A1
Sleep.KERNEL32 ref: 00007FF7E59E3109
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E3111
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E3118

Part of subcall function 00007FF7E59E3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E326F
Part of subcall function 00007FF7E59E3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E32B0

Part of subcall function 00007FF7E59E3C30: memcpy.VCRUNTIME140 ref: 00007FF7E59E3C83

Part of subcall function 00007FF7E59E32D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E33B0

Part of subcall function 00007FF7E59E33D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E34B0

Strings

invalidver, xrefs: 00007FF7E59E2FD9
success, xrefs: 00007FF7E59E2E76
Failure, xrefs: 00007FF7E59E3087
download, xrefs: 00007FF7E59E3015
message, xrefs: 00007FF7E59E2FA3, 00007FF7E59E3061
open, xrefs: 00007FF7E59E3049
sessionid, xrefs: 00007FF7E59E2E9E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 1e7466b00c29e06c08f4ea5f87bbe137f5503f3082a7dc0f4c96e7eef9db421e
Instruction ID: dc444fb0d285cca5dfc0fabb0fae644670bf02ab609d5703a97ff4556d686490
Opcode Fuzzy Hash: 1e7466b00c29e06c08f4ea5f87bbe137f5503f3082a7dc0f4c96e7eef9db421e
Instruction Fuzzy Hash: A502E662A0CB8A85EB00EB64E4543EDA7A1FF45B98F805236DA5D87BD5DF3CE084C351

Function 00007FF7E5A1B5C0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E5A1BC01
memcpy.VCRUNTIME140 ref: 00007FF7E5A1BC1D

Strings

schannel: can't renogotiate, an error is pending, xrefs: 00007FF7E5A1BB82
schannel: failed to decrypt data, need more data, xrefs: 00007FF7E5A1BB2A
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF7E5A1BBA2
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF7E5A1B665
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF7E5A1BA18
schannel: enough decrypted data is already available, xrefs: 00007FF7E5A1B645
schannel: remote party requests renegotiation, xrefs: 00007FF7E5A1B9E2
schannel: unable to re-allocate memory, xrefs: 00007FF7E5A1B6FD, 00007FF7E5A1BB66
schannel: renegotiation failed, xrefs: 00007FF7E5A1BB8E
schannel: server closed the connection, xrefs: 00007FF7E5A1BA94
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF7E5A1BA5F
schannel: failed to read data from server: %s, xrefs: 00007FF7E5A1BB52
schannel: server indicated shutdown in a prior call, xrefs: 00007FF7E5A1B688
schannel: Curl_read_plain returned error %d, xrefs: 00007FF7E5A1B961
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF7E5A1B78D
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF7E5A1BBAE

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 507de865ae20c84d9630f303409964dba77a077305b430b96329f337efb5b13c
Instruction ID: b489abd76f63ca195fa9e6c4e9bbcb3b2708ad613f5d4400742f39c0e39342de
Opcode Fuzzy Hash: 507de865ae20c84d9630f303409964dba77a077305b430b96329f337efb5b13c
Instruction Fuzzy Hash: EF0200B2B08A8E85EB10EB19E5A4B69ABA4FF44F94F904537CA4DC3790DF78D441C712

Function 00007FF7E5A1AA50 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1AB40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1AB91
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1ABD4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1ACB7
memcpy.VCRUNTIME140 ref: 00007FF7E5A1AD59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1ADC2
memcpy.VCRUNTIME140 ref: 00007FF7E5A1AE9A
memset.VCRUNTIME140 ref: 00007FF7E5A1B067
CertFreeCertificateContext.CRYPT32 ref: 00007FF7E5A1B0CA

Strings

schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF7E5A1AEC6
schannel: unable to allocate memory, xrefs: 00007FF7E5A1B1BF
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7E5A1AF2B
SSL: public key does not match pinned public key!, xrefs: 00007FF7E5A1B0AC, 00007FF7E5A1B0D4
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF7E5A1AF5E, 00007FF7E5A1B172
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF7E5A1AF74
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7E5A1B10A
schannel: unable to re-allocate memory, xrefs: 00007FF7E5A1ABE2
SSL: failed retrieving public key from server certificate, xrefs: 00007FF7E5A1B0EA

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: c9e05a40f0cb92ecf249dafa461975e93a9a3ec0d6669a3a129753aa29b99d16
Instruction ID: 3819590129aa4337ce60f736e5e11a097eb73faa9ab2cad87202300f77b37b88
Opcode Fuzzy Hash: c9e05a40f0cb92ecf249dafa461975e93a9a3ec0d6669a3a129753aa29b99d16
Instruction Fuzzy Hash: 6D129F72708B8A85EB60AF29D964BAAABA0FF44F84F904137CA5D87790DF38D441C751

Function 00007FF7E5A19C70 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7E5A19D41
GetProcAddress.KERNEL32 ref: 00007FF7E5A19D51

Strings

schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF7E5A1A9E9
schannel: unable to allocate memory, xrefs: 00007FF7E5A1A847
wine_get_version, xrefs: 00007FF7E5A19D4A
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF7E5A19D22
schannel: ALPN, offering %s, xrefs: 00007FF7E5A1A775
http/1.1, xrefs: 00007FF7E5A1A753
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF7E5A1A90C, 00007FF7E5A1A953
http/1.1, xrefs: 00007FF7E5A1A767
ntdll, xrefs: 00007FF7E5A19D3A
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7E5A1A92D
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7E5A19DE2
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7E5A1A733
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF7E5A1A6EF

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 1c6c036b66d62122edaa9a9478bc004b9b4285ff1e5785000d92acb768e7141a
Instruction ID: 71268726a058658fa00d371bc5c98ac07b88f8e615e7268b1e3e2070d97b4fbe
Opcode Fuzzy Hash: 1c6c036b66d62122edaa9a9478bc004b9b4285ff1e5785000d92acb768e7141a
Instruction Fuzzy Hash: 7402C272B08B898AE720AB24D560BFD7BA4FF44B88F804136DA4E87791DF38D544C752

Function 00007FF7E59FB2B0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB2E2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB37D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF7E59FB396

Part of subcall function 00007FF7E5A14A60: socket.WS2_32 ref: 00007FF7E5A14AA1

DeleteCriticalSection.KERNEL32 ref: 00007FF7E59FB3D0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB3E4
closesocket.WS2_32 ref: 00007FF7E59FB402
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB438
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59FB43E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FB46D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB487
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FB490
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59FB4C5
EnterCriticalSection.KERNEL32 ref: 00007FF7E59FB4E6
LeaveCriticalSection.KERNEL32 ref: 00007FF7E59FB4FA
CloseHandle.KERNEL32 ref: 00007FF7E59FB507
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB532
closesocket.WS2_32 ref: 00007FF7E59FB54B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB55F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: fe9dc3e15b7135038b309508d58dd590963aa39b29c1eba6b1d019a3f51d2b9f
Instruction ID: cd440dcbf04a3442310ec8d075a8eb5410886db83b284b082a0a5fc9d6b64f8f
Opcode Fuzzy Hash: fe9dc3e15b7135038b309508d58dd590963aa39b29c1eba6b1d019a3f51d2b9f
Instruction Fuzzy Hash: 2F816E22E05B8682E624EF11E5607B9B760FB94B50F945236CB9E437A1DF7CE4E48321

Function 00007FF7E5A02920 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF7E5A03003
No connections available in cache, xrefs: 00007FF7E5A0331B
No connections available., xrefs: 00007FF7E5A030C1
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF7E5A03172
anonymous, xrefs: 00007FF7E5A02AD8
host, xrefs: 00007FF7E5A02FF0
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF7E5A031A0
proxy, xrefs: 00007FF7E5A02FE2
ftp@example.com, xrefs: 00007FF7E5A02ADF
No more connections allowed to host %s: %zu, xrefs: 00007FF7E5A030B2

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: efddc1f6dacb3119a96794c8e25f0bd1cf04d4b00aa7f066a4e6263cdbba1fe6
Instruction ID: 0a77eec25380dbb537604e32be0bd4ffe4fb8baa67625d0030aa757cc71af8c5
Opcode Fuzzy Hash: efddc1f6dacb3119a96794c8e25f0bd1cf04d4b00aa7f066a4e6263cdbba1fe6
Instruction Fuzzy Hash: C042B622B19B8A51EB59AB31D5607B9AB91FF45F88F844037CE5D87781DF38E460C322

Function 00007FF7E5A018B0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59F1B61,?,?,?,?,00007FF7E59E3591), ref: 00007FF7E5A018C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A01911

Strings

`, xrefs: 00007FF7E5A01BAA
<, xrefs: 00007FF7E5A01B4E
<, xrefs: 00007FF7E5A01A27
v, xrefs: 00007FF7E5A01BBF
<, xrefs: 00007FF7E5A01B58

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction ID: 30e22df387c9f555a27fda3846498d8f522b3ddaa82bd92052f69ada4f1691d3
Opcode Fuzzy Hash: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction Fuzzy Hash: B3914A32A08BC586E3009F34D4143E97BA0FB55F5CF585239CE994A39ADFBAA094C721

Function 00007FF7E5A07300 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF7E5A0736C
WSAGetLastError.WS2_32 ref: 00007FF7E5A07376

Part of subcall function 00007FF7E59F2500: GetLastError.KERNEL32 ref: 00007FF7E59F2522
Part of subcall function 00007FF7E59F2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F252A

getsockname.WS2_32 ref: 00007FF7E5A073F6
WSAGetLastError.WS2_32 ref: 00007FF7E5A07400

Strings

ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF7E5A0751C
getpeername() failed with errno %d: %s, xrefs: 00007FF7E5A07396
getsockname() failed with errno %d: %s, xrefs: 00007FF7E5A07420
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF7E5A07486

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 78bda30eb9f00ef79d3851da8f0a2d784c8795b32e686334d913f5884b7e80e3
Instruction ID: 5b79cb6f6ede7b09599a4a9f1c2200e122feaed5f59d2afa6119f41e4477b6de
Opcode Fuzzy Hash: 78bda30eb9f00ef79d3851da8f0a2d784c8795b32e686334d913f5884b7e80e3
Instruction Fuzzy Hash: 0F919062A18BC582D710DF25D4607F9B7A0FB89F88F845236DE4C87615EF38E185CB21

Function 00007FF7E5A186D0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF7E5A186F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1875E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18798
memcpy.VCRUNTIME140(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A187B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A187BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A187FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18803
freeaddrinfo.WS2_32(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18831
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18845
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1884F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1885C
WSASetLastError.WS2_32(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1887D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction ID: 4767a389bc155e0f0dbf2413027483e52e7a873dc7e07e0f2255b5c4dede480a
Opcode Fuzzy Hash: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction Fuzzy Hash: E5512F75B09B4A86EA25AF11A660A39FBA1FF44F90F944036CE8E93750DF3CE444C721

Function 00007FF7E5A15FE0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF7E5A1603D
Sleep.KERNEL32 ref: 00007FF7E5A1604E
WSASetLastError.WS2_32 ref: 00007FF7E5A161B8
Sleep.KERNEL32 ref: 00007FF7E5A161C9
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A1627C
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A16293
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A162AE
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A162C2
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A162DD
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A162F1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction ID: 3e456775511b5ffc075d0a6ab2bb083ee420bc8ab7623e607e96aff75f25b5de
Opcode Fuzzy Hash: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction Fuzzy Hash: 7C915EB1F0C64686EB646E289A60BB9EA91FF44B44FD04136DA1DCBFC5DF3CD9008611

Function 00007FF7E5A04EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A04F3F

Strings

Couldn't resolve proxy '%s', xrefs: 00007FF7E5A0511C
Couldn't resolve host '%s', xrefs: 00007FF7E5A05071
Unix socket path too long: '%s', xrefs: 00007FF7E5A04F96

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: d745ec9ae58cf2da707b93dddb6ae0445aae9b10f91d28d0416c49dab86b07c7
Instruction ID: 875a86d5c6775514a2206adaf0eb14889da72ec2d42a42b18b20a330c2b14bae
Opcode Fuzzy Hash: d745ec9ae58cf2da707b93dddb6ae0445aae9b10f91d28d0416c49dab86b07c7
Instruction Fuzzy Hash: 1F51C421B1C68A82F619BB35A460B79ABD0FF48B94F940036DB5D83390EF3DE5518B21

Function 00007FF7E59E2840 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E28A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2917
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2977
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E29C7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2A17
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2A88

Strings

h%49, xrefs: 00007FF7E59E2A5E
.8, xrefs: 00007FF7E59E2A65

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: e1d3076ed9d51c2f839fb864ec69f16c8f30c31a97545b534a8eb50fa7e2259f
Instruction ID: 552880355fede25a41b6f270e9eb6b5ccb68013438c92459d3bd7b138eff9b54
Opcode Fuzzy Hash: e1d3076ed9d51c2f839fb864ec69f16c8f30c31a97545b534a8eb50fa7e2259f
Instruction Fuzzy Hash: 10617322E187DA89F301DFB8E8156BCBB70BB99B48F406239CFC565E15EB785108C365

Function 00007FF7E59FB1A0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A186D0: getaddrinfo.WS2_32 ref: 00007FF7E5A186F2
Part of subcall function 00007FF7E5A186D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1875E
Part of subcall function 00007FF7E5A186D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18798
Part of subcall function 00007FF7E5A186D0: memcpy.VCRUNTIME140(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A187B1
Part of subcall function 00007FF7E5A186D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A187BF
Part of subcall function 00007FF7E5A186D0: freeaddrinfo.WS2_32(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18831
Part of subcall function 00007FF7E5A186D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A18845
Part of subcall function 00007FF7E5A186D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1884F
Part of subcall function 00007FF7E5A186D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB1F5), ref: 00007FF7E5A1885C

WSAGetLastError.WS2_32 ref: 00007FF7E59FB1FB
WSAGetLastError.WS2_32 ref: 00007FF7E59FB205
EnterCriticalSection.KERNEL32 ref: 00007FF7E59FB220
LeaveCriticalSection.KERNEL32 ref: 00007FF7E59FB22F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FB240
send.WS2_32 ref: 00007FF7E59FB263
WSAGetLastError.WS2_32 ref: 00007FF7E59FB26D
LeaveCriticalSection.KERNEL32 ref: 00007FF7E59FB280

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: bf152be5e74fb760d3c049dad89691837c5dff5b7d510eaca98c6ec77837753b
Instruction ID: 0b9725a9763331fa2a1542f09fab7a61918de480952c01551bda98cf73c48665
Opcode Fuzzy Hash: bf152be5e74fb760d3c049dad89691837c5dff5b7d510eaca98c6ec77837753b
Instruction Fuzzy Hash: C7315032B0864A86EB40AF65E4607ADBBA0FF44F98F944132DA5EC3694DF3CD445C762

Function 00007FF7E5A15C40 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7E5A15CA6
WSASetLastError.WS2_32 ref: 00007FF7E5A15E66
Sleep.KERNEL32 ref: 00007FF7E5A15E76
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A15F8A
__WSAFDIsSet.WS2_32 ref: 00007FF7E5A15FA2
Sleep.KERNEL32 ref: 00007FF7E5A15FCD

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction ID: fa14f90644b10ddcbdf193c21787ceb4e9f1bba83bd649349c8a95b2d975ee48
Opcode Fuzzy Hash: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction Fuzzy Hash: 93A14C71B1865A86EB797B149520B79AA95FF48FD4F804236E91EC77C4DF3CD8008B21

Function 00007FF7E5A1BC90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1BD2E
memcpy.VCRUNTIME140 ref: 00007FF7E5A1BDC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1BEFC

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF7E5A1BEC4
select/poll on SSL socket, errno: %d, xrefs: 00007FF7E5A1BEA4

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 3a4e271d13577e66c4e7b199b2b74668bd8fb6e9ad094e93a6e2e9a7a93d1c40
Instruction ID: 3f686357e02dd66ca024aeafb8ff9237935d4220bda5a707fbf8670a5d81e993
Opcode Fuzzy Hash: 3a4e271d13577e66c4e7b199b2b74668bd8fb6e9ad094e93a6e2e9a7a93d1c40
Instruction Fuzzy Hash: 4B718F72B04B098AEB10DB65D560BAD7BA1FF48BA8F500636DE2D877D4EE38D4058711

Function 00007FF7E5A3F85C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF7E5A3F8F3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A3F941
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A3F946
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A3F94E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A3F956
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A3F978
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A3F9D2

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction ID: 09d683f1a0f185324618a537cdc4cfed889cde41bca1cc34c5b287bd7a5b036f
Opcode Fuzzy Hash: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction Fuzzy Hash: 26313011B1814A82FA54BB649471BBD9B91AF45F88FC40037DA4DCB2D7EE3DA8448232

Function 00007FF7E59F6D00 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F6D4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F6D65
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F6E92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F6EBE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF7E59F6F7B
%s, xrefs: 00007FF7E59F6FC7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 25ab57a35ded7b4366cd3229136faa6fbebb1ef31794a7cbe106c78bf5a5e3d9
Instruction ID: 00dafcc1e5ecf70a026e8bf2e5c4a9f9520c16421586cf7b8ebb6a6488ba153c
Opcode Fuzzy Hash: 25ab57a35ded7b4366cd3229136faa6fbebb1ef31794a7cbe106c78bf5a5e3d9
Instruction Fuzzy Hash: AA916132B1878992EB58AB25D5607F9A7A0EF45F84F840536DA4E87295CF38E4708361

Function 00007FF7E5A01190 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A011BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A011D1

Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A00FED
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0100A
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0101E
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0103A
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A01057
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0107A
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0108E
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A010A2
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A010C8
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A010DC
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A010F0
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0113F
Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0114C

Part of subcall function 00007FF7E5A00F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A01175

memset.VCRUNTIME140 ref: 00007FF7E5A01205

Strings

User-Agent: %s, xrefs: 00007FF7E5A0129F
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7E5A013E1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: b4bb99099c09c2f90696dadfa9133446c6bcfceade5dd8e952d596f6c22118ac
Instruction ID: 84e43abc3b4fe76745d28e13f372e91bb9d9e1569f8901a035e5af429e1f98a5
Opcode Fuzzy Hash: b4bb99099c09c2f90696dadfa9133446c6bcfceade5dd8e952d596f6c22118ac
Instruction Fuzzy Hash: 53718062A18BCA81E751EF3594607FDAB51EF85F88F880132DB5D8B685DF38E4418362

Function 00007FF7E5A11710 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A117A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A117B1
memcpy.VCRUNTIME140 ref: 00007FF7E5A117CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1192C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A11935

Strings

1.1, xrefs: 00007FF7E5A1171F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction ID: 24f6db731784fec9542d2e6ffe2c64cdbbe4271460851dff4279f2169b93cc50
Opcode Fuzzy Hash: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction Fuzzy Hash: 755181B2704B8986D664AF22E5507AABBA0FB44F84F844032CF9E87754CF3CE595C711

Function 00007FF7E5A05ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05F96
recv.WS2_32 ref: 00007FF7E5A05FC0
send.WS2_32 ref: 00007FF7E5A05FE3
WSAGetLastError.WS2_32 ref: 00007FF7E5A05FF5

Strings

Send failure: %s, xrefs: 00007FF7E5A06025

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: a6506a0d2cd2bf56def8e955f094f9f147e258e37c492eb6729e9695d4306e10
Instruction ID: 159f2cf5a5258e70a8cf837e87834a3386d3db536be6bf6fa944c67cb1344b77
Opcode Fuzzy Hash: a6506a0d2cd2bf56def8e955f094f9f147e258e37c492eb6729e9695d4306e10
Instruction Fuzzy Hash: F341AF22715B8945EB60AF25A860B7AAA91EF08FACF944136CE6D87384DF3CD440C721

Function 00007FF7E59F7DF8 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F7F48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F7F8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F7FBA

Part of subcall function 00007FF7E59F6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F6D4E
Part of subcall function 00007FF7E59F6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F6D65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F7FEF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7E59F7336

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 064f49bb6e255ade0c927bea9155e5f26801896246ecfeb9cc64ea89652f1773
Instruction ID: 9b3248f1b53262d36789b44c72cb4e7157755a7c832fc26b6445c37039f1b18f
Opcode Fuzzy Hash: 064f49bb6e255ade0c927bea9155e5f26801896246ecfeb9cc64ea89652f1773
Instruction Fuzzy Hash: B7D19F21A0864A85FB54AF2594643FCA3A1EF44F88F884537CE0E97699DF3CE465C372

Function 00007FF7E59E3550 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E28A7
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2917
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2977
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E29C7
Part of subcall function 00007FF7E59E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2A17

MessageBoxA.USER32 ref: 00007FF7E59E3727

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E378A

Strings

keyauth.win, xrefs: 00007FF7E59E36B3
null, xrefs: 00007FF7E59E35B2

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: a149f5d0346e2e4d48248f0c08c14f7f6b43faf1cd1bb1cce2e8f79fdbdf0108
Instruction ID: 95474b78448ff0da18170c557a6496a7495ea7bf7ec702688ab905faec3d28be
Opcode Fuzzy Hash: a149f5d0346e2e4d48248f0c08c14f7f6b43faf1cd1bb1cce2e8f79fdbdf0108
Instruction Fuzzy Hash: E051C022B18B5985FB04EB75D4253EC67A1BB44F88F804136CE4D97B96DF3CA1928362

Function 00007FF7E5A32480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A08660: GetModuleHandleA.KERNEL32(?,?,?,00007FF7E5A324BA,?,?,?,?,00007FF7E5A089EB), ref: 00007FF7E5A08674

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF7E5A089EB), ref: 00007FF7E5A324D0

Strings

secur32.dll, xrefs: 00007FF7E5A324A3
InitSecurityInterfaceA, xrefs: 00007FF7E5A324C6
security.dll, xrefs: 00007FF7E5A324AA

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: f8e17ba8d6c6c72759de793df64b220ff247381932ecd5de2460a51393658e6d
Instruction ID: 3be0b88e341e74ef3f951ad1843a76982e52ac5492e5b43def9720cd814d7f9f
Opcode Fuzzy Hash: f8e17ba8d6c6c72759de793df64b220ff247381932ecd5de2460a51393658e6d
Instruction Fuzzy Hash: 9CF06960F1AA0B80FE14B725A8B1F749E91AF54F48FC40436C50CD2690EE3CE1888322

Function 00007FF7E59F792B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7E59F7336

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: f84caca69c7972fb98c0df09d891486e401f7fb6e43fed5d7a8f50e34cea5287
Instruction ID: 19e3d1bec650dd3e5ad564b1172d03cbe4162df466605f9a70e56c352aa0c58d
Opcode Fuzzy Hash: f84caca69c7972fb98c0df09d891486e401f7fb6e43fed5d7a8f50e34cea5287
Instruction Fuzzy Hash: 17B19221A0864A85FB64AF2594743FCA3A1EF41F88F940537CA1E87299DF3DE564C372

Function 00007FF7E5A112D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A113D0

Part of subcall function 00007FF7E5A11960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A119BA

Part of subcall function 00007FF7E5A11710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A117A8
Part of subcall function 00007FF7E5A11710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A117B1

Strings

TCP4, xrefs: 00007FF7E5A1136A
PROXY %s %s %s %li %li, xrefs: 00007FF7E5A113A4
TCP6, xrefs: 00007FF7E5A11357

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 96fa687422f9b566cd94733f51a11b0d903c0c44d5a23cdfef28e96cef9fcfef
Instruction ID: 56799a9a099ebd5ef35be17dea7593a8a343bc378f0e54e79002b54ab750e85d
Opcode Fuzzy Hash: 96fa687422f9b566cd94733f51a11b0d903c0c44d5a23cdfef28e96cef9fcfef
Instruction Fuzzy Hash: 0741DEB1B0C68A85E750EB21A560BB9BFA1AF45F88F944033DB4DC7685DE3CD804C722

Function 00007FF7E59F5BC0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF7E59F1BF6,?,?,?,?,00000000,?,00007FF7E59E370E), ref: 00007FF7E59F5BDD
closesocket.WS2_32 ref: 00007FF7E59F5CE9
closesocket.WS2_32 ref: 00007FF7E59F5CF6

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: bc6efae724a25be5cf336922f8a5526ea3aa4747548e4227bf4d0a77b276633a
Instruction ID: 2f26668202ab365f25afda52871c32dbfa9c2c025fa38c34975004b533d62eac
Opcode Fuzzy Hash: bc6efae724a25be5cf336922f8a5526ea3aa4747548e4227bf4d0a77b276633a
Instruction Fuzzy Hash: FA413D32B1864A81E740AB35D4603F9A761FF88B58F944232DE5EC62D6EF38D5558332

Function 00007FF7E5A19A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF7E5A19BDC
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF7E5A19BC3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: a38cc91fe961a61f807d027dd041507603a95d00c7f28230958b43a3fdfda65b
Instruction ID: 2878be80828a0e42dac253e68f0f9aa6a6ef8d326fb0a86a39a2e5bf926eda7d
Opcode Fuzzy Hash: a38cc91fe961a61f807d027dd041507603a95d00c7f28230958b43a3fdfda65b
Instruction Fuzzy Hash: 0F51AA61B0C64A8DEB64AB119760B79AA91EF44FE8F944232CA5DC72D1DF3CE441C722

Function 00007FF7E59F5DC0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7E59F61B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F61D7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction ID: 51ca85f7c66e510aa83fd3a38cd805a2c40ff7f278724ee394c5dea67283fe90
Opcode Fuzzy Hash: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction Fuzzy Hash: 16C1E632B0878646EB259B25D4607FDA2A0FF44BA8F944236DE6E837C5DF3CE4518721

Function 00007FF7E5A01E90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A01EF5

Strings

User-Agent: %s, xrefs: 00007FF7E5A01F06
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7E5A02034

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 14735c8d4da5ff9c77df89ee8aaeda6f25f4d3af1a329b697456f181ecc354f3
Instruction ID: ca2075c1ffbd2627a81d3f5c2a96c867adfcddf15e604539aa002807492d37a4
Opcode Fuzzy Hash: 14735c8d4da5ff9c77df89ee8aaeda6f25f4d3af1a329b697456f181ecc354f3
Instruction Fuzzy Hash: 5A518F62A18BC581E7419F35D4607E9AB51EF84F9CF884132DB8D8B39ACF78D491C321

Function 00007FF7E5A05CF0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7E5A05CFC
WSAGetLastError.WS2_32 ref: 00007FF7E5A05D0B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction ID: 3a626de1a5290f89b678e6cf9211122705e9d19e009e430217ec472addb094fb
Opcode Fuzzy Hash: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction Fuzzy Hash: 9DE0DF61F0450942FF2967B0E864B7815909F48B76F844735CA3BC63C0DA3C44D24322

Function 00007FF7E5A065D0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF7E5A06613

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction ID: d781430fd3eb3f792fadd135d783cf10238ebcdc41d81eda7ddda95aa8bf1ac9
Opcode Fuzzy Hash: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction Fuzzy Hash: D001B921B1554581FF58EB7AE1687BDA790EF88F88F884032D70DC7295CF38D4A18722

Function 00007FF7E5A0E0F0 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7E5A0E119

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction ID: 9cbe83a3a1f8c9784c7841f2b0e00ae16099ce729daa324db1a30d8371235b7a
Opcode Fuzzy Hash: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction Fuzzy Hash: 3DE0E535F0210982CE186731C4A167827506F50B38FC04372C63D472C0CE3CA156AB10

Function 00007FF7E5A18D50 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A18D6B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction ID: ee4f9163e884d83693234836f3e1e783d0fe8067e2198cd2e090fcdb1e396c9c
Opcode Fuzzy Hash: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction Fuzzy Hash: F3D02B63B18A04839F10DFB1A850029E751BB88774B884339EE7D827E0DB3CD1454600

Function 00007FF7E5A14C90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF7E5A14CA9

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction ID: 4f7dc29ce8e321f07a9a5245ec9587b1bad93b71fd6fe93e29d7e1ebe612de3c
Opcode Fuzzy Hash: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction Fuzzy Hash: 26C08066F14581C2D3446F715485187A7B1AFC4614FD55436D34782124DD3CC2E58B50

Non-executed Functions

Function 00007FF7E5A12890 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A13A53

Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C15
Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C30

memchr.VCRUNTIME140 ref: 00007FF7E5A13B46
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A13C5E
strchr.VCRUNTIME140 ref: 00007FF7E5A13C72
strchr.VCRUNTIME140 ref: 00007FF7E5A13C9A
strchr.VCRUNTIME140 ref: 00007FF7E5A13CB0

Strings

Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF7E5A1389C, 00007FF7E5A138E8
Received 101, xrefs: 00007FF7E5A13D2B
Content-Length:, xrefs: 00007FF7E5A12D9F
Received HTTP/0.9 when not allowed, xrefs: 00007FF7E5A13BBB
HTTP 1.0, assume close after body, xrefs: 00007FF7E5A12CF7
RTSP/%1d.%1d%c%3d, xrefs: 00007FF7E5A12C1D
The requested URL returned error: %s, xrefs: 00007FF7E5A13CC7
Unsupported HTTP version in response, xrefs: 00007FF7E5A13C31
Mark bundle as not supporting multiuse, xrefs: 00007FF7E5A12ACF
HTTP, xrefs: 00007FF7E5A13C4E
Proxy-authenticate:, xrefs: 00007FF7E5A13551
The requested URL returned error: %d, xrefs: 00007FF7E5A13E23
close, xrefs: 00007FF7E5A13023, 00007FF7E5A131A3
Location:, xrefs: 00007FF7E5A1365E
Got 417 while waiting for a 100, xrefs: 00007FF7E5A13A33
Invalid Content-Length: value, xrefs: 00007FF7E5A13D08
HTTP/1.1 proxy connection set close!, xrefs: 00007FF7E5A1323D
Set-Cookie:, xrefs: 00007FF7E5A13423
Overflow Content-Length: value!, xrefs: 00007FF7E5A12E2B
Lying server, not serving HTTP/2, xrefs: 00007FF7E5A12AAC
keep-alive, xrefs: 00007FF7E5A12F56, 00007FF7E5A130E6
HTTP error before end of send, stop sending, xrefs: 00007FF7E5A13A9D
HTTP error before end of send, keep sending, xrefs: 00007FF7E5A13A79
Keep sending data to get tossed away!, xrefs: 00007FF7E5A13AEC
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF7E5A1321C
WWW-Authenticate:, xrefs: 00007FF7E5A13526
HTTP/, xrefs: 00007FF7E5A12B99
Content-Encoding:, xrefs: 00007FF7E5A13291
Content-Range:, xrefs: 00007FF7E5A1335E
Connection:, xrefs: 00007FF7E5A1305B, 00007FF7E5A13110
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF7E5A1325B
Content-Type:, xrefs: 00007FF7E5A12E46
HTTP/%1[23] %d, xrefs: 00007FF7E5A12A54
false, xrefs: 00007FF7E5A13600
HTTP %3d, xrefs: 00007FF7E5A12AF8
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF7E5A13846
, xrefs: 00007FF7E5A12C32
RTSP/, xrefs: 00007FF7E5A12984
Persistent-Auth, xrefs: 00007FF7E5A135C2
Last-Modified:, xrefs: 00007FF7E5A134C7
Transfer-Encoding:, xrefs: 00007FF7E5A131DA
Proxy-Connection:, xrefs: 00007FF7E5A12EC3, 00007FF7E5A12F9C
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF7E5A1361C
Retry-After:, xrefs: 00007FF7E5A132D3
, xrefs: 00007FF7E5A12A7C
HTTP/%1d.%1d%c%3d, xrefs: 00007FF7E5A12A29
Maximum file size exceeded, xrefs: 00007FF7E5A13CEF

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: 29391b55335036efc77e5294a79f8f76e0da53b964b828aae9b04ff18febf4e3
Instruction ID: 5539570c3e22b4bf8c2eac9bcf24ec30bbab4bd36561c362942ebba05b8a19f6
Opcode Fuzzy Hash: 29391b55335036efc77e5294a79f8f76e0da53b964b828aae9b04ff18febf4e3
Instruction Fuzzy Hash: DCC286B1B0868A45EB54AF259564BF9BF91AF41F88F884137CA4D8B2C5DE3DE444C332

Function 00007FF7E5A2D220 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C15
Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C30

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2D2AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2D2E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2D2EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2D309
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2D31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2D325
#22.WLDAP32 ref: 00007FF7E5A2D336
#211.WLDAP32 ref: 00007FF7E5A2D3D0
#217.WLDAP32 ref: 00007FF7E5A2D3EC
#211.WLDAP32 ref: 00007FF7E5A2D405
#211.WLDAP32 ref: 00007FF7E5A2D417
#60.WLDAP32 ref: 00007FF7E5A2D447
#211.WLDAP32 ref: 00007FF7E5A2D562
#60.WLDAP32 ref: 00007FF7E5A2D587
#22.WLDAP32 ref: 00007FF7E5A2D62A
#41.WLDAP32 ref: 00007FF7E5A2DA46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DA6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DA78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DA98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DAAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DAB4
#46.WLDAP32 ref: 00007FF7E5A2DAC6

Strings

encrypted, xrefs: 00007FF7E5A2D37E
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF7E5A2D46B
LDAP remote: %s, xrefs: 00007FF7E5A2D6A7
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF7E5A2D634
LDAP local: trying to establish %s connection, xrefs: 00007FF7E5A2D369
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF7E5A2D254
DN: , xrefs: 00007FF7E5A2D722
Microsoft Corporation., xrefs: 00007FF7E5A2D240
LDAP local: %s, xrefs: 00007FF7E5A2D33C
There are more than %d entries, xrefs: 00007FF7E5A2DA56
cleartext, xrefs: 00007FF7E5A2D35F
LDAP local: %s, xrefs: 00007FF7E5A2D297
;binary, xrefs: 00007FF7E5A2D8B0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 831d87dee25c1670673b59d4b4179000b4e3fe808a50e4d779f915d0a570c901
Instruction ID: 6a1603e62b657cf4bca96165e1d403f3dcc488fcfa36b45bed0532a36c9f3ae8
Opcode Fuzzy Hash: 831d87dee25c1670673b59d4b4179000b4e3fe808a50e4d779f915d0a570c901
Instruction Fuzzy Hash: D642A365B08A4A86E710AB61D465BBDABE1FF44F88F804036CE0EA7755DE3CE446C351

Function 00007FF7E59E955D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 978COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7E59E9F5D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7E59E9F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA0BB

Strings

object, xrefs: 00007FF7E59EA309
array, xrefs: 00007FF7E59EA17A
object separator, xrefs: 00007FF7E59E9C63, 00007FF7E59EA49A
object key, xrefs: 00007FF7E59E9DEF, 00007FF7E59EA629
number overflow parsing ', xrefs: 00007FF7E59E9F80

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 5dc6d2020e20b7b7b4f3fd0f005dc465797da0486d902d5c39db5575fa961406
Instruction ID: 0968a147f40c1101ad1a92cb7f65eb91c089526c89309175992e3e84a8812cdf
Opcode Fuzzy Hash: 5dc6d2020e20b7b7b4f3fd0f005dc465797da0486d902d5c39db5575fa961406
Instruction Fuzzy Hash: F4A2C762B1CB4985EB10EB64E4543EDA7A1FF41BA4F805232DA5D87AE9DF7CD081C311

Function 00007FF7E5A29520 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2956F
WSAStartup.WS2_32 ref: 00007FF7E5A29610
FreeLibrary.KERNEL32 ref: 00007FF7E5A297FD
GetStdHandle.KERNEL32 ref: 00007FF7E5A2980C
GetFileType.KERNEL32 ref: 00007FF7E5A2982D
WaitForMultipleObjects.KERNEL32 ref: 00007FF7E5A29877
PeekNamedPipe.KERNEL32 ref: 00007FF7E5A298FC
ReadFile.KERNEL32 ref: 00007FF7E5A29923
ReadFile.KERNEL32 ref: 00007FF7E5A299DD
WSAGetLastError.WS2_32 ref: 00007FF7E5A29A3E
WSAGetLastError.WS2_32 ref: 00007FF7E5A29C3A
FreeLibrary.KERNEL32 ref: 00007FF7E5A29C5A
GetLastError.KERNEL32 ref: 00007FF7E5A29C64

Part of subcall function 00007FF7E5A2A490: send.WS2_32 ref: 00007FF7E5A2A4CD
Part of subcall function 00007FF7E5A2A490: WSAGetLastError.WS2_32 ref: 00007FF7E5A2A4D7

Strings

insufficient winsock version to support telnet, xrefs: 00007FF7E5A29C9F
WSACreateEvent failed (%d), xrefs: 00007FF7E5A2977E
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF7E5A29C6A
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF7E5A29760
, xrefs: 00007FF7E5A29C02
WSAStartup failed (%d), xrefs: 00007FF7E5A2961D
Time-out, xrefs: 00007FF7E5A29C17
failed to find WSAEventSelect function (%u), xrefs: 00007FF7E5A29737
failed to find WSACreateEvent function (%u), xrefs: 00007FF7E5A296C3
failed to load WS2_32.DLL (%u), xrefs: 00007FF7E5A2968B
WSACloseEvent failed (%d), xrefs: 00007FF7E5A29C40
WSAEventSelect, xrefs: 00007FF7E5A29711
WSAEnumNetworkEvents, xrefs: 00007FF7E5A29740
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF7E5A29A52
failed to find WSACloseEvent function (%u), xrefs: 00007FF7E5A296EC
WSACloseEvent, xrefs: 00007FF7E5A296CC
WSACreateEvent, xrefs: 00007FF7E5A296A5
WS2_32.DLL, xrefs: 00007FF7E5A2965E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: 3a84ad12ddd9242ef5708b47fd60f2fc0ce5b5ff1c798c18c0fc51936d33e422
Instruction ID: 7767d66badbad4ef727194a42f115dbd0ea90cb4adc39c5cb6bcc852392c7323
Opcode Fuzzy Hash: 3a84ad12ddd9242ef5708b47fd60f2fc0ce5b5ff1c798c18c0fc51936d33e422
Instruction Fuzzy Hash: 7412C335B0868A89EB74AF159461BB9AB90FF44F94F844536CA4ED3794DF3CE480C722

Function 00007FF7E59FF0E0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF146
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF16D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF1C8

Strings

-----BEGIN PUBLIC KEY-----, xrefs: 00007FF7E59FF39A
;sha256//, xrefs: 00007FF7E59FF240
-----END PUBLIC KEY-----, xrefs: 00007FF7E59FF3CE
sha256//, xrefs: 00007FF7E59FF13C, 00007FF7E59FF28E
public key hash: sha256//%s, xrefs: 00007FF7E59FF1DE

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 87d8b74bfaf9f01fe411e33134954ef59d3277864874ae862f6e598a426349ef
Instruction ID: 3b797e5847844d3d3f39278cfa35d5a9bc7a23ae85a2107dadbf9f4e267a5c2e
Opcode Fuzzy Hash: 87d8b74bfaf9f01fe411e33134954ef59d3277864874ae862f6e598a426349ef
Instruction Fuzzy Hash: C8A18221B09A4A81FA10AB65A4647B9AA90EF45FD0FC85033DE0E87795EF3CE455C732

Function 00007FF7E5A363F0 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E5A36436

Part of subcall function 00007FF7E59F2640: GetLastError.KERNEL32 ref: 00007FF7E59F265C
Part of subcall function 00007FF7E59F2640: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F2664

CreateFileA.KERNEL32 ref: 00007FF7E5A36490
GetLastError.KERNEL32 ref: 00007FF7E5A364A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A367DD

Strings

schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF7E5A36539
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7E5A365DE
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF7E5A367B3
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7E5A367A2
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7E5A36450
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7E5A36781
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF7E5A36716
-----END CERTIFICATE-----, xrefs: 00007FF7E5A36609
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7E5A36765
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF7E5A366E0
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF7E5A36735
schannel: failed to open CA file '%s': %s, xrefs: 00007FF7E5A364BB
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF7E5A36502

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 919779ac502394a4df49bfc1684378c912bd20c5370d5fdb507a62585e4b15d8
Instruction ID: 675d563742b5082333a5a416889507bdaa9f83c3b150c3e02f6b24468648bde6
Opcode Fuzzy Hash: 919779ac502394a4df49bfc1684378c912bd20c5370d5fdb507a62585e4b15d8
Instruction Fuzzy Hash: E1B1A361B1874982EA10AB65E464BADAAA1BF44FD8FC00137DE4D87794DF7CE504CB22

Function 00007FF7E5A03330 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7E5A0338A
memset.VCRUNTIME140 ref: 00007FF7E5A0339F
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A033BB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A033E2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A03459
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0348C
strchr.VCRUNTIME140 ref: 00007FF7E5A03576
strchr.VCRUNTIME140 ref: 00007FF7E5A035BB
strchr.VCRUNTIME140 ref: 00007FF7E5A035EB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A03693

Part of subcall function 00007FF7E5A1BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BF68
Part of subcall function 00007FF7E5A1BF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BF8E
Part of subcall function 00007FF7E5A1BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BFAF
Part of subcall function 00007FF7E5A1BF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A03766
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A03795
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A037BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A037E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A037F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A03807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A039AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A039B3

Strings

all_proxy, xrefs: 00007FF7E5A03719
no_proxy, xrefs: 00007FF7E5A034B1
ALL_PROXY, xrefs: 00007FF7E5A03730
NO_PROXY, xrefs: 00007FF7E5A034CD
_proxy, xrefs: 00007FF7E5A036A9
Uses proxy env variable %s == '%s', xrefs: 00007FF7E5A034EC, 00007FF7E5A0374A
memory shortage, xrefs: 00007FF7E5A03467
http_proxy, xrefs: 00007FF7E5A036DD

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 85b546518fe974906508f346c34f15a72552962cb0c771cf6e189cb72353a543
Instruction ID: 9a956ce68610abd1b05ae7ee3ff23329a0569f78bbfd92b404442dc6795ede75
Opcode Fuzzy Hash: 85b546518fe974906508f346c34f15a72552962cb0c771cf6e189cb72353a543
Instruction Fuzzy Hash: 3A02C461B1D78A85EA51EB21A464BB9AF94EF45F88F880037DE4D87795DF3CE004C722

Function 00007FF7E5A315B0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A31666
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A31721
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3172F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A31741

Strings

WDigest, xrefs: 00007FF7E5A315F1, 00007FF7E5A31A25
digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF7E5A3195B
realm, xrefs: 00007FF7E5A318C7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: 7071650c09dff2dad16001d1756b7afe7cc268e2c7eedb60c4a3bb5df4c44f15
Instruction ID: 6857adf2621d61eb37990ffec309607a9dd96ea9d99d6e7f7a4f4def28131f1d
Opcode Fuzzy Hash: 7071650c09dff2dad16001d1756b7afe7cc268e2c7eedb60c4a3bb5df4c44f15
Instruction Fuzzy Hash: A1121B32B08B4AC6EB10AF61E464BADBBA4FF44B88F940136DA4E83B54DF38D545C751

Function 00007FF7E5A07630 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7E5A07702
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0771D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0775C

Strings

Local port: %hu, xrefs: 00007FF7E5A07B05
bind failed with errno %d: %s, xrefs: 00007FF7E5A07AE8
Couldn't bind to interface '%s', xrefs: 00007FF7E5A078A0
Bind to local port %hu failed, trying next, xrefs: 00007FF7E5A07A10
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF7E5A07928
getsockname() failed with errno %d: %s, xrefs: 00007FF7E5A07AAC
Couldn't bind to '%s', xrefs: 00007FF7E5A077F2
Local Interface %s is ip %s using address family %i, xrefs: 00007FF7E5A07817

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 3e5bc1e74b012f5f58e1374a4c72a9ebe9ef3efd138e2f1c7d373a212fd8c81f
Instruction ID: 9f3d4bb79400b4742dfacc23f9b6f2afe2089d1b34dd23d90993673020af81ca
Opcode Fuzzy Hash: 3e5bc1e74b012f5f58e1374a4c72a9ebe9ef3efd138e2f1c7d373a212fd8c81f
Instruction Fuzzy Hash: A0E1E522F2868685EB10EB65A460BB9AB60FF89F88F805137DE4E83755DF7CD444C711

Function 00007FF7E5A19FFC Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A1A098
strchr.VCRUNTIME140 ref: 00007FF7E5A1A0C4
strchr.VCRUNTIME140 ref: 00007FF7E5A1A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1A122
strchr.VCRUNTIME140 ref: 00007FF7E5A1A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1A24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A1A375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A1A3A1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7E5A1A4D9
CurrentUser, xrefs: 00007FF7E5A1A112
, xrefs: 00007FF7E5A19FFC

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 0f6e02ceec97318be6b8f6dc4e8b7d26f1a3ae136c02508b05c6ed373cd8a422
Instruction ID: 8b2dca459d4faa0d2b43c70c9b718c7fb01874172fd449e5c04547a43ea57b74
Opcode Fuzzy Hash: 0f6e02ceec97318be6b8f6dc4e8b7d26f1a3ae136c02508b05c6ed373cd8a422
Instruction Fuzzy Hash: 6781C261B0964B82FB55AF25A960B79AB90BF44F94FC44136CA1EC63D0EF3CE444C362

Function 00007FF7E59E973B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7E59E9F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA0BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA0FA

Strings

object, xrefs: 00007FF7E59EA309
array, xrefs: 00007FF7E59EA17A
number overflow parsing ', xrefs: 00007FF7E59E9F80

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 24dbfc32c8dc895f344db0d517b328b1238d857ed911aa6ec1f707056b30ba47
Instruction ID: 2ee5db4742e5861d45a9ef1a8f62383ff19dd4a5feb7488063a6b4ca3bbf26de
Opcode Fuzzy Hash: 24dbfc32c8dc895f344db0d517b328b1238d857ed911aa6ec1f707056b30ba47
Instruction Fuzzy Hash: B032B762B18B8A85EB10EB68D4543EDA3A1FF45B94F805232DA5D87AE9DF7CD084C311

Function 00007FF7E5A1A005 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A1A098
strchr.VCRUNTIME140 ref: 00007FF7E5A1A0C4
strchr.VCRUNTIME140 ref: 00007FF7E5A1A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1A122
strchr.VCRUNTIME140 ref: 00007FF7E5A1A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1A24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A1A375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A1A3A1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7E5A1A4D9
CurrentUser, xrefs: 00007FF7E5A1A112

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 15180cf14c634b185d4ef2093e72c7660534080491c5eda22c727618502a933b
Instruction ID: fa8c136beda975ba977f5c070305e68c1cf592dcbb5ae2ec598c4f22959f4033
Opcode Fuzzy Hash: 15180cf14c634b185d4ef2093e72c7660534080491c5eda22c727618502a933b
Instruction Fuzzy Hash: F181C361B0964B82FB55AF25A960B79AB90BF44F94FC44136CA1EC63D0EF3CE444C362

Function 00007FF7E5A30580 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF7E5A30613
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A3063D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A30702
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3070E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A30772
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3077E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A30881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3088F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A3089A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A308EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3090E

Strings

default, xrefs: 00007FF7E5A3082D
machine, xrefs: 00007FF7E5A307D1, 00007FF7E5A30812
, xrefs: 00007FF7E5A30651, 00007FF7E5A30852
login, xrefs: 00007FF7E5A3079E
password, xrefs: 00007FF7E5A307B9

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 95c53613c4b75bead37d9737eb2d18ca3386db0ad298d740e1b388510a37e02d
Instruction ID: e29a61bffde0eb21ee25c0312b6264ba24e3ab39c2f680897daa40c9b508ad25
Opcode Fuzzy Hash: 95c53613c4b75bead37d9737eb2d18ca3386db0ad298d740e1b388510a37e02d
Instruction Fuzzy Hash: 3FA18821B0D68A85FA61AF259574B7EFE90BF85F48F884033DE4D86694DF3CE4448722

Function 00007FF7E5A19300 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7E5A19340
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A1935F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A19389
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A193A1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A193C6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A193F2
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A19402
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7E5A192C9), ref: 00007FF7E5A19414

Strings

@, xrefs: 00007FF7E5A19355

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction ID: 03d32ba02c0217fd8448711bfd19325948014f2bb40e7b6e9ecc99033d17408c
Opcode Fuzzy Hash: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction Fuzzy Hash: F1314B7270868586E760DF21A554A6ABB60FFC4FC0F444036DA8E97A58CF3CD405CB11

Function 00007FF7E59F2640 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E59F265C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F2664
FormatMessageA.KERNEL32 ref: 00007FF7E59F269E
strchr.VCRUNTIME140 ref: 00007FF7E59F26B3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F26FC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F2706
GetLastError.KERNEL32 ref: 00007FF7E59F270E
SetLastError.KERNEL32 ref: 00007FF7E59F271A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF7E59F26EA

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: 2a26dff799f40e172bf9d9a434e10a599cd41592b269adf14bd1a7543fbd748f
Instruction ID: 33c95a668a5059a85766590794cc2af865a08054935d983b1af8374464df4ea0
Opcode Fuzzy Hash: 2a26dff799f40e172bf9d9a434e10a599cd41592b269adf14bd1a7543fbd748f
Instruction Fuzzy Hash: 68219522B0874A86EB116F61A82077AFAD0BF54FD0F884036DE5993754CF3CE4508732

Function 00007FF7E5A00600 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF7E5A00841
Can not multiplex, even if we wanted to!, xrefs: 00007FF7E5A007BA
can multiplex, xrefs: 00007FF7E5A00702
serially, xrefs: 00007FF7E5A0070E
Multiplexed connection found!, xrefs: 00007FF7E5A00E71
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF7E5A00ECA
Could multiplex, but not asked to!, xrefs: 00007FF7E5A0079C
Server doesn't support multiplex (yet), xrefs: 00007FF7E5A0076F
Server doesn't support multiplex yet, wait, xrefs: 00007FF7E5A0074B
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF7E5A00866
Found bundle for host %s: %p [%s], xrefs: 00007FF7E5A00719

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 0379ac116aa3b89d2553a78560e2e6e0937a33831639c842719652bd6057e29d
Instruction ID: c15395c3a0ab1c878668cb42f6b92dad765a9eaa26fcb84250949443056a2cde
Opcode Fuzzy Hash: 0379ac116aa3b89d2553a78560e2e6e0937a33831639c842719652bd6057e29d
Instruction Fuzzy Hash: 9642B661B1D6CA45EBA5AA3581607B9BF92BF41F4CFD84037CA5D87285DF3CA450C322

Function 00007FF7E5A3FD4C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E5A3FD68
memset.VCRUNTIME140 ref: 00007FF7E5A3FD8C
RtlCaptureContext.KERNEL32 ref: 00007FF7E5A3FD95
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E5A3FDAF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E5A3FDF0
memset.VCRUNTIME140 ref: 00007FF7E5A3FE23
IsDebuggerPresent.KERNEL32 ref: 00007FF7E5A3FE44
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E5A3FE61
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E5A3FE6C

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction ID: 20d676a6334abba6bc8b5e0d83e3fcf055dede2f1b3dbbef110acce741cd6654
Opcode Fuzzy Hash: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction Fuzzy Hash: 08316172704B8586EB60AFA4E8507ED7760FB84B48F40403ADA4D87B94EF3CD548C721

Function 00007FF7E5A3CE40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7E5A3CE87
CryptImportKey.ADVAPI32 ref: 00007FF7E5A3CF59
CryptReleaseContext.ADVAPI32 ref: 00007FF7E5A3CF71
CryptEncrypt.ADVAPI32 ref: 00007FF7E5A3CFA2
CryptDestroyKey.ADVAPI32 ref: 00007FF7E5A3CFAC
CryptReleaseContext.ADVAPI32 ref: 00007FF7E5A3CFB8

Strings

@, xrefs: 00007FF7E5A3CE6D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction ID: 291a6f4baf7628d1523983ded703b77f4f69307e9b85080b465746c1415b2471
Opcode Fuzzy Hash: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction Fuzzy Hash: 18419B22B046A08EF7109BB5E4607EE7FB0EB4A788F444026DE8D57A5ACF3CC11AD750

Function 00007FF7E5A1C5D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF7E5A1C5C8,?,?,?,?,?,?,00007FF7E5A3380E), ref: 00007FF7E5A1C646
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF7E5A1C5C8,?,?,?,?,?,?,00007FF7E5A3380E), ref: 00007FF7E5A1C7AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1C90C

Strings

%c%c==, xrefs: 00007FF7E5A1C773
%c%c%c=, xrefs: 00007FF7E5A1C741
%c%c%c%c, xrefs: 00007FF7E5A1C703

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: d4663184589d98a712ad90b88dcd5440e845ddca40feda83b796be39e2ad880e
Instruction ID: f2e96b246465b7dbc70824ab5dd217ab85dda5ef9152c1c6d12bf5ced5ce41a1
Opcode Fuzzy Hash: d4663184589d98a712ad90b88dcd5440e845ddca40feda83b796be39e2ad880e
Instruction Fuzzy Hash: 4B910972B086E585E721AB25A5207BEAF90EF45F94F884232DBAD877D5CF3CD4008711

Function 00007FF7E5A2B4F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2B56E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2B5CB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2B5F3
bind.WS2_32 ref: 00007FF7E5A2B672
WSAGetLastError.WS2_32 ref: 00007FF7E5A2B67C

Strings

bind() failed; %s, xrefs: 00007FF7E5A2B697

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 043503e0fdb1e12a905a901aa78c990b7d9c545350290c38aea68328abc36be4
Instruction ID: 14464c179413579c46f2a0476ee4ea66a28c5030d530528c0c6973ee3e3538e1
Opcode Fuzzy Hash: 043503e0fdb1e12a905a901aa78c990b7d9c545350290c38aea68328abc36be4
Instruction Fuzzy Hash: 1551E372B0878A86FB14AB25D4657A96BA0FF04F84F444036CB4D87781DF3CE451C721

Function 00007FF7E5A2B750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2B79F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2B7FC
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2B820
bind.WS2_32 ref: 00007FF7E5A2B89B
WSAGetLastError.WS2_32 ref: 00007FF7E5A2B8A5

Strings

bind() failed; %s, xrefs: 00007FF7E5A2B8C0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 5e9d399451e69d20be855dd8e9b27b5fe3cdf2e55046a58bcd62b973cec69776
Instruction ID: 5629d13fe664586feec108905ad379556a1c1444f11033c9cd5c8196ce11b44f
Opcode Fuzzy Hash: 5e9d399451e69d20be855dd8e9b27b5fe3cdf2e55046a58bcd62b973cec69776
Instruction Fuzzy Hash: E3519536B0878E82FB14AB25D461BB9AAA4FF44F84F844036CE4D87785DF3CE4518762

Function 00007FF7E5A153E0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%5I64d, xrefs: 00007FF7E5A153F5
%2I64d.%0I64dG, xrefs: 00007FF7E5A1549A
%2I64d.%0I64dM, xrefs: 00007FF7E5A15429
%4I64dP, xrefs: 00007FF7E5A154FD
%4I64dM, xrefs: 00007FF7E5A1547C
%4I64dk, xrefs: 00007FF7E5A1540E
%4I64dG, xrefs: 00007FF7E5A154D4
%4I64dT, xrefs: 00007FF7E5A154F0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 1a402775ebe9d7af04e26a2663a3cff6c5ec690d9225f72786fb014b8e9cfb9a
Instruction ID: 4bc900d1ace5de0d40b3a70b6c00283da054240cc54b5167f641355e1e09fa30
Opcode Fuzzy Hash: 1a402775ebe9d7af04e26a2663a3cff6c5ec690d9225f72786fb014b8e9cfb9a
Instruction Fuzzy Hash: 2421D195F0994E83FE14F7D5A521FF48AA24F48F80EC44033E90E87391DEBC6542C662

Function 00007FF7E5A400E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF7E59E1870), ref: 00007FF7E5A400FE
GetLastError.KERNEL32 ref: 00007FF7E5A40149
IsDebuggerPresent.KERNEL32 ref: 00007FF7E5A40161
OutputDebugStringW.KERNEL32 ref: 00007FF7E5A40172

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7E5A4016B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: ab1929773185d78aa00c1a2a7ebb499de6df1f4eca2485d34b4072589dd37bee
Instruction ID: ac255b1e720607d1c4e3e0483edd8447f307252bfaf62f6df3ae0ea8701d4f3b
Opcode Fuzzy Hash: ab1929773185d78aa00c1a2a7ebb499de6df1f4eca2485d34b4072589dd37bee
Instruction Fuzzy Hash: C5115B32B14B4A93E744AB66D5607A966E0FF04B41F80413AC64DC6A50EF3CE464C722

Function 00007FF7E5A19230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7E5A19261
CryptGenRandom.ADVAPI32 ref: 00007FF7E5A19275
CryptReleaseContext.ADVAPI32 ref: 00007FF7E5A19286
CryptReleaseContext.ADVAPI32 ref: 00007FF7E5A1929C

Strings

@, xrefs: 00007FF7E5A19249

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction ID: 79a33c3c7fd4e3d7eb9cf4eeda603c0267d9c82039b587d019f8a3db2b6f06a4
Opcode Fuzzy Hash: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction Fuzzy Hash: 5EF0A465B08A8582E7209B61F85473AEB60FFC8FE4F844032DE8D87668DF7CC0858B11

Function 00007FF7E5A09840 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

%ld, xrefs: 00007FF7E5A09B50
.%ld, xrefs: 00007FF7E5A09BA9
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF7E5A09D5B, 00007FF7E5A09DC6
(nil), xrefs: 00007FF7E5A0A0A6
(nil), xrefs: 00007FF7E5A0A024
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF7E5A09883, 00007FF7E5A09D54, 00007FF7E5A09DBB

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 5e1eafa53adae3ce6afb8c9d757bf206f60acaa71a792b37c3c2878a97f52238
Instruction ID: 5905605c23bb0fd0e7bbe9aeda0c8a0d5817f79fc994d871d5c25691341fe68a
Opcode Fuzzy Hash: 5e1eafa53adae3ce6afb8c9d757bf206f60acaa71a792b37c3c2878a97f52238
Instruction Fuzzy Hash: 3742F832B28A4A49E7306E349460B79EF91FF45B9CFD44232DA5D876D4DE3CE8418722

Function 00007FF7E59E1000 Relevance: 6.7, Strings: 5, Instructions: 438COMMON

Download Yara Rule

Strings

8.1, xrefs: 00007FF7E59E1203
https://keyauth.win/api/1.2/, xrefs: 00007FF7E59E1037
8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913, xrefs: 00007FF7E59E1311
loader principal, xrefs: 00007FF7E59E1557
9WIvTVJa9m, xrefs: 00007FF7E59E1539

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: 8.1$8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913$9WIvTVJa9m$https://keyauth.win/api/1.2/$loader principal
API String ID: 0-256606248
Opcode ID: 0dfdf05879803bf8175c6789fdbce2eae093a341d9f58156f62145278cda41a9
Instruction ID: 0e83b5e29443c941d9dec56fc0fc4974f02f17ecfd8323a7f5aaadf75174efaa
Opcode Fuzzy Hash: 0dfdf05879803bf8175c6789fdbce2eae093a341d9f58156f62145278cda41a9
Instruction Fuzzy Hash: F7124D21E2DB8649F703A73598116A8EB549FA3BC4F90D337FD58B1962FF396281C205

Function 00007FF7E5A1C220 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF7E5A1C250
CryptGetHashParam.ADVAPI32 ref: 00007FF7E5A1C276
CryptDestroyHash.ADVAPI32 ref: 00007FF7E5A1C285
CryptReleaseContext.ADVAPI32 ref: 00007FF7E5A1C295

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction ID: 8c74f0b7ac92132778cd0824f240c6577294bf095ca298b58a2866360beb5c14
Opcode Fuzzy Hash: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction Fuzzy Hash: B0014C7660869582EB109FA0E464B2ABB20FF85FC8F944526DB4947A68CF3DD4488A11

Function 00007FF7E5A1C1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7E5A1C1DC
CryptCreateHash.ADVAPI32 ref: 00007FF7E5A1C1FD

Strings

@, xrefs: 00007FF7E5A1C1CC

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction ID: e17968cb2b1b2207993cac6dbe9244eed3d0f5d660ee8f756cbf1d47133ed429
Opcode Fuzzy Hash: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction Fuzzy Hash: 97E04865B1469643F7605BA5E411F26A750FF94F88F844031CF4C4BA58DF3DC1558B15

Function 00007FF7E59EDDE0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7E59EDEE4

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction ID: 3be7669e0fff0e11a63dc1e5367f915c27f9e671beb7b2e15743e78ef4559f73
Opcode Fuzzy Hash: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction Fuzzy Hash: 3D81BB22B19B9989EB00DB69D4A43EC6BB0EB15F88F94402ADF4D87795DF39D081C361

Function 00007FF7E59ED250 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction ID: c1756a2c4e6133ee97162744a5e3abdca845b452737fe8f1009caefe40e028b3
Opcode Fuzzy Hash: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction Fuzzy Hash: 6F61F562B0DB4842DA10DB29E4543B9A3A1E759BD4F90A23ADF5DC7788EF3CE5418310

Function 00007FF7E5A3EEC0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: 2052107c8077091d3cc878d3d88e678c5523c64782c7a56b7a768827f06bf64e
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: E7F08C29324767BEFE00853B8624FBD5E419BD0B01FB379758C80420CB8AAE5493D714

Function 00007FF7E5A1C210 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction ID: 6bb8cd8c921ff3c459f23500964d51c07740b7d63019a452bd3458a9b0fc85ff
Opcode Fuzzy Hash: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction Fuzzy Hash: 72A00265B459498097105755E560E255650EBD8B557555022C50D45410CD3995458211

Function 00007FF7E5A3FEF4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction ID: 72413962a2dd053ca85989d35f770460977ec9cd3c2d5df513c91844adf9c378
Opcode Fuzzy Hash: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction Fuzzy Hash: 3CA00121A28C4A90E604AB44A960A34AA64AF55B44B810036C51D81060AF3CA900C222

Function 00007FF7E5A19430 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 425stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7E5A19463
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A194B3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A194D4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A194EA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A19508
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A19526
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A19544
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1955C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A19574

Strings

CALG_RC4, xrefs: 00007FF7E5A19699
CALG_ECDSA, xrefs: 00007FF7E5A19A14
CALG_TLS1PRF, xrefs: 00007FF7E5A198D3
CALG_HMAC, xrefs: 00007FF7E5A198B5
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF7E5A1981F
CALG_MD4, xrefs: 00007FF7E5A19501
CALG_MAC, xrefs: 00007FF7E5A1956D
CALG_SHA, xrefs: 00007FF7E5A1953D
CALG_RC2, xrefs: 00007FF7E5A1967B
CALG_SEAL, xrefs: 00007FF7E5A196B7
CALG_TEK, xrefs: 00007FF7E5A1976B
CALG_SHA_512, xrefs: 00007FF7E5A199C3
CALG_PCT1_MASTER, xrefs: 00007FF7E5A1983D
CALG_SHA_384, xrefs: 00007FF7E5A199A5
CALG_RSA_SIGN, xrefs: 00007FF7E5A1958B
CALG_HASH_REPLACE_OWF, xrefs: 00007FF7E5A198F1
CALG_SHA1, xrefs: 00007FF7E5A19555
CALG_TLS1_MASTER, xrefs: 00007FF7E5A19879
CALG_3DES, xrefs: 00007FF7E5A1963F
CALG_DES, xrefs: 00007FF7E5A19603
CALG_NO_SIGN, xrefs: 00007FF7E5A195C7
CALG_ECMQV, xrefs: 00007FF7E5A199F9
CALG_RC5, xrefs: 00007FF7E5A19897
CALG_MD5, xrefs: 00007FF7E5A1951F
CALG_ECDH, xrefs: 00007FF7E5A199DE
CALG_DSS_SIGN, xrefs: 00007FF7E5A195A9
CALG_ECDH_EPHEM, xrefs: 00007FF7E5A19A2F
CALG_AES, xrefs: 00007FF7E5A19969
CALG_SSL3_MASTER, xrefs: 00007FF7E5A197C5
CALG_CYLINK_MEK, xrefs: 00007FF7E5A19789
CALG_DH_EPHEM, xrefs: 00007FF7E5A196F3
CALG_RSA_KEYX, xrefs: 00007FF7E5A195E5
CALG_AES_128, xrefs: 00007FF7E5A1990F
CALG_HUGHES_MD5, xrefs: 00007FF7E5A1972F
CALG_AES_192, xrefs: 00007FF7E5A1992D
CALG_SSL2_MASTER, xrefs: 00007FF7E5A1985B
CALG_AES_256, xrefs: 00007FF7E5A1994B
CALG_MD2, xrefs: 00007FF7E5A194E3
CALG_3DES_112, xrefs: 00007FF7E5A19621
CALG_SHA_256, xrefs: 00007FF7E5A19987
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF7E5A197E3
CALG_SSL3_SHAMD5, xrefs: 00007FF7E5A197A7
CALG_DH_SF, xrefs: 00007FF7E5A196D5
CALG_SKIPJACK, xrefs: 00007FF7E5A1974D
CALG_DESX, xrefs: 00007FF7E5A1965D
CALG_AGREEDKEY_ANY, xrefs: 00007FF7E5A19711
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF7E5A19801

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: a95fb3a32220d5d2373a41e2be5983f02937563951c6669e17548706725ee269
Instruction ID: c1b73a8aae3ff4022c9d6b489745d361c0ccf8253f0044b13c31c7979968570b
Opcode Fuzzy Hash: a95fb3a32220d5d2373a41e2be5983f02937563951c6669e17548706725ee269
Instruction Fuzzy Hash: 54122090F1C55F99FB20B764E960BB9AA55AF50B48FC05033D90ECA1D5EE3CE909D322

Function 00007FF7E5A26E90 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A26F8D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2708E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A27101
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2717B

Strings

%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF7E5A27227
Content-Type, xrefs: 00007FF7E5A27413, 00007FF7E5A27449
Content-Type: application/sdp, xrefs: 00007FF7E5A2745D
Accept-Encoding: %s, xrefs: 00007FF7E5A27039
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF7E5A26F13
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF7E5A26FC5
Session ID cannot be set as a custom header., xrefs: 00007FF7E5A271ED
Range, xrefs: 00007FF7E5A27157
Referer: %s, xrefs: 00007FF7E5A27132
%s%s%s%s%s%s%s%s, xrefs: 00007FF7E5A272E6
Failed sending RTSP request, xrefs: 00007FF7E5A274F1
User-Agent, xrefs: 00007FF7E5A2706E, 00007FF7E5A2709D
Content-Type: text/parameters, xrefs: 00007FF7E5A27427
Accept: application/sdp, xrefs: 00007FF7E5A26FFA
Session, xrefs: 00007FF7E5A271D9
Referer, xrefs: 00007FF7E5A27117
Range: %s, xrefs: 00007FF7E5A27183
CSeq cannot be set as a custom header., xrefs: 00007FF7E5A271C0
Transport, xrefs: 00007FF7E5A26F3E
CSeq, xrefs: 00007FF7E5A271AC
Content-Length, xrefs: 00007FF7E5A273CC
OPTIONS, xrefs: 00007FF7E5A26E90
Accept, xrefs: 00007FF7E5A26FE8
Content-Length: %I64d, xrefs: 00007FF7E5A273E7
Session: %s, xrefs: 00007FF7E5A2725D
Accept-Encoding, xrefs: 00007FF7E5A27004
Transport: %s, xrefs: 00007FF7E5A26F9A

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 2ec97d5793b2a055e3b496001f5adaffbf27f7ecb529a76ec01f4e511673b300
Instruction ID: 1375d8e4af8569e35899c2eb4b2118f8f430a47673a9aa028c55d0b672e11846
Opcode Fuzzy Hash: 2ec97d5793b2a055e3b496001f5adaffbf27f7ecb529a76ec01f4e511673b300
Instruction Fuzzy Hash: 9702B425B0978A81FE54BB21A461BBAAB90EF44F84FC40037CE4D97795EF3CE5448322

Function 00007FF7E5A3DE10 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3DEF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3DFF2
htonl.WS2_32 ref: 00007FF7E5A3E01F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E031
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E060
htonl.WS2_32 ref: 00007FF7E5A3E075
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E0A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E129
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E132
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E13B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E172
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E17B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E184
memcpy.VCRUNTIME140 ref: 00007FF7E5A3E19F
memcpy.VCRUNTIME140 ref: 00007FF7E5A3E1B3
memcpy.VCRUNTIME140 ref: 00007FF7E5A3E1C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E1F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E1F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E202
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E20B

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 00007FF7E5A3E006
GSSAPI handshake failure (empty security message), xrefs: 00007FF7E5A3DF77, 00007FF7E5A3E218
GSSAPI handshake failure (invalid security data), xrefs: 00007FF7E5A3DF87

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 5ccaf9b6bd47add414f92efa479d141dd7631a221141d7cb2d10b0ad0c26a9f5
Instruction ID: a0abb75a6ed2fa52c8a2dccaeb444718758fff443653d128e706da1bb722ae96
Opcode Fuzzy Hash: 5ccaf9b6bd47add414f92efa479d141dd7631a221141d7cb2d10b0ad0c26a9f5
Instruction Fuzzy Hash: 2DC13E32B18A5A86E710AB65E860BADBBA0FF44F98F904036DE4E87B54DF3CD445C711

Function 00007FF7E5A025B0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A025CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A025E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A025F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0260B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0261F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02633
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02647
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0265B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0266F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02683
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A026AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A026BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A026D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A026E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A026FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0270F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02723
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02737
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0274B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0275F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02773
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0279B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A027AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A027C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A027D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A027EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A027FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02813

Part of subcall function 00007FF7E5A028A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02828), ref: 00007FF7E5A028BB
Part of subcall function 00007FF7E5A028A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02828), ref: 00007FF7E5A028E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0283D

Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF061
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF071
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF07F
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF08D
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF09B
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0A9
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0B7
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A02869
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0287D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0288D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1355b7a7184f64feaaccd16da42868722d35f25f5e110b8e10d39babc2a5a14d
Instruction ID: 9f2aaecd83525e639adedd020c47dd5814101516b591616f941e757013d932d2
Opcode Fuzzy Hash: 1355b7a7184f64feaaccd16da42868722d35f25f5e110b8e10d39babc2a5a14d
Instruction Fuzzy Hash: 97719135608B86C1D740AF21E9A5BBC7764FF85F99F980136DE8E867148F389199C332

Function 00007FF7E59EAE0F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7E59EAE17
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EB8D3
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EB901
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EB90F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EB94A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EB989

Strings

object, xrefs: 00007FF7E59EBB98
array, xrefs: 00007FF7E59EBA09
number overflow parsing ', xrefs: 00007FF7E59EB80F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: 2b25a70388e658df558de5c10f1f6de355e433b31a00a9922361f82aacf7a162
Instruction ID: c7d4e3693a4175b594e726d7ce12952604a23c121159f8f3f5ab8debf731ee5b
Opcode Fuzzy Hash: 2b25a70388e658df558de5c10f1f6de355e433b31a00a9922361f82aacf7a162
Instruction Fuzzy Hash: D922C562A1CB8985EB10EBA8E4543EDA761FF45BA4F805233DA5D86AD5DF7CE080C311

Function 00007FF7E59E98E8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA0BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA0FA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EAAEE

Strings

object, xrefs: 00007FF7E59EA309
array, xrefs: 00007FF7E59EA17A
number overflow parsing ', xrefs: 00007FF7E59E9F80

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: ad25c7a86437acde071c81594076c447ca3aaed47a1884f3f9ceb8d8117a9dab
Instruction ID: 93d7b5d4fb7190f0b9ad278957f1c0e3d7669c9912cef5cdc2ad65b6226103bd
Opcode Fuzzy Hash: ad25c7a86437acde071c81594076c447ca3aaed47a1884f3f9ceb8d8117a9dab
Instruction Fuzzy Hash: 6212C662B1CB8985EB00EB68E4543EDA761FF41BA4F905232DA5D97AE9DF7CD080C311

Function 00007FF7E59FBE00 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E59F1B61), ref: 00007FF7E59F5757
Part of subcall function 00007FF7E59F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E59F1B61), ref: 00007FF7E59F5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FC094
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FC09C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FC0C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FC0CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FC150
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FC159

Strings

Content-Type: %s%s%s, xrefs: 00007FF7E59FC17D
Content-Type, xrefs: 00007FF7E59FBE88
; boundary=, xrefs: 00007FF7E59FC173
attachment, xrefs: 00007FF7E59FC04B, 00007FF7E59FC052
Content-Transfer-Encoding: %s, xrefs: 00007FF7E59FC2E1
; filename=", xrefs: 00007FF7E59FC0E1
multipart/form-data, xrefs: 00007FF7E59FC257
Content-Disposition, xrefs: 00007FF7E59FBFC1
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF7E59FC119
text/plain, xrefs: 00007FF7E59FBF6C
8bit, xrefs: 00007FF7E59FC2DA
; name=", xrefs: 00007FF7E59FC0EF
multipart/, xrefs: 00007FF7E59FC037
application/octet-stream, xrefs: 00007FF7E59FBF26
multipart/mixed, xrefs: 00007FF7E59FBEF5
Content-Transfer-Encoding, xrefs: 00007FF7E59FC1C1
form-data, xrefs: 00007FF7E59FC306

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: 300bd899a9cef0cdbabd0a11104f44b44084b0c6fc07b8b834b64faa677ac54b
Instruction ID: 26402ab921cd1701083eef717501fd88208c99bab74597c6eaca506aacedc43b
Opcode Fuzzy Hash: 300bd899a9cef0cdbabd0a11104f44b44084b0c6fc07b8b834b64faa677ac54b
Instruction Fuzzy Hash: E9E16E21B0C68A92EA65AF1195207F9A791FF04F84FC88436CF4D87681DF3CE4658772

Function 00007FF7E5A14480 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A145F7

Strings

Bearer, xrefs: 00007FF7E5A145F0
%s auth using %s with user '%s', xrefs: 00007FF7E5A14796
Digest, xrefs: 00007FF7E5A144FE
Authorization:, xrefs: 00007FF7E5A145D1
CONNECT, xrefs: 00007FF7E5A1448E
%s:%s, xrefs: 00007FF7E5A14689
NTLM, xrefs: 00007FF7E5A144DC
Proxy, xrefs: 00007FF7E5A147A4
Authorization, xrefs: 00007FF7E5A1463A
Proxy-authorization, xrefs: 00007FF7E5A14563
Proxy-, xrefs: 00007FF7E5A14706
Server, xrefs: 00007FF7E5A1478C
Authorization: Bearer %s, xrefs: 00007FF7E5A14600
%sAuthorization: Basic %s, xrefs: 00007FF7E5A14710
Negotiate, xrefs: 00007FF7E5A144BA
Basic, xrefs: 00007FF7E5A14757

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: 9d864d28d9e300f388af087b7d8b9fd2095f76582643c860ef49b6a4ced9ffbd
Instruction ID: f73df4f14e892e081a9429cde2720e84fa1b65431c8355b2518a65a9e66fdc3e
Opcode Fuzzy Hash: 9d864d28d9e300f388af087b7d8b9fd2095f76582643c860ef49b6a4ced9ffbd
Instruction Fuzzy Hash: F5919661F0CA9B81FA50AB199670B79AB90EF41F94F944037DA4C87691DF3CE845C322

Function 00007FF7E59E6310 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

memcpy.VCRUNTIME140 ref: 00007FF7E59E6486
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7E59E6518
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7E59E6559
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E66A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E66E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E6730
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E6771
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E67CE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E6888

Part of subcall function 00007FF7E5A3F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7E59E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E5A3F20A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E68C9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E6996
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E69D7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E69FA

Strings

unexpected , xrefs: 00007FF7E59E6813
; last read: ', xrefs: 00007FF7E59E65DC
rsing , xrefs: 00007FF7E59E6468
; expected , xrefs: 00007FF7E59E6920
syntax error , xrefs: 00007FF7E59E635D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 4e1204277121835ebe4e06a958129741cbb2a0c4066216bae6c9bb7d253b311e
Instruction ID: 03f7b74409a8336fc8192d2d4898886c3765608d80cfe38f2563db93aaef86c6
Opcode Fuzzy Hash: 4e1204277121835ebe4e06a958129741cbb2a0c4066216bae6c9bb7d253b311e
Instruction Fuzzy Hash: F512C462F08A4981EB10EB64F4143ADA7A1EB45BE8F805732DA6D937D9DF7CE084C311

Function 00007FF7E5A2E240 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2E250
strstr.VCRUNTIME140 ref: 00007FF7E5A2E27F
strchr.VCRUNTIME140 ref: 00007FF7E5A2E2AB
strrchr.VCRUNTIME140 ref: 00007FF7E5A2E2C5
strchr.VCRUNTIME140 ref: 00007FF7E5A2E2DA
strrchr.VCRUNTIME140 ref: 00007FF7E5A2E33A

Strings

., xrefs: 00007FF7E5A2E31A
/, xrefs: 00007FF7E5A2E295
/, xrefs: 00007FF7E5A2E353
?, xrefs: 00007FF7E5A2E2B8
/, xrefs: 00007FF7E5A2E30E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: 532677097c9836d2ba0a64a8e6dc7d0731298d3760ddfc5c2a40f58a8fc9dc2d
Instruction ID: 7203f0ecd0606e63232be7968f5b236c918b78cbd4cc0dd82d2df512c0728a4b
Opcode Fuzzy Hash: 532677097c9836d2ba0a64a8e6dc7d0731298d3760ddfc5c2a40f58a8fc9dc2d
Instruction Fuzzy Hash: 7281C316B0C28A45FB656721D522B79EFD1AF45F84FC84036CE4E963C6DE3DE8858322

Function 00007FF7E5A29140 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7E5A29213
strchr.VCRUNTIME140 ref: 00007FF7E5A2926A
strchr.VCRUNTIME140 ref: 00007FF7E5A29282
strchr.VCRUNTIME140 ref: 00007FF7E5A2929D
strchr.VCRUNTIME140 ref: 00007FF7E5A29319
strchr.VCRUNTIME140 ref: 00007FF7E5A29331
strchr.VCRUNTIME140 ref: 00007FF7E5A2934C
strchr.VCRUNTIME140 ref: 00007FF7E5A29367
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A293F4

Strings

/D:, xrefs: 00007FF7E5A291E6
default, xrefs: 00007FF7E5A292C3, 00007FF7E5A2938D
/FIND:, xrefs: 00007FF7E5A291B0
/MATCH:, xrefs: 00007FF7E5A2917A
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF7E5A293D5
/DEFINE:, xrefs: 00007FF7E5A291CB
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF7E5A292FA
lookup word is missing, xrefs: 00007FF7E5A292B4, 00007FF7E5A2937E
/LOOKUP:, xrefs: 00007FF7E5A291FD
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF7E5A2924A
/M:, xrefs: 00007FF7E5A29195
Failed sending DICT request, xrefs: 00007FF7E5A29401

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 40fc0069801b7dfe2785114d83a4b2d6c3cc27889de5eff3aac2ff71acebb616
Instruction ID: cd0d0bf6a10967539308fece26cd56bf66c3d009056d740c0183f7797cba08d8
Opcode Fuzzy Hash: 40fc0069801b7dfe2785114d83a4b2d6c3cc27889de5eff3aac2ff71acebb616
Instruction Fuzzy Hash: E881BE15B0C68A48FA25AB629571BB9EA81AF45FC4FC84433CD4DD7B85DE3CE941C322

Function 00007FF7E5A05170 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0518C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A051A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A051B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A051C3

Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF061
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF071
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF07F
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF08D
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF09B
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0A9
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0B7
Part of subcall function 00007FF7E59FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A051FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05213
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05266
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0527A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0528E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A052A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0530A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0531E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05332
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05346
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A053AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A053EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A053FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05412
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05426
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0543A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0544E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05462
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05476
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05498

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction ID: dee05d1fff69b6a7a09fe27fb66342181e500c321641a6026ba1187f0d99c6c4
Opcode Fuzzy Hash: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction Fuzzy Hash: B291E636614B86D3E7499F30E9A06AC7768FB49F48F540136EF9E47354CF34A2A58321

Function 00007FF7E5A0E5D0 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 310stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0E6C5
strchr.VCRUNTIME140 ref: 00007FF7E5A0E765
memcpy.VCRUNTIME140 ref: 00007FF7E5A0E795
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A0E7C1
strchr.VCRUNTIME140 ref: 00007FF7E5A0E80C
memcpy.VCRUNTIME140 ref: 00007FF7E5A0E86B

Part of subcall function 00007FF7E59FAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59FAB64

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0E984

Strings

Added %s:%d:%s to DNS cache, xrefs: 00007FF7E5A0EA7D
:%u, xrefs: 00007FF7E5A0E6D9, 00007FF7E5A0E998
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF7E5A0EA0B
@, xrefs: 00007FF7E5A0E856
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF7E5A0E8FA
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF7E5A0E667
%255[^:]:%d, xrefs: 00007FF7E5A0E651
], xrefs: 00007FF7E5A0E845
Resolve address '%s' found illegal!, xrefs: 00007FF7E5A0E8EB
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF7E5A0EAAE

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: 955c7712c79ff587e7c603a986f10185c6f7a27a7aa30e803e5dd7570a33bcd5
Instruction ID: d8151f0c2948702d5a56d1669dfb1f99881b97dd02f22e7754b6347b77b2311a
Opcode Fuzzy Hash: 955c7712c79ff587e7c603a986f10185c6f7a27a7aa30e803e5dd7570a33bcd5
Instruction Fuzzy Hash: DAD19122B2968A45EF51AB31D420BF9AB50FF44B98F844133DA5E876C5DF3CE505D322

Function 00007FF7E5A04240 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A04562

Strings

https, xrefs: 00007FF7E5A042C4
socks4a, xrefs: 00007FF7E5A0431B
socks4, xrefs: 00007FF7E5A04336
Unsupported proxy scheme for '%s', xrefs: 00007FF7E5A04371
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF7E5A043A4
socks5, xrefs: 00007FF7E5A04300
socks, xrefs: 00007FF7E5A0434A
Unsupported proxy syntax in '%s', xrefs: 00007FF7E5A0454A
socks5h, xrefs: 00007FF7E5A042E2
http, xrefs: 00007FF7E5A0435E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: a4b04b913e93c2f9c523f7cf3eae0e2690bd5702689a41c3ee2f1092c1171054
Instruction ID: fa22aba7eecd1357a327ff84c653c2ae6d89540871b979c0c6a0de9539d89895
Opcode Fuzzy Hash: a4b04b913e93c2f9c523f7cf3eae0e2690bd5702689a41c3ee2f1092c1171054
Instruction Fuzzy Hash: 66A1C421F1864A81FB50EB61E460FBDAB64BF44F98F84443BCE0D93695DF38E9448362

Function 00007FF7E5A22E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A1C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7E5A0340F), ref: 00007FF7E5A1C0AE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A22F36
strchr.VCRUNTIME140 ref: 00007FF7E5A22F54
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A22F84
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A22F9F
strchr.VCRUNTIME140 ref: 00007FF7E5A22FC9
strrchr.VCRUNTIME140 ref: 00007FF7E5A22FE5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2300F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2302A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2304E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A23066
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A230A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A230E0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2317C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A231A1

Strings

Request has same path as previous transfer, xrefs: 00007FF7E5A23186
Uploading to a URL without a file name!, xrefs: 00007FF7E5A230CC

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 9dcf305a52cd3e23aaf1153be538e4d3e6a8ad2efff6f173cfe376763f3954e1
Instruction ID: 58a5bc9f01f3601199134f9073a9b34dd0ec634d903af1c0b1dea047623363d6
Opcode Fuzzy Hash: 9dcf305a52cd3e23aaf1153be538e4d3e6a8ad2efff6f173cfe376763f3954e1
Instruction Fuzzy Hash: C591E325B0C78A82EA54AB25E465B79ABE0FF46F80F944037DA4E93794CF3CD4148723

Function 00007FF7E59FA3A0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA403
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA47D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA4A1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA4F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA52A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA53C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA54F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA56A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA580
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59FA589

Strings

%s.%s.tmp, xrefs: 00007FF7E59FA43A
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF7E59FA476
## Fatal libcurl error, xrefs: 00007FF7E59FA5B7
%s, xrefs: 00007FF7E59FA51B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 1f35a80a99e6fd3e0fec7f91074f21a35dd5555525d88da8c92026e8bc2dde98
Instruction ID: dc645abc57af69ebe74347e8981dfc8319fa36038e5e436bb1e09d9ac639fa44
Opcode Fuzzy Hash: 1f35a80a99e6fd3e0fec7f91074f21a35dd5555525d88da8c92026e8bc2dde98
Instruction Fuzzy Hash: 70516421B0964A41EE55AB61A8347BAA690AF45FC4FC84432DD1ECA750DF3CE4558232

Function 00007FF7E5A16440 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF7E5A168E1
[, xrefs: 00007FF7E5A169D4
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF7E5A1672B
SOCKS4%s request granted., xrefs: 00007FF7E5A16A06
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF7E5A165AB
Failed to send SOCKS4 connect request., xrefs: 00007FF7E5A167ED
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF7E5A169E4
SOCKS4 communication to %s:%d, xrefs: 00007FF7E5A1651F
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF7E5A16946
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF7E5A169AD
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF7E5A16506
SOCKS4: too long host name, xrefs: 00007FF7E5A16806
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF7E5A16973
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF7E5A166AA
SOCKS4 connection to %s not supported, xrefs: 00007FF7E5A1670C
Too long SOCKS proxy name, can't use!, xrefs: 00007FF7E5A16607
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF7E5A1689A

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: 6c30f7f6b874b116607d717ff4598b0c656bd0c5a0a8bccfb45bdd3e036cc216
Instruction ID: 594ac8ecda42fdb7fa8533672596b3e7e34ce0c266dcb26e7da187d6f1368f0f
Opcode Fuzzy Hash: 6c30f7f6b874b116607d717ff4598b0c656bd0c5a0a8bccfb45bdd3e036cc216
Instruction Fuzzy Hash: 32E1C3A1B082C985EB54AB25E164779AFA0EF45F84F848137DA4DC7B96CF3CE444C722

Function 00007FF7E59E5470 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E55CE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59E55FC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59E560A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E5644
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E5695
memset.VCRUNTIME140 ref: 00007FF7E59E54C3

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

Part of subcall function 00007FF7E59E6310: memcpy.VCRUNTIME140 ref: 00007FF7E59E6486

Part of subcall function 00007FF7E59E1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E5802
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59E582E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59E583C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E5877
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E58CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E59B1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7E59E59C9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7E59E59D6

Strings

value, xrefs: 00007FF7E59E5536, 00007FF7E59E576E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 023b6053358200f424848e61aa4fa9e49c9a7dc309aec37bbb2a978c88a57a66
Instruction ID: 335b247206c28f06b5e8548ad5723a5b79dd2f47b62b68394744eb28c72a1360
Opcode Fuzzy Hash: 023b6053358200f424848e61aa4fa9e49c9a7dc309aec37bbb2a978c88a57a66
Instruction Fuzzy Hash: BDF1DB22B1C68545EB10EB74E4543EDA7A0FF45BA8F905232D6AD83AE9DF3CD085C711

Function 00007FF7E5A1B1E0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7E5A1B4C7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7E5A1B537
CertFreeCertificateContext.CRYPT32 ref: 00007FF7E5A1B575
CertFreeCertificateContext.CRYPT32 ref: 00007FF7E5A1B588

Strings

schannel: failed to setup memory allocation, xrefs: 00007FF7E5A1B291
http/1.1, xrefs: 00007FF7E5A1B33B
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF7E5A1B328
schannel: failed to setup stream orientation, xrefs: 00007FF7E5A1B2B0
schannel: failed to retrieve remote cert context, xrefs: 00007FF7E5A1B5A7
schannel: failed to retrieve ALPN result, xrefs: 00007FF7E5A1B2FB
ALPN, server did not agree to a protocol, xrefs: 00007FF7E5A1B355
schannel: failed to setup confidentiality, xrefs: 00007FF7E5A1B272
schannel: failed to store credential handle, xrefs: 00007FF7E5A1B42C
schannel: failed to setup replay detection, xrefs: 00007FF7E5A1B256
schannel: failed to setup sequence detection, xrefs: 00007FF7E5A1B23A

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 003eef28260a4f8df0df00670386984386231f818a0537bbf2c3299004cc96c5
Instruction ID: 28cb93ad143a2e8faa8973188be0ca6cc51fb7a2e235b1e3954919360ded6196
Opcode Fuzzy Hash: 003eef28260a4f8df0df00670386984386231f818a0537bbf2c3299004cc96c5
Instruction Fuzzy Hash: D9B1A461B08A8E85EB60AB25D864BB9AB91FF84F98FC44033D94DC7795CF3CD4458722

Function 00007FF7E5A3D000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7E5A2FD2F), ref: 00007FF7E5A3D02D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF7E5A2FD2F), ref: 00007FF7E5A3D04F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7E5A2FD2F), ref: 00007FF7E5A3D060
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7E5A2FD2F), ref: 00007FF7E5A3D08E

Strings

/../, xrefs: 00007FF7E5A3D15B
../, xrefs: 00007FF7E5A3D0F9
/./, xrefs: 00007FF7E5A3D11C
/.., xrefs: 00007FF7E5A3D192

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: 190f5f5efba5df30148cf3e06b309bf7ce750d830b12a83570053c044d9442d2
Instruction ID: cf66babd495aecdb0786238b30048de952f2fc6385ae89f252ad60adbd3aa63e
Opcode Fuzzy Hash: 190f5f5efba5df30148cf3e06b309bf7ce750d830b12a83570053c044d9442d2
Instruction Fuzzy Hash: 3F71A821F0D68AC5FB626B219920B7DEF91AF12FD8F844133CA5D86691DE3CE451C322

Function 00007FF7E59FF4D0 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF534
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF568
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF64F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF65C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF6A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF71F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF740
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF761
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FF782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF819
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FF822

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction ID: 3d2945f170a1f46ab78f58ad00f14a3e2a96e273f210b1376a591899c1da3167
Opcode Fuzzy Hash: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction Fuzzy Hash: 38B14F32A09B8A96EA659F15E5607B9B7A0FB44F54F940136CB8E83750DF3CE0748321

Function 00007FF7E5A2ED9C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F008
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F060
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F06D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F16F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F1BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F1D6

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: e50ef931bf97fd6978a02dacd3bdcb8e3fa39a162dbfd03a69ca58af84868c80
Instruction ID: 77f2dcb48c5d3d9a1c699a8fb23bc35c5578c1725e0cf66a1ae93bbab368e4e0
Opcode Fuzzy Hash: e50ef931bf97fd6978a02dacd3bdcb8e3fa39a162dbfd03a69ca58af84868c80
Instruction Fuzzy Hash: DCA1B715B0D28A45FB616B219532B79AFD19F06F84FC84073DA8E962C5EE3DE4448733

Function 00007FF7E5A1D080 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF7E5A1D0D8

Strings

CAPABILITY, xrefs: 00007FF7E5A1D4A0
SEARCH, xrefs: 00007FF7E5A1D1EC, 00007FF7E5A1D3BF
STORE, xrefs: 00007FF7E5A1D30A
UID, xrefs: 00007FF7E5A1D407
EXPUNGE, xrefs: 00007FF7E5A1D3D7
NOOP, xrefs: 00007FF7E5A1D41F
Unexpected continuation response, xrefs: 00007FF7E5A1D51E
LIST, xrefs: 00007FF7E5A1D2BC
FETCH, xrefs: 00007FF7E5A1D24C, 00007FF7E5A1D362
LSUB, xrefs: 00007FF7E5A1D3EF
EXAMINE, xrefs: 00007FF7E5A1D3A7
PREA, xrefs: 00007FF7E5A1D114
, xrefs: 00007FF7E5A1D0E1
SELECT, xrefs: 00007FF7E5A1D38F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 5e11bfa2a84c0bb5aa158c4cf855aa4d81f042b1f6a2de6bc2e49222ceafe7f8
Instruction ID: 1d25b8eb1eca695f40873441675211fba74282c60f8a568cbc3dd11990c6d9ab
Opcode Fuzzy Hash: 5e11bfa2a84c0bb5aa158c4cf855aa4d81f042b1f6a2de6bc2e49222ceafe7f8
Instruction Fuzzy Hash: 8FD15DA1B0C25A51FB247E25C664BB8AF90AF11F94FC45033DA9D8A585EE7CF8418323

Function 00007FF7E5A188B0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF7E5A18B66), ref: 00007FF7E5A188CB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A188EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1890C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A18915

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction ID: c8776e6f2d9dcf65bb99674d5a63c98512ca256967d6b46d4a947455d27c532f
Opcode Fuzzy Hash: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction Fuzzy Hash: E1617C66B05B4682EA25EF12B564A29B7A4FF48F90B854036CF8E83750EF3CE494C311

Function 00007FF7E59EA7A2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

Part of subcall function 00007FF7E59E6310: memcpy.VCRUNTIME140 ref: 00007FF7E59E6486

Part of subcall function 00007FF7E59E1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA851
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA87F
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EA88D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA8C7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA924
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA9DD
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EAA0B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EAA19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EAA53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EAAA4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EAAEE

Strings

value, xrefs: 00007FF7E59EA7C0, 00007FF7E59EA949

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 318b2423f1fc7c9365d9dea7f80e65f750f29bf68608046753f263769fa03efc
Instruction ID: 0b2ef09503da027421e28a1091dcd6f40be530f6485046b32247d0a407600746
Opcode Fuzzy Hash: 318b2423f1fc7c9365d9dea7f80e65f750f29bf68608046753f263769fa03efc
Instruction Fuzzy Hash: 30A19632B18B4985EB00EB68E4553EDA761FF41BA4F901332DA6D86AE9DF7CD081C711

Function 00007FF7E59EC031 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

Part of subcall function 00007FF7E59E6310: memcpy.VCRUNTIME140 ref: 00007FF7E59E6486

Part of subcall function 00007FF7E59E1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC0E0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EC10E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EC11C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC156
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC1B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC333
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC37D

Strings

value, xrefs: 00007FF7E59EC04F, 00007FF7E59EC1D8

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 9efa30662b9e0125733c549c7ddb0404d6325bb906536454243b4d6c7a755523
Instruction ID: 218b36200ca7b02042600c4f64822db0faa21bd4131772a4de34a4f3c09c1b1e
Opcode Fuzzy Hash: 9efa30662b9e0125733c549c7ddb0404d6325bb906536454243b4d6c7a755523
Instruction Fuzzy Hash: 7DA18922B18A4555EB00EBA8E4543EDA761EF45BB4F801332D6AD82AD9DF7CE081C711

Function 00007FF7E59FA010 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA07D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FA09D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59FA0D1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59FA0F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA115
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA126
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59FA148
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA1FF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59FA214

Strings

Set-Cookie:, xrefs: 00007FF7E59FA186
ignoring failed cookie_init for %s, xrefs: 00007FF7E59FA152
none, xrefs: 00007FF7E59FA092

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: 992fbeba35ba7d9cfd174204178d183b8fb1cad6507cabc141d8163f4fd3fce8
Instruction ID: 58afe89f49b2e8ddd43be40257c86889cc2133854a26278a2d9622c40eb3f16c
Opcode Fuzzy Hash: 992fbeba35ba7d9cfd174204178d183b8fb1cad6507cabc141d8163f4fd3fce8
Instruction Fuzzy Hash: AB61E721B0C78A81EA50AB15A5247F9AB94BF46F84FDC4036DE8D8B781DF3DE4518332

Function 00007FF7E59F2500 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E59F2522
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F252A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F2549
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F2555
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F2564
strrchr.VCRUNTIME140 ref: 00007FF7E59F25B5
strrchr.VCRUNTIME140 ref: 00007FF7E59F25D6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F25EF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F25FA
GetLastError.KERNEL32 ref: 00007FF7E59F2603
SetLastError.KERNEL32 ref: 00007FF7E59F260F

Strings

Unknown error %d (%#x), xrefs: 00007FF7E59F2597

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 7b9888dc63a3e7c9f678162156a496c77b2712124fc0888817af1d5cf78b4351
Instruction ID: 2349d6b3e5b42b3ff660790b731a8019477e30a3af5a4f75e08cfdc5d9e39a6c
Opcode Fuzzy Hash: 7b9888dc63a3e7c9f678162156a496c77b2712124fc0888817af1d5cf78b4351
Instruction Fuzzy Hash: 41316021B0865A86EF156F61A83437DEA92AF84F84F884037D95EC7795DF3CE4118732

Function 00007FF7E5A36810 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A368C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36929
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3694C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A369AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36A1C

Strings

Issuer: %s, xrefs: 00007FF7E5A3699A
TRUE, xrefs: 00007FF7E5A36A81
Version, xrefs: 00007FF7E5A36A07
%lx, xrefs: 00007FF7E5A369EC
Issuer, xrefs: 00007FF7E5A36980
Subject, xrefs: 00007FF7E5A368FA
%2d Subject: %s, xrefs: 00007FF7E5A36914
Version: %lu (0x%lx), xrefs: 00007FF7E5A36A2E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: d66a8e2a531d88578f19dc84826a95064c5f9f86ba4d3b4d7cb9b6f8f2967699
Instruction ID: 7645ca0d13b7006f70fad1fec23ca614648c6e52f890df4ee1edba2a20f278eb
Opcode Fuzzy Hash: d66a8e2a531d88578f19dc84826a95064c5f9f86ba4d3b4d7cb9b6f8f2967699
Instruction Fuzzy Hash: EF61B222B0978685E711AB61E464BFAAB91BF44B88FC40537CE1E87395EF3CE144C312

Function 00007FF7E5A29D20 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7E5A29D8B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A29EB5

Part of subcall function 00007FF7E59F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E59F1B61), ref: 00007FF7E59F5757
Part of subcall function 00007FF7E59F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E59F1B61), ref: 00007FF7E59F5763

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A29E6F

Part of subcall function 00007FF7E59F5690: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F56A0

Strings

TTYPE, xrefs: 00007FF7E5A29E45
%hu%*[xX]%hu, xrefs: 00007FF7E5A29F39
XDISPLOC, xrefs: 00007FF7E5A29E8B
%127[^= ]%*[ =]%255s, xrefs: 00007FF7E5A29E30
Unknown telnet option %s, xrefs: 00007FF7E5A29FAD
USER,%s, xrefs: 00007FF7E5A29DB0
NEW_ENV, xrefs: 00007FF7E5A29ED1
BINARY, xrefs: 00007FF7E5A29F5E
Syntax error in telnet option: %s, xrefs: 00007FF7E5A29FC6

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: 1fef72c7444546989d73c0875fbfa1f9dd609a4fb55574ababa5f96400690454
Instruction ID: b6d0988ff9d38718b7edf90f132bd0c8ee71bbd9bc32cf3e96efdd352e9b89fe
Opcode Fuzzy Hash: 1fef72c7444546989d73c0875fbfa1f9dd609a4fb55574ababa5f96400690454
Instruction Fuzzy Hash: 2F714E32B0CACA95EB21AF24D461BE9A760FF44B88FC44033DA8C96255DF38D595C762

Function 00007FF7E5A2C5A3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2C6A3

Strings

TFTP file name too long, xrefs: 00007FF7E5A2C68F
%I64d, xrefs: 00007FF7E5A2C736
tsize, xrefs: 00007FF7E5A2C7B2
blksize, xrefs: 00007FF7E5A2C878
%s%c%s%c, xrefs: 00007FF7E5A2C6BA
TFTP buffer too small for options, xrefs: 00007FF7E5A2C79F, 00007FF7E5A2C8E8
timeout, xrefs: 00007FF7E5A2C965

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: 8bff296f59c387a8d797001e2b4b23bc00947aaa51299eb1c46842c7a3ab6500
Instruction ID: ab6cd64a05daf383650983da9f6d1235205f78cf20143c0b6d0e8b0a78821735
Opcode Fuzzy Hash: 8bff296f59c387a8d797001e2b4b23bc00947aaa51299eb1c46842c7a3ab6500
Instruction Fuzzy Hash: FED18B66B08A8A95EB10DF24D0607B9ABA1EF85F88FC48133DA4D97785DF7CD109C361

Function 00007FF7E5A2CE20 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7E5A2CF93
sendto.WS2_32 ref: 00007FF7E5A2D04C
WSAGetLastError.WS2_32 ref: 00007FF7E5A2D05A

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7E5A2CE8D
tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF7E5A2D004
tftp_tx: internal error, event: %i, xrefs: 00007FF7E5A2CE78
Received ACK for block %d, expecting %d, xrefs: 00007FF7E5A2CFE5

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 50e73455d7e3a75b11b53e943120c7777fc9fe00b525068e7abcedd1a1672a85
Instruction ID: b353e848d9291e66f6f08ceb8b6b0d93a736591facee941710166e2b93fe1022
Opcode Fuzzy Hash: 50e73455d7e3a75b11b53e943120c7777fc9fe00b525068e7abcedd1a1672a85
Instruction Fuzzy Hash: D8B18C76708686C6EB24AF29D461BA97BA0FF48F88F844032DA4D8B759DF38D441C761

Function 00007FF7E5A2A850 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7E5A2AA4C
WSAGetLastError.WS2_32 ref: 00007FF7E5A2AA5E
send.WS2_32 ref: 00007FF7E5A2AB56
WSAGetLastError.WS2_32 ref: 00007FF7E5A2AB60

Strings

#, xrefs: 00007FF7E5A2AACE
%c%s%c%s, xrefs: 00007FF7E5A2A9F0
%c%c, xrefs: 00007FF7E5A2AA28
Sending data failed (%d), xrefs: 00007FF7E5A2AA64, 00007FF7E5A2AB66
%c%c%c%c%s%c%c, xrefs: 00007FF7E5A2AB2F
%127[^,],%127s, xrefs: 00007FF7E5A2A9B8
%c%c%c%c, xrefs: 00007FF7E5A2A92D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: 00404623e120793d597db3c352179d0aa63a3864e2c814257e5a1cf65cb6576d
Instruction ID: d7b0e7fde1705d126c7decf6e5856dfcefd7aa5442c7a53a2fe6eb69c6b60ec8
Opcode Fuzzy Hash: 00404623e120793d597db3c352179d0aa63a3864e2c814257e5a1cf65cb6576d
Instruction Fuzzy Hash: 3D91E332608ACA85F721AF64E415BEAA7A0FF44BA8F840232EE4D47B85DF7CD145C751

Function 00007FF7E5A2C200 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7E5A2C378
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7E5A2C393
sendto.WS2_32 ref: 00007FF7E5A2C3FA
sendto.WS2_32 ref: 00007FF7E5A2C4B1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7E5A2C4E9

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7E5A2C272
tftp_rx: internal error, xrefs: 00007FF7E5A2C24E
Received last DATA packet block %d again., xrefs: 00007FF7E5A2C445
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF7E5A2C4F1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 082182b0c608b5dd753e2c0b4bfb06eb638cf906bf23a4cf43ef42e9b11363e8
Instruction ID: e061ac82578ab5ccec18508c678d4f7b73f59ad74c7d9d42a136cb15ae549875
Opcode Fuzzy Hash: 082182b0c608b5dd753e2c0b4bfb06eb638cf906bf23a4cf43ef42e9b11363e8
Instruction Fuzzy Hash: 50918B36708685C5D721EF29D464BA9BBA0FB88F88F848132DB4D8B758DF39D406C721

Function 00007FF7E5A03DF0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A03E2D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A03EAF
strchr.VCRUNTIME140 ref: 00007FF7E5A03F2E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A03F5C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A03F7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A03F8F

Strings

Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF7E5A03EB9
Invalid IPv6 address format, xrefs: 00007FF7E5A03F17
No valid port number in connect to host string (%s), xrefs: 00007FF7E5A03FBB
%25, xrefs: 00007FF7E5A03EA5

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: 0d1e06a6d0f9712c3ca27df683fb699d76da4af6e053dfbf71b887b8ca41c8f6
Instruction ID: 5bd53975340e2a0a3983eaa4a9eded12a728d25e295b51cf146401eb36a07af3
Opcode Fuzzy Hash: 0d1e06a6d0f9712c3ca27df683fb699d76da4af6e053dfbf71b887b8ca41c8f6
Instruction Fuzzy Hash: 8451F661B1868F46EB11AB359470B79EFD1AF05F98FC84033DA4D8A281DF3CE4468322

Function 00007FF7E59F9E00 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9E3E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9E5E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59F9E90
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59F9EAD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9ECB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9EDC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E59F9EFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E59F4050), ref: 00007FF7E59F9FAF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E59F4050), ref: 00007FF7E59F9FC5

Strings

Set-Cookie:, xrefs: 00007FF7E59F9F36
none, xrefs: 00007FF7E59F9E53

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: c845ef27a6eb0f70cfb5e5d8d0ec943c7a71320ffd18cdb9581be7247b181f35
Instruction ID: 2050aaed1fdef1efb15df3f4943c49089ee26db15d06c4a31867119c3bc57811
Opcode Fuzzy Hash: c845ef27a6eb0f70cfb5e5d8d0ec943c7a71320ffd18cdb9581be7247b181f35
Instruction Fuzzy Hash: 7051E521A0C78A51FA55BB2165307FAEA91AF45F80FD84436DE8E86790DF3CE855C332

Function 00007FF7E5A04590 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A05584
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0559A
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055AE
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055C2
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055D6
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055EA
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055FE
Part of subcall function 00007FF7E5A05570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A05612

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A04612

Part of subcall function 00007FF7E5A2E540: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E555
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E56F
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E58A
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5A6
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5C2
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5DA
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5F2
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E60A
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E622
Part of subcall function 00007FF7E5A2E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E63A
Part of subcall function 00007FF7E5A2E540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E654

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A04816
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A04859
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A0499E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A04A1B

Strings

file, xrefs: 00007FF7E5A04903, 00007FF7E5A0497C
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF7E5A0475F
%s://%s, xrefs: 00007FF7E5A0461F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 2ca85521c9ecdf955f9429382aae5dedbdb67b063789061bcb64614b8007046f
Instruction ID: 23f212ad91cab3e87fa17a483fc512eeb79533da9db57fcbb06cfb7156925592
Opcode Fuzzy Hash: 2ca85521c9ecdf955f9429382aae5dedbdb67b063789061bcb64614b8007046f
Instruction Fuzzy Hash: 4AC1A931B186C686FB64AA31D560BF9AB90FF45B48F84053ACB0DC7685DF3CE9548362

Function 00007FF7E59E1FB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2469
Part of subcall function 00007FF7E59E2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E24A8

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

Part of subcall function 00007FF7E59E3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E3BF6

Part of subcall function 00007FF7E59E5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5E61

Part of subcall function 00007FF7E59E3C30: memcpy.VCRUNTIME140 ref: 00007FF7E59E3C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2121
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2171
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E21C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2202
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2254
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2293
__std_exception_copy.VCRUNTIME140 ref: 00007FF7E59E22E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2337

Strings

parse error, xrefs: 00007FF7E59E203B
parse_error, xrefs: 00007FF7E59E2011

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: 796c5f3307eb32e0ad6337efd212abd60be5357c1e3d7b385b4cd24bde934b85
Instruction ID: 86cdffc265e6bffb4efbf62cb8cbc1dcbfbe7f389c9fe811d23225db2a797114
Opcode Fuzzy Hash: 796c5f3307eb32e0ad6337efd212abd60be5357c1e3d7b385b4cd24bde934b85
Instruction Fuzzy Hash: CFB1A562B18B4985FF00EB64E4543AD77A1EB44BA8F905632DA6D82BE9DF7CD1C0C311

Function 00007FF7E5A0E160 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0E1F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0E238
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0E2D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0E2EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0E30B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0E35A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7E5A0E3AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0E3DF

Strings

:%u, xrefs: 00007FF7E5A0E36E
Shuffling %i addresses, xrefs: 00007FF7E5A0E1DA

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 1c6b2c5cffc96e1f2faa13328d5cbc488b8c058bf72ff2addcdcbf0fc35252f0
Instruction ID: 905cbe264694fe8d9c52453ce9ec7468ea06cd12c4809318fcb1eb31def17637
Opcode Fuzzy Hash: 1c6b2c5cffc96e1f2faa13328d5cbc488b8c058bf72ff2addcdcbf0fc35252f0
Instruction Fuzzy Hash: 2771C772718A4A81EB14AB21E564BBDABA0FF48F98F844532DE4E87790DF3CD445C712

Function 00007FF7E5A0BDD0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0BE4A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0BE65
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0BEE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0BF6C

Strings

Switch from POST to GET, xrefs: 00007FF7E5A0C036
Issue another request to this URL: '%s', xrefs: 00007FF7E5A0BF77
Maximum (%ld) redirects followed, xrefs: 00007FF7E5A0BF37
Switch to %s, xrefs: 00007FF7E5A0BFF7
GET, xrefs: 00007FF7E5A0BFDE
HEAD, xrefs: 00007FF7E5A0BFD7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: eedddef45915e7ee78f04db88568bb3b1bf7b9df837a40408026672cc07be263
Instruction ID: 5ae413e38f36b41917d27e718c87f61d963f9d536610dc616b12e78250a926d4
Opcode Fuzzy Hash: eedddef45915e7ee78f04db88568bb3b1bf7b9df837a40408026672cc07be263
Instruction Fuzzy Hash: C8719361B1868A80E760AF359470BBEAB91EF45F98F980032DF4D87695CF3DD4818762

Function 00007FF7E5A3B680 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3BB4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3BBA3

Strings

NTLM, xrefs: 00007FF7E5A3B909
OAUTHBEARER, xrefs: 00007FF7E5A3B992
GSSAPI, xrefs: 00007FF7E5A3B816
CRAM-MD5, xrefs: 00007FF7E5A3B8D2
EXTERNAL, xrefs: 00007FF7E5A3B79B
LOGIN, xrefs: 00007FF7E5A3BAC3
XOAUTH2, xrefs: 00007FF7E5A3BA05
DIGEST-MD5, xrefs: 00007FF7E5A3B8B3
PLAIN, xrefs: 00007FF7E5A3BA5A

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: bcc6fd5a38e36d593fabfc2fa539815a04fff9fc478c505d022e484110f194b5
Instruction ID: e70ecee9d524dbfa4a16d3749f760df70628280bc6bb1fe3935345cfc153a158
Opcode Fuzzy Hash: bcc6fd5a38e36d593fabfc2fa539815a04fff9fc478c505d022e484110f194b5
Instruction Fuzzy Hash: E7D16C62A09A8A85EB60DF10E450BADBBA1FF84B58F844137DE8C47798DF3CD445C722

Function 00007FF7E5A1D6B0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A1C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7E5A0340F), ref: 00007FF7E5A1C0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1D94E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1D958
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1D9B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1D9BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1D9CA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF7E5A1D6B8
MAILINDEX, xrefs: 00007FF7E5A1D887
SECTION, xrefs: 00007FF7E5A1D8C8
UIDVALIDITY, xrefs: 00007FF7E5A1D805
UID, xrefs: 00007FF7E5A1D846
PARTIAL, xrefs: 00007FF7E5A1D906

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 529f760526342dc532923641d4e7bfe965fc7578af4e37c6f5efba9c0881beb6
Instruction ID: e075ca398427b7f582ebabddbcb0e63c14fb65104ea411d4a8709e97bc5ebb63
Opcode Fuzzy Hash: 529f760526342dc532923641d4e7bfe965fc7578af4e37c6f5efba9c0881beb6
Instruction Fuzzy Hash: 0AA18852B0868A85EB55AF25D560BB86F90FF44F98F841033DA8F87A95DF3CD490C362

Function 00007FF7E5A2F1F1 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F16F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F26D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F2D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F2EE

Part of subcall function 00007FF7E5A2E240: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2E250

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F316
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F32D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F39F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F3B4

Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F4FC
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F506
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F510
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F51A
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F524
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F52E
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F538
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F542
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F54C
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F556
Part of subcall function 00007FF7E5A2F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F560

Strings

,, xrefs: 00007FF7E5A2F234
:, xrefs: 00007FF7E5A2F217

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction ID: 5ca69b468ae21672e83ab4a46b1b0fd1c81e62d40bfa2d96be596ceb9a0e1a21
Opcode Fuzzy Hash: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction Fuzzy Hash: 06518416F0C68A42F711AB359523BB9A750BF56F88F849236CE8EA1542EF7CF1C48711

Function 00007FF7E5A2E540 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E555
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E56F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E58A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5DA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E5F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E60A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E622
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E63A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A045B5,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A2E654

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: b29704e7a7bafcfd67e48d247ff31038bc34b79da22b3b3364008b4691575eec
Instruction ID: 99dbc45cd1ffff1de6aabfca0407f115d16d4816cecb1ce1b722b0411824dff3
Opcode Fuzzy Hash: b29704e7a7bafcfd67e48d247ff31038bc34b79da22b3b3364008b4691575eec
Instruction Fuzzy Hash: 2C31F369B06B0782EE69AB55E471B3467D0BF44F50B584536CD0D92740EF3CE4A48371

Function 00007FF7E5A24590 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

LIST, xrefs: 00007FF7E5A24692
NLST, xrefs: 00007FF7E5A2468B
%s%s%s, xrefs: 00007FF7E5A246B5
Couldn't set desired mode, xrefs: 00007FF7E5A245AE
Got a %03d response code instead of the assumed 200, xrefs: 00007FF7E5A245D0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 467d5c9c31773df116a706cbdf672d776cac5ef44452e7be24205e671929127c
Instruction ID: db8bf784f141487fb96a1624f5e89d283a31e0aad1cfdc8cb3fd31bfa5b3c9c2
Opcode Fuzzy Hash: 467d5c9c31773df116a706cbdf672d776cac5ef44452e7be24205e671929127c
Instruction Fuzzy Hash: 8F41F236B0865AC6FA20AB55E461BBDEB60EF41F80FC4403BCA4D97641DF7CE8448722

Function 00007FF7E5A084A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7E5A1450A), ref: 00007FF7E5A0851F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7E5A1450A), ref: 00007FF7E5A08571
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7E5A1450A), ref: 00007FF7E5A08595
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7E5A1450A), ref: 00007FF7E5A085E5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7E5A1450A), ref: 00007FF7E5A08628

Strings

%sAuthorization: Digest %s, xrefs: 00007FF7E5A08605
%.*s, xrefs: 00007FF7E5A0857E
Digest, xrefs: 00007FF7E5A084AB
Proxy-, xrefs: 00007FF7E5A085FB

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: 991cca11e921deaf2fb3f742e1aed303678f25a5ce7169caec8dc6d57ca1d1d1
Instruction ID: eb1d381cca0b3a77cf3b83dfd84910bd5e95d7565287dadeb16a15fce267900c
Opcode Fuzzy Hash: 991cca11e921deaf2fb3f742e1aed303678f25a5ce7169caec8dc6d57ca1d1d1
Instruction Fuzzy Hash: 1041A522718B8A92EA20AF11E450BAABBA0FF45F84F940036DE8D87794DF7CD556C315

Function 00007FF7E5A375CE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A37602
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Strings

FALSE, xrefs: 00007FF7E5A375F7
TRUE, xrefs: 00007FF7E5A375F0
Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 9dc0b852f7038322631c9ff623631b1be7e00c642b1ca7ddf154faf074b028e8
Instruction ID: af3d360e14ddc24590606a1c5f15aff01a001b63bc402f2a7daa4cae4f2e0d23
Opcode Fuzzy Hash: 9dc0b852f7038322631c9ff623631b1be7e00c642b1ca7ddf154faf074b028e8
Instruction Fuzzy Hash: CE416261B0978A85EB11AB61E464BFDABA1BF05B88FC40433CE4D97756DF3CE1448322

Function 00007FF7E59F1E42 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

SEC_E_BAD_BINDINGS, xrefs: 00007FF7E59F1E42
%s (0x%08X), xrefs: 00007FF7E59F1D95
%s - %s, xrefs: 00007FF7E59F2299

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: fed2a8485bd53f2b9fc33547e3bf34e68c56676f5b9d2557088d6d2309b96134
Instruction ID: ea22093c052cb10bc660cee053cbf9bfcb2e47f2c8d0411712ddb02974da50e4
Opcode Fuzzy Hash: fed2a8485bd53f2b9fc33547e3bf34e68c56676f5b9d2557088d6d2309b96134
Instruction Fuzzy Hash: 8031502270C68585EB25AB60E4617FEFBA0BF84B44F840137DA9D82A95DF3CD554C731

Function 00007FF7E59F1E4E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

SEC_E_BAD_PKGID, xrefs: 00007FF7E59F1E4E
%s (0x%08X), xrefs: 00007FF7E59F1D95
%s - %s, xrefs: 00007FF7E59F2299

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: f85a2a735a9d920cdfcb51d5e4cf70fc8eb07e7097d1353a9d283ee2013f9742
Instruction ID: e5ec4c5cf1fe17c70cb16ae4aa584303ab4c58563e93c944095390a43637f115
Opcode Fuzzy Hash: f85a2a735a9d920cdfcb51d5e4cf70fc8eb07e7097d1353a9d283ee2013f9742
Instruction Fuzzy Hash: D0314F2270C68585EB25AB60E4607FEFBA0BF84B44FC40537DA9D82A95DF3CD5548731

Function 00007FF7E59F1E7E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

%s (0x%08X), xrefs: 00007FF7E59F1D95
%s - %s, xrefs: 00007FF7E59F2299
SEC_E_CERT_EXPIRED, xrefs: 00007FF7E59F1E7E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: 034b749fa52bb0e83432a6375c736f1c388a10f79a58ee50a6da77af21e3aa5c
Instruction ID: d0efb1a1314ff26eda21238b1062642f7529ce7f4f724cd8af48856d3eeaa9b5
Opcode Fuzzy Hash: 034b749fa52bb0e83432a6375c736f1c388a10f79a58ee50a6da77af21e3aa5c
Instruction Fuzzy Hash: 4B314F2260C68585EB25AB60E4607FEFBA0BF84B44FC40137DA9D82A95DF3CD554C731

Function 00007FF7E59F1E8A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

%s (0x%08X), xrefs: 00007FF7E59F1D95
SEC_E_CERT_UNKNOWN, xrefs: 00007FF7E59F1E8A
%s - %s, xrefs: 00007FF7E59F2299

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: e079303a299a1b80ca10b30e1ba550ec69c8fd7568ac497db52d7815dacb691d
Instruction ID: 56148171028790e00b6469c448477814ac5f7322295704645d8cb716e7337f5c
Opcode Fuzzy Hash: e079303a299a1b80ca10b30e1ba550ec69c8fd7568ac497db52d7815dacb691d
Instruction Fuzzy Hash: EF314F2260C68585EB25AB60E4607FEFBA0BF84B44FC40137DA9D82A95DF3CD5548731

Function 00007FF7E59F1E66 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

%s (0x%08X), xrefs: 00007FF7E59F1D95
%s - %s, xrefs: 00007FF7E59F2299
SEC_E_CANNOT_INSTALL, xrefs: 00007FF7E59F1E66

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: da84ee425c665103f0509870f9862496ac41dbffd059b21d0e085cc4c39f0c10
Instruction ID: 8ad9d27e520be2979fa1108c0abdd85865619e998929e43035475bd89022e624
Opcode Fuzzy Hash: da84ee425c665103f0509870f9862496ac41dbffd059b21d0e085cc4c39f0c10
Instruction Fuzzy Hash: 85314F2260C68585EB25AB60E4607FEFBA0BF84B44FC40137DA9D82A95DF3CD5548731

Function 00007FF7E59F1E5A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

%s (0x%08X), xrefs: 00007FF7E59F1D95
SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF7E59F1E5A
%s - %s, xrefs: 00007FF7E59F2299

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: d6c51fbaba7f869f43a916abab987e5ed6b2a07158bb5033ab135ee3800e9c5b
Instruction ID: 9a29416538fa3ce91592e317678530ae14a0d69b03b62780f87bed6728210bdb
Opcode Fuzzy Hash: d6c51fbaba7f869f43a916abab987e5ed6b2a07158bb5033ab135ee3800e9c5b
Instruction Fuzzy Hash: C4314F2260C68585EB25AB60E4607FEFBA0BF85B44F840137DA9D82A95DF3CD5548731

Function 00007FF7E59F1E72 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

SEC_E_CANNOT_PACK, xrefs: 00007FF7E59F1E72
%s (0x%08X), xrefs: 00007FF7E59F1D95
%s - %s, xrefs: 00007FF7E59F2299

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 597226f125e326fc4276559fb01c1fdade4893ea3d3427af41880d6c60d103f9
Instruction ID: d8581f6caf79f57d74afff6a6a82c4a5bd321773898ca73f18d41c7bebc8fa64
Opcode Fuzzy Hash: 597226f125e326fc4276559fb01c1fdade4893ea3d3427af41880d6c60d103f9
Instruction Fuzzy Hash: D7314F2260C68585EB25AB60E4647FEFBA0BF84B44F840137DA9D82A95DF3CD5548731

Function 00007FF7E59F1D8E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7E59F1DE9
strchr.VCRUNTIME140 ref: 00007FF7E59F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F22C5
GetLastError.KERNEL32 ref: 00007FF7E59F22CE
SetLastError.KERNEL32 ref: 00007FF7E59F22DA

Strings

%s (0x%08X), xrefs: 00007FF7E59F1D95
%s - %s, xrefs: 00007FF7E59F2299
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF7E59F1D8E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: d12fab4b8c6893375368121d2eff4d50167fa0c363ab1c99d00b3eb034989995
Instruction ID: f3d6d593678d51729d055fc375db9f6664cfeb4cb0e96c397b6ced12b67374e3
Opcode Fuzzy Hash: d12fab4b8c6893375368121d2eff4d50167fa0c363ab1c99d00b3eb034989995
Instruction Fuzzy Hash: 2E317E2270C78685EB21AB60E4607FEFBA0BF84B44F840137DA9D82A95CF3CD544C721

Function 00007FF7E5A277B0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A27A08

Part of subcall function 00007FF7E5A05840: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7E5A11655,?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A05855
Part of subcall function 00007FF7E5A05840: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7E5A11655,?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A0586B

memcpy.VCRUNTIME140 ref: 00007FF7E5A27828
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A27979
memcpy.VCRUNTIME140 ref: 00007FF7E5A27A42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A27A4E

Strings

Cannot pause RTP, xrefs: 00007FF7E5A2794C
Failed writing RTP data, xrefs: 00007FF7E5A27943
Got an error writing an RTP packet, xrefs: 00007FF7E5A2795B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: f3879a8a08388b93ace09444e092abff1d8c4238582cb68e877fd15ded32fa93
Instruction ID: f8cb43adc09dd2f93fae801bdeed1f9bc6773c5851554e2ea2b9817e8bbd96ea
Opcode Fuzzy Hash: f3879a8a08388b93ace09444e092abff1d8c4238582cb68e877fd15ded32fa93
Instruction Fuzzy Hash: 31717036B09B8986E658EB25E411BB9ABA4FF49B90F844032DF5D97740DF3CE560C312

Function 00007FF7E5A3E240 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E30A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E358
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E3BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3E4F9

Part of subcall function 00007FF7E5A322A0: strchr.VCRUNTIME140(00000000,?,?,00007FF7E5A3185F), ref: 00007FF7E5A322E6
Part of subcall function 00007FF7E5A322A0: strchr.VCRUNTIME140(00000000,?,?,00007FF7E5A3185F), ref: 00007FF7E5A322F6
Part of subcall function 00007FF7E5A322A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7E5A3185F), ref: 00007FF7E5A32320
Part of subcall function 00007FF7E5A322A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A32355
Part of subcall function 00007FF7E5A322A0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3237A
Part of subcall function 00007FF7E5A322A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3239C

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3E584

Strings

GSSAPI, xrefs: 00007FF7E5A3E243
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF7E5A3E403
Kerberos, xrefs: 00007FF7E5A3E2D3, 00007FF7E5A3E375

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 765f7b10c892f1fb1e6010970bd4640316ed08fb1ae60ff5c030ea6a027f76d4
Instruction ID: 16416dd283dab9a48ef8709fdc0558d7330f573a4f93a6432c7e066ffe5b9616
Opcode Fuzzy Hash: 765f7b10c892f1fb1e6010970bd4640316ed08fb1ae60ff5c030ea6a027f76d4
Instruction Fuzzy Hash: FEA14B32B08B4A86EB509B65E460BADBBA5FF58B88F800036DE4D93754EF38D845C751

Function 00007FF7E59E73F9 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF7E59E7797
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF7E59E7947

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 3ff7f47f9996d535c6382d0025158cafa12b24fe735b2f180ded5116634d41eb
Instruction ID: aeb490a388189091524cdd8fd1a0fc42c9cf46eeff41d7986c1e1fabff796d6e
Opcode Fuzzy Hash: 3ff7f47f9996d535c6382d0025158cafa12b24fe735b2f180ded5116634d41eb
Instruction Fuzzy Hash: ABB16D7250CA8981E7249F28D4603BCB7A1FB15F48FA44532C65EC22D9DF39E985C363

Function 00007FF7E59F91B5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F91FA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F921A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F926B

Part of subcall function 00007FF7E59FAA80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FAA86

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9371

Strings

Replaced, xrefs: 00007FF7E59F9601
FALSE, xrefs: 00007FF7E59F934B
Added, xrefs: 00007FF7E59F960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7E59F9617

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 328f28ee43acbe02e3b55e4857f65d3be118cca83605d292f44299386820e1f1
Instruction ID: d702f43473cb3be48728258240322babc0952cd067514452aa3e9c34c43d2698
Opcode Fuzzy Hash: 328f28ee43acbe02e3b55e4857f65d3be118cca83605d292f44299386820e1f1
Instruction Fuzzy Hash: FD919221A0D78A45FF71AB2190647F9E7A1EF55F44F880037DA8E82691DF3CE4A48372

Function 00007FF7E5A124B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1257C

Strings

Authentication problem. Ignoring this., xrefs: 00007FF7E5A126BD
NTLM, xrefs: 00007FF7E5A125AC
Bearer, xrefs: 00007FF7E5A12698
Ignoring duplicate digest auth header., xrefs: 00007FF7E5A1262D
Digest, xrefs: 00007FF7E5A12614
Negotiate, xrefs: 00007FF7E5A12526
Basic, xrefs: 00007FF7E5A12671

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 2edee1d6d6b9369a94ec35f2711a8e3ce3417dfda42f4832661bacb91708de52
Instruction ID: ae3b349d869a6cf6972c0a2c814d0d86fdd1e1839c33142b5397835c609fb2ae
Opcode Fuzzy Hash: 2edee1d6d6b9369a94ec35f2711a8e3ce3417dfda42f4832661bacb91708de52
Instruction Fuzzy Hash: AA71E9A1B0C28E46F7546B229665B7AFED2AF01F88F844036DE5AC71C1DF3CE4548722

Function 00007FF7E59F92C3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F92C6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9371

Strings

Replaced, xrefs: 00007FF7E59F9601
__Host-, xrefs: 00007FF7E59F92FD
FALSE, xrefs: 00007FF7E59F934B
__Secure-, xrefs: 00007FF7E59F92E0
Added, xrefs: 00007FF7E59F960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7E59F9617

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 8bdde5ae7f6a45b5a7f26c8991cb0c6dd01dc0cbdf0c72bd889af76c7a23e672
Instruction ID: 935aa3c453e39ccf039763b440ac43e808c5dfeac8043a1e8dc26ca6c73223cc
Opcode Fuzzy Hash: 8bdde5ae7f6a45b5a7f26c8991cb0c6dd01dc0cbdf0c72bd889af76c7a23e672
Instruction Fuzzy Hash: 1F718321A0D78A45FF71AB2590647F9A791EF54F54F880037DA8D82691DF3CE4948332

Function 00007FF7E5A03FF0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A040CC
strchr.VCRUNTIME140 ref: 00007FF7E5A04100
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A04120
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A041A4

Strings

Connecting to port: %d, xrefs: 00007FF7E5A041C0
anonymous, xrefs: 00007FF7E5A04000
%s%s%s, xrefs: 00007FF7E5A0408F
Connecting to hostname: %s, xrefs: 00007FF7E5A0417B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: ae296eaaf9617ce67e340360966fd7ce56b0ec3a65961541972d05b3815a59bf
Instruction ID: 27cedc334a5d6b033cfce95493b4d3e4421605be4c953048f03f12214975427f
Opcode Fuzzy Hash: ae296eaaf9617ce67e340360966fd7ce56b0ec3a65961541972d05b3815a59bf
Instruction Fuzzy Hash: 9251FA22B08BC684EB21AF25A860BA9ABD0FF45F98F844136DE5D87785CF3DD545C312

Function 00007FF7E5A206A0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2075F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A207A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A20860

Strings

SMTPUTF8, xrefs: 00007FF7E5A2070D, 00007FF7E5A20815
EXPN, xrefs: 00007FF7E5A206E7
VRFY %s%s%s%s, xrefs: 00007FF7E5A2082E
%s %s%s, xrefs: 00007FF7E5A20729
HELP, xrefs: 00007FF7E5A20895

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: ec7dde51753d90db8e99e92e45708158327cfa7a3992d6b3b56b6418e18a2dea
Instruction ID: f2f17f79ad2ad80b1205e4aab62576de2b4fcf724b1602df701bd56949b903be
Opcode Fuzzy Hash: ec7dde51753d90db8e99e92e45708158327cfa7a3992d6b3b56b6418e18a2dea
Instruction Fuzzy Hash: 22519126B08B8981EB11AB11E420BB9AFA0FF45F84F844132DA8D93B95DF3CE545C752

Function 00007FF7E59F4067 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

ALL, xrefs: 00007FF7E59F4073
FLUSH, xrefs: 00007FF7E59F40F3
RELOAD, xrefs: 00007FF7E59F4115
SESS, xrefs: 00007FF7E59F40B3
Set-Cookie:, xrefs: 00007FF7E59F4188

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 9b66fc2e34baff06f096cbca24ff7e3129ac13fcb66a14bdd11d473ac3b2e9fc
Instruction ID: 2820acbdf4f4075be85bd2b7aad32d908021a58c8eaba0d7dcf1a3dc27dd93ce
Opcode Fuzzy Hash: 9b66fc2e34baff06f096cbca24ff7e3129ac13fcb66a14bdd11d473ac3b2e9fc
Instruction Fuzzy Hash: BD413E10B1C51A42FA24BB256A217F9D691AF94F80FD84033DA0EC76D6DF3DE4618372

Function 00007FF7E5A26371 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF7E5A26383
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2639E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A263CA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A263EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A264CC

Strings

Wildcard - Parsing started, xrefs: 00007FF7E5A26467

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 7821651418ac284b7fe37018b700e1dd8bffd1ee22ba97486258aa5e4425af75
Instruction ID: db1e180cc8b9100b1d38b01298c72b09b4675c9813a9221e2052ec9803c5c080
Opcode Fuzzy Hash: 7821651418ac284b7fe37018b700e1dd8bffd1ee22ba97486258aa5e4425af75
Instruction Fuzzy Hash: D5517E36B09B4681EB14EF15E461AB8BBA5FF84F44F854036CA8E97350DF38E444C321

Function 00007FF7E59F96A0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F96CD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F96F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F9701
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F970B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F9715
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F971F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F9729
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F9733
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F973D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F9746
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7E5A010B9,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E59F9761

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: dca2646a6d4bee659c796f93a2f38fa2669d1fcc608c2bf197bd4bbed9a2a8d6
Instruction ID: acbb4300b2c3c4914b8d940cabfccf6a68189936316a5505b86b4b203502aa0b
Opcode Fuzzy Hash: dca2646a6d4bee659c796f93a2f38fa2669d1fcc608c2bf197bd4bbed9a2a8d6
Instruction Fuzzy Hash: 2221AB36A18A46C2DB50AF11F865A79A760FF88F95F941032DE8F83724CF38D499C711

Function 00007FF7E5A2F4F0 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F4FC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F506
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F510
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F51A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F524
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F52E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F538
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F542
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F54C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F556
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A2E522,?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2F560

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction ID: c0991874306836f41906aeae9c15e2107ec9ebf9ecf6375db5da202d4705426e
Opcode Fuzzy Hash: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction Fuzzy Hash: B201B526B1490AC2D714AF26FC669386730FF88F59BA41032CE4F86224DE38D899C351

Function 00007FF7E5A2E8E0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EA35
memcpy.VCRUNTIME140 ref: 00007FF7E5A2EA52

Strings

%ld, xrefs: 00007FF7E5A2E99E
https, xrefs: 00007FF7E5A2E970
%%25%s], xrefs: 00007FF7E5A2EA62
file, xrefs: 00007FF7E5A2E8FB
file://%s%s%s, xrefs: 00007FF7E5A2E92E
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7E5A2EC22

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: 69b0ccfb545972a865a62a18da8bb8aafa5613a807871fdf383be4992c4471e4
Instruction ID: de78c76c6a7c34ee9fc31a42f620308645ba55ad366d653f0bfcc0511f7beba1
Opcode Fuzzy Hash: 69b0ccfb545972a865a62a18da8bb8aafa5613a807871fdf383be4992c4471e4
Instruction Fuzzy Hash: 95A16E65709B8A85EA65AB11E421BB9BBA0FF44F84F844137CE4D93798DF3CE484C721

Function 00007FF7E5A3A500 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E5A3A5A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3A5B9
memcpy.VCRUNTIME140 ref: 00007FF7E5A3A6F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3A754
memcpy.VCRUNTIME140 ref: 00007FF7E5A3A771

Strings

Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF7E5A3A6D1
8, xrefs: 00007FF7E5A3A7A3
cached response data too big to handle, xrefs: 00007FF7E5A3A7F1
response reading failed, xrefs: 00007FF7E5A3A791

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: ac4d52a539b15f27428fc5d89cc48acd8341c1d8d3da493b39954d9423c2a7b7
Instruction ID: 654358e3685c31c9f5563dcf79d6d4de87f76905a650f10f1976cae3a8fc4bbc
Opcode Fuzzy Hash: ac4d52a539b15f27428fc5d89cc48acd8341c1d8d3da493b39954d9423c2a7b7
Instruction Fuzzy Hash: 94819122708B9982DA54AF26D464BAEABA0FF45F88F844437DE4E87741DF3CD4A1C351

Function 00007FF7E5A36DD6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36E0F
memcpy.VCRUNTIME140 ref: 00007FF7E5A36E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37023

Strings

Serial Number, xrefs: 00007FF7E5A36F52
Signature Algorithm: %s, xrefs: 00007FF7E5A37011
Serial Number: %s, xrefs: 00007FF7E5A36F6C
Signature Algorithm, xrefs: 00007FF7E5A36FF7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 54122bf5e3d3342fd2a96bae5bdd9d8b9827785846c702c0f1603b4f91230c77
Instruction ID: d743fce3f809fb1f490433ee91c1070cb7ec2a1710df42a83977567149107357
Opcode Fuzzy Hash: 54122bf5e3d3342fd2a96bae5bdd9d8b9827785846c702c0f1603b4f91230c77
Instruction Fuzzy Hash: E6610851B0979A45EB18A7658434BBDAF91AF05FC8FC44537CA0F87785DE3CA1488322

Function 00007FF7E5A30E80 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7E5A144E8), ref: 00007FF7E5A31010
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7E5A144E8), ref: 00007FF7E5A31047
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7E5A144E8), ref: 00007FF7E5A3106E

Strings

NTLM, xrefs: 00007FF7E5A30E86
%sAuthorization: NTLM %s, xrefs: 00007FF7E5A31028, 00007FF7E5A310D4
Proxy-, xrefs: 00007FF7E5A3101E, 00007FF7E5A310CA
HTTP, xrefs: 00007FF7E5A30E96

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: 33b6c4fc7c206a8ba251b097363a5618546007abb926c668e6bcb56dbfa46066
Instruction ID: cb338e5f41e5b97095b918330dfa8233732a1ebf3084c014d7bd3e3e4c3fb4f7
Opcode Fuzzy Hash: 33b6c4fc7c206a8ba251b097363a5618546007abb926c668e6bcb56dbfa46066
Instruction Fuzzy Hash: 1B614B32B08B8A85E760AF15E854BAABBA5FB44F88F900037DA4D87754DF3CD545C712

Function 00007FF7E5A0D370 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0D3CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0D4CE
WSAIoctl.WS2_32 ref: 00007FF7E5A0D627
setsockopt.WS2_32 ref: 00007FF7E5A0D64F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0D746

Strings

We are completely uploaded and fine, xrefs: 00007FF7E5A0D6BA
Failed to alloc scratch buffer!, xrefs: 00007FF7E5A0D4E0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: ee81accd4b847cd42e6af56fc2334136a251d3c0f8ce0672d0cf2a3ae3100591
Instruction ID: 660357b285b6075f46ef4787416f7053a45b6b2eae9488afad32a639dc6e4e2f
Opcode Fuzzy Hash: ee81accd4b847cd42e6af56fc2334136a251d3c0f8ce0672d0cf2a3ae3100591
Instruction Fuzzy Hash: C4B17333B18A8A85EB65AF34D0647F9AB90EF44F5CF480136CF4D8A785DF3894958721

Function 00007FF7E5A2DEF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2DF37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2E0CF

Part of subcall function 00007FF7E5A1C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7E5A0340F), ref: 00007FF7E5A1C0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2DFCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2E10D

Strings

Failed sending Gopher request, xrefs: 00007FF7E5A2E0D5
%s?%s, xrefs: 00007FF7E5A2DF29

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 81f371cc6c3db1ce7e6c04f2230a01a77cff2dda73c20b072d1ffa1f43af017b
Instruction ID: 5a7ab6cf84da719fe6a590f49e0add8cae0d84a9ead47ec2933cd050f2ffb278
Opcode Fuzzy Hash: 81f371cc6c3db1ce7e6c04f2230a01a77cff2dda73c20b072d1ffa1f43af017b
Instruction Fuzzy Hash: 1251C825B0CA4682E610AB65A821BBAEB90FF44FE4F940233DE5D937D5DE3CD4428716

Function 00007FF7E5A397B5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A397F8
memcpy.VCRUNTIME140 ref: 00007FF7E5A3981D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A398EF
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

TRUE, xrefs: 00007FF7E5A3990D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: b52c7bb7d1c7cac77b7c8d046bf2007316f3759b90af48cd7ee6a67ced8cd261
Instruction ID: aa774907117772d2dc0b12639154f01297be8fc66784db31cab87583988a97d0
Opcode Fuzzy Hash: b52c7bb7d1c7cac77b7c8d046bf2007316f3759b90af48cd7ee6a67ced8cd261
Instruction Fuzzy Hash: 70512711F0D29A49FB2AAE254134B7CAF92EF55F94F844237C6AF826D5DE3C9045C322

Function 00007FF7E59E94D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EA9DD
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EAA0B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7E59EAA19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EAA53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EAAA4

Strings

value, xrefs: 00007FF7E59EA949

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 595543e97e4f44316877afba9dfb2750bd3319d5226b2b7634a77da9004cd7a0
Instruction ID: 1f258c63218b7e47b7d7a54e00c92a68727cb6bc6a4f83734cdefb747e1fb95b
Opcode Fuzzy Hash: 595543e97e4f44316877afba9dfb2750bd3319d5226b2b7634a77da9004cd7a0
Instruction Fuzzy Hash: C561C432B18A8985EB10EB74E4553EDA761EF45BA4F505332DA6C86AE9DF3CD081C311

Function 00007FF7E5A2EE30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7E5A2EE40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 0729c3e4434bc5675d099d01015e06993560b35443a2945d2449c0f814ce84fd
Instruction ID: 2e1c8aeeb927d244d55c793e29eb3e941141f6003ab16d8b84ef2774bc5b7f2c
Opcode Fuzzy Hash: 0729c3e4434bc5675d099d01015e06993560b35443a2945d2449c0f814ce84fd
Instruction Fuzzy Hash: 2451E416B0D28A45FB22A711A032B79AF919F46F50F880137DA9E977C1EE3DE444C323

Function 00007FF7E5A2EE06 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EE13
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: a8f65ed0a19ceec9d11366574aeb1cfd595ab54779fa0fea19c01c3edba6243c
Instruction ID: 54c22fc05277c24a23dfe8ef18b53bbcb07119c41ae236ebd38f7c83a49de11b
Opcode Fuzzy Hash: a8f65ed0a19ceec9d11366574aeb1cfd595ab54779fa0fea19c01c3edba6243c
Instruction Fuzzy Hash: 0C41D715B0D68A45FA22A711A036B79AFD19F06F50F880177DA9E967C1EE3DE4448323

Function 00007FF7E5A2A6A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7E5A2A70C
htons.WS2_32 ref: 00007FF7E5A2A722
send.WS2_32 ref: 00007FF7E5A2A7C8
WSAGetLastError.WS2_32 ref: 00007FF7E5A2A7DC
send.WS2_32 ref: 00007FF7E5A2A81E
WSAGetLastError.WS2_32 ref: 00007FF7E5A2A828

Strings

Sending data failed (%d), xrefs: 00007FF7E5A2A7E2, 00007FF7E5A2A82E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: befb03195a2148d1b1ff0ac0ac481479d5c72445e3b291bc39e30fad092fb3ed
Instruction ID: bb71120520f9cc354ccb50d99515db5a12a7a5dcf49e3cf3d492f442ae2423c2
Opcode Fuzzy Hash: befb03195a2148d1b1ff0ac0ac481479d5c72445e3b291bc39e30fad092fb3ed
Instruction Fuzzy Hash: ED41AE36708A8A85E7006F75D420EA8BB20FB54F89F848533DB8983754DFBCD006C322

Function 00007FF7E5A376BE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A376C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Part of subcall function 00007FF7E5A00240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00292

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: af7acaef84084e0d3a6a94bc248c2c0a1cef4ae4d46cb6da752fa977f64bedcd
Instruction ID: a3fd35e498f8c334dc213264e194d0caadf86b95815a49a5a796cb0b2b23feee
Opcode Fuzzy Hash: af7acaef84084e0d3a6a94bc248c2c0a1cef4ae4d46cb6da752fa977f64bedcd
Instruction Fuzzy Hash: 4D315261B0978A45EB11AB61D464AFDABA1BF05F8CFC40837CE4E97356DF3CA1448322

Function 00007FF7E5A377BD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7E5A378F1
Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92
GMT, xrefs: 00007FF7E5A3787E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: c6ae9fa0a038b8fac058063dacbcb7526f06a8394d406d1e43624cac3139f064
Instruction ID: a2560b9381f5639b8b6887ed991125a8e0194597d1e4da66e0204e899d01e9a7
Opcode Fuzzy Hash: c6ae9fa0a038b8fac058063dacbcb7526f06a8394d406d1e43624cac3139f064
Instruction Fuzzy Hash: CE71A061B0969A84EB10AB61D424AFDEFA5BF05B88FC44437CA8D87755DF3CE644C322

Function 00007FF7E5A376F4 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7E5A377A9
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92
GMT, xrefs: 00007FF7E5A37756

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 59f460ac5380dd79f6a867ac5ef20a454ae35efbab770c3c74f0f6e64463f9e0
Instruction ID: 82eb506301c77594ef343733f0ef2e049bb2a5ffabaadd4c0ed9b67948eb0843
Opcode Fuzzy Hash: 59f460ac5380dd79f6a867ac5ef20a454ae35efbab770c3c74f0f6e64463f9e0
Instruction Fuzzy Hash: 17512D61B0978A84EB10AB61D464AFDEFA5BF05F88FC44436CA4D97356DF3CE6448322

Function 00007FF7E59FEEA0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FEEE6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FEF12
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59FEF3E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction ID: 94a6c1d7626ad4c67ef0436f7126009828c0c708fd6fa1bf3c0fab0675d8f4ce
Opcode Fuzzy Hash: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction Fuzzy Hash: 7F517F22B1AB4182EB95CF65F050678B7A4FF48F84B581136EF4D43B49EF38D5A18721

Function 00007FF7E5A257B6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A257DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A25895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A258A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A258D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2594C

Strings

Entry path is '%s', xrefs: 00007FF7E5A258AE, 00007FF7E5A258E5
SYST, xrefs: 00007FF7E5A25876
Failed to figure out path, xrefs: 00007FF7E5A25952

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: 1cc48e0c41870337beabcd0a033c8b29a8aea442c7c760e77b31f6e6c80b91b2
Instruction ID: e490efc41cde53e6a1249dda19bfcdb5f5f42cce75f145cea58817d59024a3f6
Opcode Fuzzy Hash: 1cc48e0c41870337beabcd0a033c8b29a8aea442c7c760e77b31f6e6c80b91b2
Instruction Fuzzy Hash: 8841B765B086DA81E720BF25A461BB8AF90FF08F54F904033CE8E97655EE7CD045D321

Function 00007FF7E59F9870 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F98EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F98F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F98FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9912
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F991C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9926
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9930
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9939

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction ID: 999d307da7a8b0a75de5146521ef5690066d5515b142d334be6d6100fed93fc7
Opcode Fuzzy Hash: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction Fuzzy Hash: 93310B36A08A56C2E710AF12E824679B765FB84FD4F984032DE8E87B58CF3CD895C711

Function 00007FF7E59F9790 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F97D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F97E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F97EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F97F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F97FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9809
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9813
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F981D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F9826

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6a71efeabdaa36d73244b4352c5f5012b7b3ec64435facd515957462087f5632
Instruction ID: 2ccf6a75068aa342ec2deb2fe02caccd83b00fceea6684b96b9081c96d0eb022
Opcode Fuzzy Hash: 6a71efeabdaa36d73244b4352c5f5012b7b3ec64435facd515957462087f5632
Instruction Fuzzy Hash: 7A218836608A46C2D710AF21F865969B764FB88F95F940532DE8E83728CF3CD8998751

Function 00007FF7E5A336A0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7E5A32AB3), ref: 00007FF7E5A33748
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7E5A32AB3), ref: 00007FF7E5A3378A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7E5A32AB3), ref: 00007FF7E5A3382F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7E5A32AB3), ref: 00007FF7E5A33842
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A33D27

Strings

%s?dns=%s, xrefs: 00007FF7E5A33818
Failed to encode DOH packet [%d], xrefs: 00007FF7E5A33881

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: a8182fd0dfdacbe33f9d3f9c7374c26c3e360a6d2655ff1bf9f5d1c61c0da78b
Instruction ID: 97a92c8f5a6f73f9df9f5725d0cf17ca6dbf5e8f08b2628647c53dd77a228f6f
Opcode Fuzzy Hash: a8182fd0dfdacbe33f9d3f9c7374c26c3e360a6d2655ff1bf9f5d1c61c0da78b
Instruction Fuzzy Hash: 5F02AF61B0C7CA46E710AA669464BBDAF95AF44F9CF844033DE0DC7786EE78D844C362

Function 00007FF7E5A08FE0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A0910F

Strings

Internal error removing splay node = %d, xrefs: 00007FF7E5A08FF2
I32, xrefs: 00007FF7E5A090E5, 00007FF7E5A09145
I64, xrefs: 00007FF7E5A09105, 00007FF7E5A0916F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 9e80ba9495084d9940152a93fe6650defdac990b8f6d3432b4772d1b7d51b77b
Instruction ID: 403b253a90c78e8e00d8daf9c116c41a081993ad523a9b7f34927cfdaeee9d81
Opcode Fuzzy Hash: 9e80ba9495084d9940152a93fe6650defdac990b8f6d3432b4772d1b7d51b77b
Instruction Fuzzy Hash: 59A19532B196458AEB20AF25E464B7EBFA4FB48B4CF854136DA9D83254DF3CD208C751

Function 00007FF7E5A18EB0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A190DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1911F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A19147
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A19189

Strings

schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF7E5A190A3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF7E5A18F2E
schannel: ApplyControlToken failure: %s, xrefs: 00007FF7E5A18FB8

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 2a7a42c719cfc41e9ecda004752248a4e22455c9d79dbc273a396cbd76637f1d
Instruction ID: 18103358383284ce4e676f2c29118bab0b6eb8b6beed813aa78f1a7060708bc4
Opcode Fuzzy Hash: 2a7a42c719cfc41e9ecda004752248a4e22455c9d79dbc273a396cbd76637f1d
Instruction Fuzzy Hash: DF915A72704F8986EB109F25E8A4AAE7BA4FB44F88F940136DE4D87764DF38D445CB11

Function 00007FF7E5A17900 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7E59FA92A,?,?,?,?,?,?,?,00007FF7E59FA6F7), ref: 00007FF7E5A17911
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7E5A17AB3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7E5A17AD0

Strings

0123456789ABCDEF, xrefs: 00007FF7E5A17AC2, 00007FF7E5A17AC9
0123456789abcdef, xrefs: 00007FF7E5A17AA2, 00007FF7E5A17AAC
TRUE, xrefs: 00007FF7E5A17A3C

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 6731cf7eb79fe99fc956e7da2918d2a85c4fd8fba441eb85d481e59dff622fac
Instruction ID: 7a9708d4c44badafb83069dffb085112ffd2320f555b9b0530c60320fc011db8
Opcode Fuzzy Hash: 6731cf7eb79fe99fc956e7da2918d2a85c4fd8fba441eb85d481e59dff622fac
Instruction Fuzzy Hash: 0751F752B0D6CE41EA61AB249660B7AEB90AF45F48FD45032D94ECA746DF3CD541C322

Function 00007FF7E5A3962A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7E5A39751
TRUE, xrefs: 00007FF7E5A3990D
GMT, xrefs: 00007FF7E5A396DE

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 526dd6a61990846182b873f93f743bd90d9af5d28ecef45840b88224687b0280
Instruction ID: be7b3a91f5cc6c9cd9f9fc51ee768ea9693a29c9c85bd9dac7977160b77411ea
Opcode Fuzzy Hash: 526dd6a61990846182b873f93f743bd90d9af5d28ecef45840b88224687b0280
Instruction Fuzzy Hash: 5761E361B0D69A89FB21AF649524B7DEF95AF01F88FD44033C68E82694DF3CD541C722

Function 00007FF7E59F917C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9182
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9371

Strings

Replaced, xrefs: 00007FF7E59F9601
FALSE, xrefs: 00007FF7E59F934B
Added, xrefs: 00007FF7E59F960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7E59F9617

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 90133f61e9f3a2972452251f6a672964b389b412b9e8e14f35b27df89e8546ac
Instruction ID: b38b5cad954b385bae0a1d0c497d6a17ed70032620cf3dd2fa68974e4ef36ef6
Opcode Fuzzy Hash: 90133f61e9f3a2972452251f6a672964b389b412b9e8e14f35b27df89e8546ac
Instruction Fuzzy Hash: B6618221A0979A45FF71AB25A0643FAE792EF54F54F880037DB8D82691DF3CE4948372

Function 00007FF7E59F9319 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F931C

Part of subcall function 00007FF7E5A176F0: strchr.VCRUNTIME140 ref: 00007FF7E5A17726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9371

Strings

Replaced, xrefs: 00007FF7E59F9601
FALSE, xrefs: 00007FF7E59F934B
Added, xrefs: 00007FF7E59F960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7E59F9617

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 62dffb43bf084e46f221ed9f2adcc8f6b7e67df89a3940d09ae168eab1eb17b1
Instruction ID: b723ce5d256527e86c6d5bad65e8e44e852db176cad91f39dbbcc8a1f54b3713
Opcode Fuzzy Hash: 62dffb43bf084e46f221ed9f2adcc8f6b7e67df89a3940d09ae168eab1eb17b1
Instruction Fuzzy Hash: F3619361A0978A45FF71AB25A0643FAE7A1EF54F54F880037DB8D82691DF3CE4948372

Function 00007FF7E5A202C0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2030A
memcpy.VCRUNTIME140 ref: 00007FF7E5A20421
memcpy.VCRUNTIME140 ref: 00007FF7E5A20492
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A204BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A204D0

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF7E5A20320

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 983475b5252fee3b519ee8893d5ff2ec22a28cab796edf3ac853c7e78d6e9305
Instruction ID: da2b7d7ef85b08a991a7ff9efa443a458250f47c81ad756a7b690a9cdd78442a
Opcode Fuzzy Hash: 983475b5252fee3b519ee8893d5ff2ec22a28cab796edf3ac853c7e78d6e9305
Instruction Fuzzy Hash: 7A519D2671878996EA25EB65A410BAABBA0FF08B84F840036CF8D97751DF3CE154C321

Function 00007FF7E5A23400 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF7E5A234C3

Strings

, xrefs: 00007FF7E5A23467
RETR response: %03d, xrefs: 00007FF7E5A23458
bytes, xrefs: 00007FF7E5A234B9
Maxdownload = %I64d, xrefs: 00007FF7E5A2355C, 00007FF7E5A235FB
Data conn was not available immediately, xrefs: 00007FF7E5A235B7
Getting file with size: %I64d, xrefs: 00007FF7E5A23575

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 6e3d0a3c5aa691337795dccfca836fcde4962f08d3d7d525d14d9e7aa75dc6f1
Instruction ID: c30bb53d74a0cf632b1cada13b28161397b802006405989572b3be4a6181fe4e
Opcode Fuzzy Hash: 6e3d0a3c5aa691337795dccfca836fcde4962f08d3d7d525d14d9e7aa75dc6f1
Instruction Fuzzy Hash: 94513966B0978945FB24BB68A455BB8FB90EF06B64FC40237CA5D826C1DF7CE4818712

Function 00007FF7E59E5DD0 Relevance: 10.6, APIs: 7, Instructions: 146COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5E61
memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5EA5
memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5F42

Part of subcall function 00007FF7E5A3F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7E59E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E5A3F20A

memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5F74
memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5F8F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E5FAC

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction ID: ec047452d5502db9fd694d81a0d9f25e78531e2cdfc44876c73c50ad987d0f07
Opcode Fuzzy Hash: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction Fuzzy Hash: 3551D032A08B8991EA14AF25D5143ACA3A1FB14FD4F940A36DF2E873D1CF78E191D352

Function 00007FF7E5A231D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF7E5A23376

Part of subcall function 00007FF7E5A3A500: memcpy.VCRUNTIME140 ref: 00007FF7E5A3A5A8
Part of subcall function 00007FF7E5A3A500: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3A5B9

Strings

We got a 421 - timeout!, xrefs: 00007FF7E5A233B5
FTP response aborted due to select/poll error: %d, xrefs: 00007FF7E5A23384
FTP response timeout, xrefs: 00007FF7E5A233E3
*, xrefs: 00007FF7E5A23344
QUOT string not accepted: %s, xrefs: 00007FF7E5A2339F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: fa97018fce896f81ca5d4429d1ceceda691d05f0cb1cad433c6317878a5e6d84
Instruction ID: 1118dd5428e75cfbd0449e2873e25d0a57cef16d2ee8b2acedfa0626dc8fc573
Opcode Fuzzy Hash: fa97018fce896f81ca5d4429d1ceceda691d05f0cb1cad433c6317878a5e6d84
Instruction Fuzzy Hash: 04510726B0C68A85FB24BA298421BB99B90BF46F94FC44133DE4DD72C1EF3CE5448712

Function 00007FF7E5A37DCB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A38139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3814C

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7E5A37EEF
Signature, xrefs: 00007FF7E5A380CF
GMT, xrefs: 00007FF7E5A37E7E
Signature: %s, xrefs: 00007FF7E5A380E7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: 486b11a5dbf6f6220d0470a4a60f1b5c1fbc44e62c4a92e0fa326115e51303ef
Instruction ID: e551ad0b8c27d8f4ed8ecd8700a19e663875a8dd406c6004682fb981ec9acb62
Opcode Fuzzy Hash: 486b11a5dbf6f6220d0470a4a60f1b5c1fbc44e62c4a92e0fa326115e51303ef
Instruction Fuzzy Hash: 6651BF62B0C68A81EA159B24E424BBDEBA4EF45F98F940033DA8D83754CF3CD605C322

Function 00007FF7E5A08420 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A32144
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3216A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A32178

Strings

true, xrefs: 00007FF7E5A320E4
stale, xrefs: 00007FF7E5A320CF
Digest, xrefs: 00007FF7E5A08448

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 29f2d144675f23a553318cadf2dbd3e2c172a0bf61d37d97765e181fdbbf1ba6
Instruction ID: 5c93a11897f04c313ee5b0b51afc65d8c1b5acc1b1adcfb5df649213c88b4408
Opcode Fuzzy Hash: 29f2d144675f23a553318cadf2dbd3e2c172a0bf61d37d97765e181fdbbf1ba6
Instruction Fuzzy Hash: 5751A521B08A4A82EB20AB21E9607BDAB91FF45F88F944132DB9D876C1DF3CD555C721

Function 00007FF7E5A2BFB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF7E5A2C010
memcpy.VCRUNTIME140 ref: 00007FF7E5A2C036
memchr.VCRUNTIME140 ref: 00007FF7E5A2C133

Strings

Internal error: Unexpected packet, xrefs: 00007FF7E5A2C0D8
TFTP error: %s, xrefs: 00007FF7E5A2C150
Received too short packet, xrefs: 00007FF7E5A2C062

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: b5abf7ddbc41a4e4313125dd5a2000d1c180a3dd02d87012433adc899920b445
Instruction ID: 637f5cf6e84287266b1d4be8d1a0018444a824437b2066b9707349052c2136ef
Opcode Fuzzy Hash: b5abf7ddbc41a4e4313125dd5a2000d1c180a3dd02d87012433adc899920b445
Instruction Fuzzy Hash: 1B51E465B0858A85EB64AB259432BB9AB90FF44F84F844133EF4D97785DE3CE405CB21

Function 00007FF7E59E2370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7E59E23CB), ref: 00007FF7E59E6E4E
Part of subcall function 00007FF7E59E6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7E59E23CB), ref: 00007FF7E59E6E5C
Part of subcall function 00007FF7E59E6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7E59E23CB), ref: 00007FF7E59E6E72

Part of subcall function 00007FF7E59E3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E3BF6

Part of subcall function 00007FF7E59E5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF7E59E1DBA), ref: 00007FF7E59E5E61

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2469
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E24A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E24F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2544

Strings

at line , xrefs: 00007FF7E59E23BC
, column , xrefs: 00007FF7E59E23F9

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: 57100d119804690e628be863f834d55bd5b6b334a7ff37d4b486aad42ae39a7f
Instruction ID: 1ac3f90ceae40065a0c9f288462a9f94239f70203fef4eab2e730d591703cdf5
Opcode Fuzzy Hash: 57100d119804690e628be863f834d55bd5b6b334a7ff37d4b486aad42ae39a7f
Instruction Fuzzy Hash: 3A51B062F08B8985FB00EBB4E4543EC6762EB44BA8F405232DA6D93BD9DF38D085D351

Function 00007FF7E5A2EE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 995a1957d159ea99697b42c3a6b6bf0ff12af625b36380b0b66350f6ea9b707c
Instruction ID: bdac439706ff7f1863aff257b6932c96696549700e8127efb7c41190c6377146
Opcode Fuzzy Hash: 995a1957d159ea99697b42c3a6b6bf0ff12af625b36380b0b66350f6ea9b707c
Instruction Fuzzy Hash: 2B41D605B0D28A45FA62A711A022779AF91AF06F54F880176DA9E967C1EE3DE4448323

Function 00007FF7E5A2EE77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: ca10f7099a8e11b7cfc61e554ba5e926ab0c0bb5474b4376fd2f4e3479e7f3e1
Instruction ID: bbc7a2652be9a95880b95fb85eb4431f61a770ff01ee362783f8fafb415182b0
Opcode Fuzzy Hash: ca10f7099a8e11b7cfc61e554ba5e926ab0c0bb5474b4376fd2f4e3479e7f3e1
Instruction Fuzzy Hash: 4841D406B0D28A44FB22A711A036B79AF919F06F54F880177DA9E967C1EE3DE4448323

Function 00007FF7E5A2EE22 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 4ce7970afd5a9239f65debad424b97acd0ba8e2cc2fc0e723198cdc55f5ca029
Instruction ID: b77c082598da73cd9c9217e5b4f725dd58fce6087e6dc3ea8170b7b72468e9af
Opcode Fuzzy Hash: 4ce7970afd5a9239f65debad424b97acd0ba8e2cc2fc0e723198cdc55f5ca029
Instruction Fuzzy Hash: D541B506B0D29A44FA62A711A036B79AFD19F06F50F880177DA9E967C5EE3DE4448323

Function 00007FF7E5A2EDF8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 83e1fb0100f905c57ab9f068d43ff6605369474d9e078fffc21d34a0778c98eb
Instruction ID: 14381b5f2a9f530d1b43c9cf36d0bc4378c3ee88e65144d038fb140bfc0c9a47
Opcode Fuzzy Hash: 83e1fb0100f905c57ab9f068d43ff6605369474d9e078fffc21d34a0778c98eb
Instruction Fuzzy Hash: 0041D506B0D29A44FA22A711A036B79AFD19F06F50F880177DA9E967C1EE3DE4448323

Function 00007FF7E5A2EDEA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 9d88bebb43b2fbc7647fe023011e1ba91fe3620b1f9d8eca84b5e207088da114
Instruction ID: 1de06c4f2d681911dcd89887f3d1f760c1a36ccf71a54a09381e1d6e844429e6
Opcode Fuzzy Hash: 9d88bebb43b2fbc7647fe023011e1ba91fe3620b1f9d8eca84b5e207088da114
Instruction Fuzzy Hash: 8B41D506B0D29A45FA22A711A036B79AFD19F06F50F880177DA9E967C1EE3DE4448323

Function 00007FF7E5A2EDDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: e40c05a633061906cd65db25f240a886dccca3a985eefeb9232968f34b6f1054
Instruction ID: bb206171f22d7a833c0827afa88c913083be7233116e3fdc1bc65b42b80b5804
Opcode Fuzzy Hash: e40c05a633061906cd65db25f240a886dccca3a985eefeb9232968f34b6f1054
Instruction Fuzzy Hash: E641D606B0D29A44FA22A711A036B79AFD19F06F50F880177DE9E977C1EE3DE4448323

Function 00007FF7E5A2EEAD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2F0FB

Strings

%%%02x, xrefs: 00007FF7E5A2EFA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: a37f3f224fc798ce1b298b1525752757f579e6cf70c552f4d4f4674165861193
Instruction ID: 1bb9d6dae5afa934e2756705372a7fae98a50f985fca14e265e090bad28b7ab7
Opcode Fuzzy Hash: a37f3f224fc798ce1b298b1525752757f579e6cf70c552f4d4f4674165861193
Instruction Fuzzy Hash: 4241C606B0D29A44FA62A711A036B79AFD19F06F50F880177DE9E977C5EE3DE4448323

Function 00007FF7E5A37610 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
%s%lx, xrefs: 00007FF7E5A3766D
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: 0b765e0755920559e9d2752ae23419eff446ece7a23fa35f3ed63ae1d9cff77a
Instruction ID: 4dde232f633feec2e1b65d7b945a496372e8724e22f46f08023598b87eb804a5
Opcode Fuzzy Hash: 0b765e0755920559e9d2752ae23419eff446ece7a23fa35f3ed63ae1d9cff77a
Instruction Fuzzy Hash: 04415251B0969A45EA11AB659464BFDABA1BF05F8CFC44833CE4E87746DF3CE2448322

Function 00007FF7E5A0C360 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A0C4AA

Strings

the ioctl callback returned %d, xrefs: 00007FF7E5A0C455
ioctl callback returned error %d, xrefs: 00007FF7E5A0C46F
necessary data rewind wasn't possible, xrefs: 00007FF7E5A0C4B5
seek callback returned error %d, xrefs: 00007FF7E5A0C3FE
Cannot rewind mime/post data, xrefs: 00007FF7E5A0C4E0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 636c29a6ac46b64cd287b79ad26834ec061afeb8b3ebe0566f26f826e7c36bbb
Instruction ID: 341e84ea73e36f9262369358ad804c9cf04537ec1798f6cd932359bca29ed044
Opcode Fuzzy Hash: 636c29a6ac46b64cd287b79ad26834ec061afeb8b3ebe0566f26f826e7c36bbb
Instruction Fuzzy Hash: 0D41B461B2464942EB50BF79A4647B89791EF89F98FC81032DF0D8B289DF3DE4918721

Function 00007FF7E5A1FE10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1FE4D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A1FEBE

Strings

., xrefs: 00007FF7E5A1FEB7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: f91b2f7d14dfdf7098ab5232583014ba284079e117e41f318c1d2d3077799d1f
Instruction ID: 5e9f5863426ac84483846e8d50adf46868266e56d0179ef1e9bf9c3731fca82d
Opcode Fuzzy Hash: f91b2f7d14dfdf7098ab5232583014ba284079e117e41f318c1d2d3077799d1f
Instruction Fuzzy Hash: 5541E962B08BCA82E720EB11A520B7DFA90FF45F94F844132DA4D83695CF7CE4518362

Function 00007FF7E5A36DDE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36E0F
memcpy.VCRUNTIME140 ref: 00007FF7E5A36E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37023

Strings

Serial Number, xrefs: 00007FF7E5A36F52
Signature Algorithm: %s, xrefs: 00007FF7E5A37011
Serial Number: %s, xrefs: 00007FF7E5A36F6C
Signature Algorithm, xrefs: 00007FF7E5A36FF7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: d8f8e0a4a0e375cd5f204021ae47b3fac140e17fff0a1bf2cfc304c0a5c5ad0c
Instruction ID: 2d7f97ae78f234b82fd9704e26d04b1174f2af47990ebc95fa38f6793d50896f
Opcode Fuzzy Hash: d8f8e0a4a0e375cd5f204021ae47b3fac140e17fff0a1bf2cfc304c0a5c5ad0c
Instruction Fuzzy Hash: E7418D51B0978A44EB14AB659424BBDABA2BF05FC8FC44437CE0E9B755EF3CA5048322

Function 00007FF7E5A397BD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A397F8
memcpy.VCRUNTIME140 ref: 00007FF7E5A3981D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

TRUE, xrefs: 00007FF7E5A3990D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: 8ef32bb30e83b178644582b19e9688f8a4366afb6a486a2f55abccd6880cd497
Instruction ID: aa64146037e50f8b5cbb511ce3680b24b758e25571291342b6b2ca60c2ffe767
Opcode Fuzzy Hash: 8ef32bb30e83b178644582b19e9688f8a4366afb6a486a2f55abccd6880cd497
Instruction Fuzzy Hash: 6D310111F0D68A48FB22EF255124B3CEF929F55F98F840633C99E82AD5EE3C9441C322

Function 00007FF7E5A30430 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A1BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BF68
Part of subcall function 00007FF7E5A1BF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BF8E
Part of subcall function 00007FF7E5A1BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BFAF
Part of subcall function 00007FF7E5A1BF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A004B9,?,?,?,?,00007FF7E59FF85B), ref: 00007FF7E5A1BFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A304CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A30518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A30521

Strings

%s%s.netrc, xrefs: 00007FF7E5A3048F
%s%s_netrc, xrefs: 00007FF7E5A304E4
HOME, xrefs: 00007FF7E5A30469

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: ce33ce03b15b08335ee075b48f2ac132f7423bfbe585d713eb93ca792406d6ff
Instruction ID: ba45a359e100df6c58833019ff36bc883d251abd6ad665cf13359453ff88cf36
Opcode Fuzzy Hash: ce33ce03b15b08335ee075b48f2ac132f7423bfbe585d713eb93ca792406d6ff
Instruction Fuzzy Hash: 5C319721B09B4AC1EA10EB16BC20A6AEA90BF44FD8FD44133ED8D87755EF3CE5458721

Function 00007FF7E5A37068 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3709C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Strings

FALSE, xrefs: 00007FF7E5A37091
Start Date: %s, xrefs: 00007FF7E5A37577
TRUE, xrefs: 00007FF7E5A3708A
Start Date, xrefs: 00007FF7E5A3755D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 1f487dde392c3a3120692d44dd57c5843b08388db113ca8ef60605f3459bfef1
Instruction ID: b48b1448ed26d64050a373213bd9bb8bec924c5a7b26226ac326d35dee60faa6
Opcode Fuzzy Hash: 1f487dde392c3a3120692d44dd57c5843b08388db113ca8ef60605f3459bfef1
Instruction Fuzzy Hash: 1B21A152B096CA85EB25AB24A464BB9AB51BF05F88FC44433CA4D87755CF3CE184C322

Function 00007FF7E5A05640 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A05675
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A056A1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A056A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A056CB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E5A029BC), ref: 00007FF7E5A056E2

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF7E5A056B4

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: c0c8fcb44667ca2c8fe23aa92df2b9262a7bcb97f9c91f97d65f5fb040fd2184
Instruction ID: 186919e530daf9cdad5e83349fd5fcc43d8bcf1f72e03c68db7d614cf3630490
Opcode Fuzzy Hash: c0c8fcb44667ca2c8fe23aa92df2b9262a7bcb97f9c91f97d65f5fb040fd2184
Instruction Fuzzy Hash: 63118931B1954A82EB00FB61E464B79AB60EF85F48F980433DA0D87654DF3DD444CB22

Function 00007FF7E5A05570 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A05584
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0559A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055AE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055C2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055D6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A055FE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A05612

Part of subcall function 00007FF7E5A2E510: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A0562B,?,?,00000000,00007FF7E5A01073,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A2E525

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction ID: 4bd00aa9744cea50f3af6822aec58bd3f42e71a36a6640b9d2897927f8315dd2
Opcode Fuzzy Hash: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction Fuzzy Hash: 5E115636608F85C1D7009F21FDA55E877A4FBC9F9AB980136DE4F8F6549F3490958221

Function 00007FF7E59FF050 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF061
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF071
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF07F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF08D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF09B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A02856), ref: 00007FF7E59FF0C5

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction ID: d14fcfe8c4f397accf3b0eb4aaec58003c90c5bc7efcaf209cb4d9178614806d
Opcode Fuzzy Hash: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction Fuzzy Hash: 45015936608B06C2D714AF21F99593C77B4FF89F997A15126CE8E82718CF38D499C351

Function 00007FF7E59FA7B0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA7F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59FA803

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 76e9e92d93f0c8c719248e6433bf710fa477ed7a141f7287600a96dac61d5d71
Instruction ID: 741171aeea2c81edf49a95581675873fb2f40e7291a968ba9c4d283f6d298d26
Opcode Fuzzy Hash: 76e9e92d93f0c8c719248e6433bf710fa477ed7a141f7287600a96dac61d5d71
Instruction Fuzzy Hash: 9BF0A966B1490AC2D714AF66FC669386730FF98F55BA41032CD5F86364CE3CD899C351

Function 00007FF7E59EEE20 Relevance: 9.3, APIs: 6, Instructions: 273COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E59EEF1C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EEF9D
memcpy.VCRUNTIME140 ref: 00007FF7E59EEF2F

Part of subcall function 00007FF7E5A3F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7E59E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E5A3F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59EEFAA
memcmp.VCRUNTIME140 ref: 00007FF7E59EF03D
memcmp.VCRUNTIME140 ref: 00007FF7E59EF0C1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcmpmemcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 2846809682-0
Opcode ID: 69c2e6193ddaa38194f47971ac0935eb94a2df83c2e04eaa05abd7d51751e23c
Instruction ID: e42e98927c0bf3a541dd76c4e59ea1df4c82812aa901d99169ebe29d311c20ae
Opcode Fuzzy Hash: 69c2e6193ddaa38194f47971ac0935eb94a2df83c2e04eaa05abd7d51751e23c
Instruction Fuzzy Hash: 1FA1F222718A8982EA10EF25E4543A9A7A0FB48FD4F984536DFAD877C5DF3CE091C311

Function 00007FF7E5A02120 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7E5A0299B), ref: 00007FF7E5A02137
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7E5A0299B), ref: 00007FF7E5A02168

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: c13eb664660336fd0cc8a44c18222f56f9417570d696fd593da57c98a09dd568
Instruction ID: 702ce65c55dddf08c52a50dc5ce7811b2fe1a2014d7569582e37ddb4be831abd
Opcode Fuzzy Hash: c13eb664660336fd0cc8a44c18222f56f9417570d696fd593da57c98a09dd568
Instruction Fuzzy Hash: A3919C22609BC189E7459F34D4507AD7BA1FB59B28F480236CFAC4B3D6DF3991A4C722

Function 00007FF7E5A373DC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3741F
memcpy.VCRUNTIME140 ref: 00007FF7E5A37445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Strings

Start Date: %s, xrefs: 00007FF7E5A37577
Start Date, xrefs: 00007FF7E5A3755D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: 320c2bfa95c58a3e1609ac9c22957941cfe5e410ed8167142616c93d932a3e4d
Instruction ID: 95988ab8e7b239577b6f9cdc3cd5fd305c239129ccf67a5f2a87a98a7f201176
Opcode Fuzzy Hash: 320c2bfa95c58a3e1609ac9c22957941cfe5e410ed8167142616c93d932a3e4d
Instruction Fuzzy Hash: B8413951B092CA46EF1D66218034B7DAF82AF05F98F844637CA1F877C5DE3CE2458322

Function 00007FF7E59EC600 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E59EC6EA
memcpy.VCRUNTIME140 ref: 00007FF7E59EC6F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59EC72D
memcpy.VCRUNTIME140 ref: 00007FF7E59EC734
memcpy.VCRUNTIME140 ref: 00007FF7E59EC743
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59EC768

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 56b14bdc5f89045d4f7b2da786287d42a27f2024155c1ece33cbbf5de22e5f5c
Instruction ID: e4229c3a1b66cd53fbac925da9d4044883ec9540ed1c269aca4caab1767d37d8
Opcode Fuzzy Hash: 56b14bdc5f89045d4f7b2da786287d42a27f2024155c1ece33cbbf5de22e5f5c
Instruction Fuzzy Hash: 8B31AE6271974A85EE14AB16A5142E9A295BF08FE0F980633DFAD877D5CF3CE0418221

Function 00007FF7E59E4EB0 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7E59E3C25,?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E4FA3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7E59E3C25,?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E4FB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF7E59E3C25,?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E4FEA
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7E59E3C25,?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E4FF4
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7E59E3C25,?,?,?,?,?,00007FF7E59E1D8B), ref: 00007FF7E59E5002
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E5031

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: a0251d31b2e56c634ffd3971ee331e0c2d19140fef6248804dc9cc2118053b84
Instruction ID: 00ca7a2507ae1de3e95cc1df17c998b4cbca7d4aa401dd767ac696386aa9b13a
Opcode Fuzzy Hash: a0251d31b2e56c634ffd3971ee331e0c2d19140fef6248804dc9cc2118053b84
Instruction Fuzzy Hash: 1041D32171964985EA14AB16A5243ADE791BF08FE4F940A32DF6D8BBD5CF3CE0418311

Function 00007FF7E5A08800 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF7E5A088E5
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A088F4
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08906
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A08918
VerSetConditionMask.KERNEL32 ref: 00007FF7E5A0892E
VerifyVersionInfoA.KERNEL32 ref: 00007FF7E5A08941

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: b6c6db3b816de679375f91f2878e76babe7d6183a69cc8df1fcf61702d0bf89d
Instruction ID: 4b240f9eb88e15eaa80b91a6bf0513a28c7744944e17f5d2bc8d93196f9e06cb
Opcode Fuzzy Hash: b6c6db3b816de679375f91f2878e76babe7d6183a69cc8df1fcf61702d0bf89d
Instruction Fuzzy Hash: 5641FB22F2C68686F6309B21A424BBAEB90EFD5B44F405236D5C942B54DF7DE4848B11

Function 00007FF7E5A3790F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: a7dcf3b872bca8685f5961ceb99f1390aa710949134b2c2dcb5dcad2218fd221
Instruction ID: 1b262a1cc97b0a59dc5dcd86e598571df4de6bcd59765d6593b40afac92902ee
Opcode Fuzzy Hash: a7dcf3b872bca8685f5961ceb99f1390aa710949134b2c2dcb5dcad2218fd221
Instruction Fuzzy Hash: DD418565B0978644EB10AB61D4646FDABA1BF05F9CF884533CE5E87786DF3CD2448322

Function 00007FF7E5A322A0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF7E5A3185F), ref: 00007FF7E5A322E6
strchr.VCRUNTIME140(00000000,?,?,00007FF7E5A3185F), ref: 00007FF7E5A322F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7E5A3185F), ref: 00007FF7E5A32320
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A32355
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3237A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3239C

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 701b562d305d28b033affdddbf65d7e14a7e199027673d6d929ac0e14e4089d7
Instruction ID: 4e4a27657094450ca7cffb0d0af97f6a3261d0ad253ea9aed991926a14979407
Opcode Fuzzy Hash: 701b562d305d28b033affdddbf65d7e14a7e199027673d6d929ac0e14e4089d7
Instruction Fuzzy Hash: CB31EA21B09B8686EA54FF12A46077DBB91EF85F84F445636DE4E43784DF3CE0409311

Function 00007FF7E5A3D850 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3D8F9
memcpy.VCRUNTIME140 ref: 00007FF7E5A3D915
memcpy.VCRUNTIME140 ref: 00007FF7E5A3D92C
memcpy.VCRUNTIME140 ref: 00007FF7E5A3D947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3D97A

Strings

PLAIN, xrefs: 00007FF7E5A3D85B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 8f06fc03e41532ca5b0a05e7a0119cb7575dcb3cf368c3afc8c923dc2a594b74
Instruction ID: c683cd10bd78db5ca7f490468c13be3f96ae4461f0b2abe2f4f02d69a9ef4b45
Opcode Fuzzy Hash: 8f06fc03e41532ca5b0a05e7a0119cb7575dcb3cf368c3afc8c923dc2a594b74
Instruction Fuzzy Hash: 6731D366B08B8982EB109F15E45076AEB90FF45FE8F848632DE9D87795EE3CD045C311

Function 00007FF7E5A36D9F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A36F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37023

Strings

Serial Number, xrefs: 00007FF7E5A36F52
Signature Algorithm: %s, xrefs: 00007FF7E5A37011
Serial Number: %s, xrefs: 00007FF7E5A36F6C
Signature Algorithm, xrefs: 00007FF7E5A36FF7

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 2fd35b2195533c0d331094ca4293c55f542b21112d758763103316afcab7a770
Instruction ID: d1493f48c08e04b6e3159268ff928b8e9bec946ea995d8f753e81bb69beabfcd
Opcode Fuzzy Hash: 2fd35b2195533c0d331094ca4293c55f542b21112d758763103316afcab7a770
Instruction Fuzzy Hash: 6A417362B0978644EB11AB61D464AFDABA1BF05FCCF884437DE0E97756DF38E1448322

Function 00007FF7E5A37685 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: b659deefd899a68d928ef1cf79296cef25cdd2965dd7581ad9d560776997bfc4
Instruction ID: 6be161246b7ab7b1d667b2afd2fdf5be99c9b2f96bc08cb6984e817a660b6f33
Opcode Fuzzy Hash: b659deefd899a68d928ef1cf79296cef25cdd2965dd7581ad9d560776997bfc4
Instruction Fuzzy Hash: 3E315451B0978A45EB11AB619464AFDABA1BF05F8CFC40837CE4E87346DF3CE1448322

Function 00007FF7E5A376D6 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A38800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Part of subcall function 00007FF7E5A00240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00292

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: e0429e70490afcf1625c8906fbbcc74cc03aec47c80e042e40f4a1758fe81c31
Instruction ID: 1c86a73eb350f16c6d9a32cdb2ccda82877fefc8ddc809e6edbf763f6162d099
Opcode Fuzzy Hash: e0429e70490afcf1625c8906fbbcc74cc03aec47c80e042e40f4a1758fe81c31
Instruction Fuzzy Hash: 14313561B0978A45EB11AB61D464AFDABA1BF05B8CFC40837CE4D97356DF3CE5448322

Function 00007FF7E5A376A3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A3A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37BC2

Part of subcall function 00007FF7E5A00240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00292

Strings

Expire Date, xrefs: 00007FF7E5A37ACD
Public Key Algorithm, xrefs: 00007FF7E5A37B78
Expire Date: %s, xrefs: 00007FF7E5A37AE7
Public Key Algorithm: %s, xrefs: 00007FF7E5A37B92

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 5a34c979c22d99fa642846dc252d67e8bd6e08a4038edfdd442936c0c994fb53
Instruction ID: 00cf4747d6257c3e9ea6c1be9f2c2705aab575f15b8d8aadd77758b5931acb21
Opcode Fuzzy Hash: 5a34c979c22d99fa642846dc252d67e8bd6e08a4038edfdd442936c0c994fb53
Instruction Fuzzy Hash: B6315361B0978A44EB11AB61D464AFDABA1BF05B8CFC40837CE4E97356DF3CE1448322

Function 00007FF7E59FB070 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7E59FB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7E59FB0B7
CloseHandle.KERNEL32 ref: 00007FF7E59FB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7E59FB0E6
closesocket.WS2_32 ref: 00007FF7E59FB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7E59FB11D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction ID: 2034ede8176f4e60b07fc2e70dea1287efd2507bc2b7debf4aa773c028765265
Opcode Fuzzy Hash: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction Fuzzy Hash: 1C213E36708A4986E620AF52E560379B770FF49F90F844032CF8E83B54DF39E4A58721

Function 00007FF7E59F92A8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A177A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A177C1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9371

Strings

Replaced, xrefs: 00007FF7E59F9601
FALSE, xrefs: 00007FF7E59F934B
Added, xrefs: 00007FF7E59F960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7E59F9617

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 82631bb3135a2ad10e17f086c294e470c804b6d2ccea4246878ff724b50622f8
Instruction ID: 5bc933ceb32def50c3adf7ae94a1db03c03b95804644f202ff05813008eadcfb
Opcode Fuzzy Hash: 82631bb3135a2ad10e17f086c294e470c804b6d2ccea4246878ff724b50622f8
Instruction Fuzzy Hash: C3617161A0979A45FF71AB2590643FAA792EF54F44F880033DB8D82691DF3CE494C372

Function 00007FF7E59F919D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A176F0: strchr.VCRUNTIME140 ref: 00007FF7E5A17726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F9371

Strings

Replaced, xrefs: 00007FF7E59F9601
FALSE, xrefs: 00007FF7E59F934B
Added, xrefs: 00007FF7E59F960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7E59F9617

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: c2ab3cbf1cffc3fc9e4ce8172e99c2bf4d11b967c886fdd51e25c4ea2097fbec
Instruction ID: a9018ed970caaee9f4a140f3effefaba60d50e13828b558c9af8a15ff8388c7b
Opcode Fuzzy Hash: c2ab3cbf1cffc3fc9e4ce8172e99c2bf4d11b967c886fdd51e25c4ea2097fbec
Instruction Fuzzy Hash: 44618121A0978A45FF71AB2590643FAA7A2EF54F54F880037DB8D82691DF3CE4948372

Function 00007FF7E5A121A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A123AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A123C5

Strings

The requested URL returned error: %d, xrefs: 00007FF7E5A1234E
Forcing HTTP/1.1 for NTLM, xrefs: 00007FF7E5A12269

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 0e0eaa027d3d22a4a8d4ec68c5691ab6803c475b566300ff1cb4639a436c852e
Instruction ID: 39b70d8ee6f7d4e788f2a0af86a87a03d2a7a86fff0efd746e78eb1cf7aee9ca
Opcode Fuzzy Hash: 0e0eaa027d3d22a4a8d4ec68c5691ab6803c475b566300ff1cb4639a436c852e
Instruction Fuzzy Hash: 4651ACB1B0C6C641FB64AA259260BBDAF92EF45F44F880036DA4DCB685DF3CE4508732

Function 00007FF7E59E2610 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341

Part of subcall function 00007FF7E59E3C30: memcpy.VCRUNTIME140 ref: 00007FF7E59E3C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E26E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E2730
__std_exception_copy.VCRUNTIME140 ref: 00007FF7E59E2780
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E27CD

Strings

out_of_range, xrefs: 00007FF7E59E2656

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 011e101c21e85212f65616117e2b30cad61de5ca062f2b3863d0ff6025111508
Instruction ID: 3794cb003afeb07502e65000160f53790b31aa38696a2087bd17cf94fff63f4d
Opcode Fuzzy Hash: 011e101c21e85212f65616117e2b30cad61de5ca062f2b3863d0ff6025111508
Instruction Fuzzy Hash: 38518032B18B4599FB00EF64E4603EC7765EB45BA8F805232DA5D82AD5DF38E195C311

Function 00007FF7E5A2F580 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F5F8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F62A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F69A

Part of subcall function 00007FF7E5A17900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7E59FA92A,?,?,?,?,?,?,?,00007FF7E59FA6F7), ref: 00007FF7E5A17911

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2F715

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF7E5A2F5EE

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 843ade515a0bd07329736349e60a03f950eedd840701748e77495a0b5ca17848
Instruction ID: 995cd0db40b8316e8ba2237434a2ef8886b6dc40febed559fd63b3136012f440
Opcode Fuzzy Hash: 843ade515a0bd07329736349e60a03f950eedd840701748e77495a0b5ca17848
Instruction Fuzzy Hash: 7D41C316B0CACE45EB21AB149822B79AF91EF06F54FC44133CA8D97A85DF3CD445C722

Function 00007FF7E5A39568 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7E5A39616
GMT, xrefs: 00007FF7E5A395C4

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 18548420aa55df9f48917c6983994d8601e4b2c51c1ca09d28ffe1cdaf2f51e4
Instruction ID: e8518b9d7ee9f14250e41eff0f61a738fd73b338d4cd53189b2c6ed7337ba52e
Opcode Fuzzy Hash: 18548420aa55df9f48917c6983994d8601e4b2c51c1ca09d28ffe1cdaf2f51e4
Instruction Fuzzy Hash: 6E419021B0CA8A89F7219F649160BBDEF91AF45F88FD80132C68E82695DF3CD545C322

Function 00007FF7E59E4310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4341
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E4406
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E59E445A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E4461

Part of subcall function 00007FF7E5A3F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7E59E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E5A3F20A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7E59E4312

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 060c81ddfd111417c5091a61c3a1e0148c2aa5dfc69f83c4e14a55458c154890
Instruction ID: 7a59e266786c0787725b9f9ab292e101e57fcca146caa1ee5c73b96228709744
Opcode Fuzzy Hash: 060c81ddfd111417c5091a61c3a1e0148c2aa5dfc69f83c4e14a55458c154890
Instruction Fuzzy Hash: 8431C622B0964944EE19BA55A6643BC92D1EF04FE4F940632CE2D87BD5EF7CE4828312

Function 00007FF7E59F0680 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7E59E11FA), ref: 00007FF7E59F075F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7E59E11FA), ref: 00007FF7E59F079C
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7E59E11FA), ref: 00007FF7E59F07A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59F07D9

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7E59F0682

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: e4ce4394363e5324866952fb85af2f58288ab99f1bf50804098d43e406ae33b8
Instruction ID: 8351c0c4483c3bd4f5ef7ee6279cd2359bc4bdafbb4114ceab37512103fd22e1
Opcode Fuzzy Hash: e4ce4394363e5324866952fb85af2f58288ab99f1bf50804098d43e406ae33b8
Instruction Fuzzy Hash: 76310561B0974994EE10AB11E9243BDF699AF04FD0F980636DE5E477C5DF7CE0618322

Function 00007FF7E5A05D80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E5A05DFE

Part of subcall function 00007FF7E59F2500: GetLastError.KERNEL32 ref: 00007FF7E59F2522
Part of subcall function 00007FF7E59F2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F252A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05E1C
recv.WS2_32 ref: 00007FF7E5A05E47
WSAGetLastError.WS2_32 ref: 00007FF7E5A05E59

Strings

Recv failure: %s, xrefs: 00007FF7E5A05E85

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: 76a45e13e4a53d45da3cc6b1da66ccd2384b2d5048a0601096faee186a3d44d2
Instruction ID: 0657289e9c07301ac5bdd94f5711f6581930b2d04cca3ab5f35126398b434994
Opcode Fuzzy Hash: 76a45e13e4a53d45da3cc6b1da66ccd2384b2d5048a0601096faee186a3d44d2
Instruction Fuzzy Hash: 7F31C272B1574981EB20AF21E854BA9A760BB48FD8F904136CE5D87384DF3CD455C351

Function 00007FF7E5A0C810 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0C905
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0C964

Strings

Connection died, tried %d times before giving up, xrefs: 00007FF7E5A0C8C8
Connection died, retrying a fresh connect, xrefs: 00007FF7E5A0C8EF
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF7E5A0C89B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: 04786302b464ce4458984dfce92d798d726ef78eb1baf23cf9b6393892aed6c8
Instruction ID: e3471d22dc8d574b3bff1d0f69e8ebc88cfe83e9b2981a8467b20437ce323e93
Opcode Fuzzy Hash: 04786302b464ce4458984dfce92d798d726ef78eb1baf23cf9b6393892aed6c8
Instruction Fuzzy Hash: AE41B132B1868A81EB54AB35E0607A9EB90EF44F8CF884032DB4D87795CF3DD495C712

Function 00007FF7E5A0A510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0A599
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0A62F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0A657

Strings

Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF7E5A0A645
identity, xrefs: 00007FF7E5A0A553, 00007FF7E5A0A5C3, 00007FF7E5A0A628

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: df79667446998cfa9fe32aac958eaa7bfc2909eaa380d159321fe0720fedef74
Instruction ID: 750d78e9b0dc731791e493321f0caa01d67e7022182495bae52bed8fef7f59d0
Opcode Fuzzy Hash: df79667446998cfa9fe32aac958eaa7bfc2909eaa380d159321fe0720fedef74
Instruction Fuzzy Hash: 27419321B19A4A85EB05AF25A460778EBA0FF48FD8F854232CE5D877D4EF3CE4418311

Function 00007FF7E5A39459 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39480
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

FALSE, xrefs: 00007FF7E5A39475

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: e075efb9f471538cf5fea25a544e13b80d27f3e372c79109e91b7771380f9fd1
Instruction ID: f911baff096d46e1f074dd13a103f5c7bc284fa19b9e89eb525e6a795b8ace68
Opcode Fuzzy Hash: e075efb9f471538cf5fea25a544e13b80d27f3e372c79109e91b7771380f9fd1
Instruction Fuzzy Hash: 7731C422F0D59E4DFB22DF249424B7CAF919F05F68F940633C69A816E1DE3C9585C322

Function 00007FF7E5A20DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A20E0B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A20E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A20EB6

Strings

RCPT TO:<%s>, xrefs: 00007FF7E5A20E9B
RCPT TO:<%s@%s>, xrefs: 00007FF7E5A20E8D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 310991105be6317898f4caa6c789cae6c9633f0561393eaf4ed82575c1179860
Instruction ID: 4824ec8fe6fffb10afeffeec63d39ded0857fb5c7123dbdbc475a220ac37da06
Opcode Fuzzy Hash: 310991105be6317898f4caa6c789cae6c9633f0561393eaf4ed82575c1179860
Instruction Fuzzy Hash: BD318F66B18B8581EB11EB25E4607B9ABA0FF84F94F884232EA8E437D1DF7CD541C311

Function 00007FF7E59F07E0 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E59E3D70: memcpy.VCRUNTIME140(?,?,0000000100000000,00007FF7E59F083D), ref: 00007FF7E59E3E22
Part of subcall function 00007FF7E59E3D70: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E3E47

Part of subcall function 00007FF7E59E3D70: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0000000100000000,00007FF7E59F083D), ref: 00007FF7E59E3E04

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F0A50
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F0A57
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F0A5E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F0A65
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59F0A6C

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 5e99ca1bde4e1416277db961ec109b41f83edf1a84fdc12d99675d70987ffbfa
Instruction ID: f702a71b04580552815c763e60d0b370ff1ba32c102493011568e2f78187472e
Opcode Fuzzy Hash: 5e99ca1bde4e1416277db961ec109b41f83edf1a84fdc12d99675d70987ffbfa
Instruction Fuzzy Hash: A561C472A04B8985EB20EF20E4687BDB765EB41FC8F904032DA8D86A96DF7DD4D0C311

Function 00007FF7E5A34330 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A34290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A342B6
Part of subcall function 00007FF7E5A34290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A342D7
Part of subcall function 00007FF7E5A34290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A342F2
Part of subcall function 00007FF7E5A34290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A34300
Part of subcall function 00007FF7E5A34290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A34312

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A343B6

Strings

NTLM, xrefs: 00007FF7E5A3436E, 00007FF7E5A34420
HTTP, xrefs: 00007FF7E5A3433A

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 39a23f78fe25a4d256fce5b592c7a67188582c1c21e97960aec82a00448847b9
Instruction ID: 37457336126da7e6280331ac19a04bd208e83b38c2fd81090473fc66cc51fd9a
Opcode Fuzzy Hash: 39a23f78fe25a4d256fce5b592c7a67188582c1c21e97960aec82a00448847b9
Instruction Fuzzy Hash: 31612E32608B8A86E7609F15E454B6EBBA4FF88F84F944136DA8D83B58DF3CD454CB11

Function 00007FF7E5A39D35 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A39D78
memcpy.VCRUNTIME140 ref: 00007FF7E5A39D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A39E6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A39EBF

Strings

TRUE, xrefs: 00007FF7E5A39EC9

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 2de0af5476a8bee818dfaffc51287aacab6865fda698d13ebbfacdef7cd6ec0c
Instruction ID: 5286f02bae8f338c58b91d8b5ad6ca7772320591873da53aad507e3d9cec2b78
Opcode Fuzzy Hash: 2de0af5476a8bee818dfaffc51287aacab6865fda698d13ebbfacdef7cd6ec0c
Instruction Fuzzy Hash: 97414661B0879A49FB295A15852477DAF52EF00FE8F944633CA6EC73C1CE3CD0898322

Function 00007FF7E5A3D5E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7E5A3D5A0), ref: 00007FF7E5A3D64F

Part of subcall function 00007FF7E5A17900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7E59FA92A,?,?,?,?,?,?,?,00007FF7E59FA6F7), ref: 00007FF7E5A17911

Part of subcall function 00007FF7E5A17900: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7E5A17AB3
Part of subcall function 00007FF7E5A17900: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7E5A17AD0

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7E5A3D5A0), ref: 00007FF7E5A3D6BE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7E5A3D5A0), ref: 00007FF7E5A3D6D8
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7E5A3D5A0), ref: 00007FF7E5A3D70E

Strings

xn--, xrefs: 00007FF7E5A3D6F5

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: 423bf8c0c49e3ec128dd97a9686630982e6650d8334231880676cdb0425b1833
Instruction ID: 984a6c3a38ce6191cab1ffd3955dff69903822632a5f34a130e969e975336cc9
Opcode Fuzzy Hash: 423bf8c0c49e3ec128dd97a9686630982e6650d8334231880676cdb0425b1833
Instruction Fuzzy Hash: 9841E255B1C68A85FB54BA218924BBDDE819F45FC4F888136DE4EC7BC1EE3CE4058362

Function 00007FF7E5A0B6D0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7E5A0B778
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0B7F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0B8A2

Strings

CONNECT phase completed!, xrefs: 00007FF7E5A0B8E3
allocate connect buffer!, xrefs: 00007FF7E5A0B81F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: d7ea1e66ceb379eda812ece8c49fb1848ff451d92fd1e2f75f760f6ee0f4fc64
Instruction ID: 59eb14efa0ff6accf4f0224dd48273631a979c262a075b322c2c586d65bbd93c
Opcode Fuzzy Hash: d7ea1e66ceb379eda812ece8c49fb1848ff451d92fd1e2f75f760f6ee0f4fc64
Instruction Fuzzy Hash: 0851B322B1868A92E718AB31D6747BDBB90FF44F48F840036CB5D8B291DF78E565C311

Function 00007FF7E5A37253 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7E5A37381
Start Date: %s, xrefs: 00007FF7E5A37577
Start Date, xrefs: 00007FF7E5A3755D
GMT, xrefs: 00007FF7E5A3730E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 3cc400d705c7ae2362500cf1e020bece85d41da4efc320729d18f1b821df95dc
Instruction ID: 1326c80c0981aee2a518f779c00e5a20a225468f31ee2c59848de8eade8e21f2
Opcode Fuzzy Hash: 3cc400d705c7ae2362500cf1e020bece85d41da4efc320729d18f1b821df95dc
Instruction Fuzzy Hash: 3851B061B0D6DA85EB10AB649524BBCEF95EF01B88FC44433DA4D86654CF3CE645C322

Function 00007FF7E5A39049 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3908C
memcpy.VCRUNTIME140 ref: 00007FF7E5A390B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A39189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A391F6

Strings

%s: %s, xrefs: 00007FF7E5A391E1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 3c73917e9a3ff9f287237219b96bb395f56d01fc929189d139cfd492ab4b7b15
Instruction ID: fe3b1decdc4d0f4866453dca05d31855192492dc76958a503fa7b49e2263d989
Opcode Fuzzy Hash: 3c73917e9a3ff9f287237219b96bb395f56d01fc929189d139cfd492ab4b7b15
Instruction Fuzzy Hash: 4D415601B092D94AEA786E0694387B99B91AF46FE4F844237CE6F877C5DD3CD0458322

Function 00007FF7E5A1E450 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A177A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E5A177C1

memcpy.VCRUNTIME140 ref: 00007FF7E5A1E5C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1E5CF

Strings

Failed to parse FETCH response., xrefs: 00007FF7E5A1E4AE
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF7E5A1E58D
Found %I64d bytes to download, xrefs: 00007FF7E5A1E522

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 2666265653ab1ec3e10e930bd31a71e0d180f8da04622154dd8d31111f66fc27
Instruction ID: cdbd20230d39d86757b6672f97f84a323617026a6fac7747742b464a6d4a8106
Opcode Fuzzy Hash: 2666265653ab1ec3e10e930bd31a71e0d180f8da04622154dd8d31111f66fc27
Instruction Fuzzy Hash: B75192A2B0868A82EB24EA65D560BA9EF90FF45F94F844033DB4D83A45DF7DE4518312

Function 00007FF7E5A37190 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Strings

Start Date: %s, xrefs: 00007FF7E5A37577
Start Date, xrefs: 00007FF7E5A3755D
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7E5A3723F
GMT, xrefs: 00007FF7E5A371EC

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: fd687db5ce81c312168de4ee473c0d8d84d0a0caf4907a782c0026f3af3b1231
Instruction ID: 4bb90d89f01607c50c321cc4cd6da6a474e931f3a164b604ff8df23ee54b1497
Opcode Fuzzy Hash: fd687db5ce81c312168de4ee473c0d8d84d0a0caf4907a782c0026f3af3b1231
Instruction Fuzzy Hash: 6E315162B0968A85EB10AB60D460BB9EB91EF05F88FC84433C64E9A255DF3CD6458322

Function 00007FF7E5A373E4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3741F
memcpy.VCRUNTIME140 ref: 00007FF7E5A37445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Strings

Start Date: %s, xrefs: 00007FF7E5A37577
Start Date, xrefs: 00007FF7E5A3755D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 931404bb7ef4e7a24fca340e42252142a84ad0bfd55e92b62d93b7e113a9c3aa
Instruction ID: 6ec82ca1fe0f8cac61967418ac35f3e3e8e6535abf5a7f34da3d9f068d5906f4
Opcode Fuzzy Hash: 931404bb7ef4e7a24fca340e42252142a84ad0bfd55e92b62d93b7e113a9c3aa
Instruction Fuzzy Hash: C521E551B0928A41EE15AB219524BB8EB92AF05FD8FC84533CD1E877D1DE3CA6448322

Function 00007FF7E5A27E00 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A27E31
strchr.VCRUNTIME140 ref: 00007FF7E5A27E5D
strchr.VCRUNTIME140 ref: 00007FF7E5A27E74
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A27E93

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction ID: 38c990ca08b5c971b92dc0d33771101b82d15a8d256c2a6c9ab4754517fc99ef
Opcode Fuzzy Hash: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction Fuzzy Hash: 9D219262B15B8A81EB85DB259461B6867D1EF45F54F480035DE0D8BB44EF3CD990C332

Function 00007FF7E5A15790 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF7E5A15AE2

Strings

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF7E5A15A75
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF7E5A1582B
** Resuming transfer from byte position %I64d, xrefs: 00007FF7E5A15818

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: cf5752f772f53d5a01ce0a4df43098bbf945ca1bb178d9efa3e48f8af9e2371a
Instruction ID: f37a1d6217f0058f21c8f8f59e80e9c2036c14038fba15c6965f263ffcb7fb39
Opcode Fuzzy Hash: cf5752f772f53d5a01ce0a4df43098bbf945ca1bb178d9efa3e48f8af9e2371a
Instruction Fuzzy Hash: 8D91846170678A85DA60EB16E664BAAB768FB88FC0F851032DE4D87B55FF7CD001DB01

Function 00007FF7E5A227B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E5A3A500: memcpy.VCRUNTIME140 ref: 00007FF7E5A3A5A8
Part of subcall function 00007FF7E5A3A500: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3A5B9

WSAGetLastError.WS2_32 ref: 00007FF7E5A2291A

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF7E5A22928
We got a 421 - timeout!, xrefs: 00007FF7E5A2293E
FTP response timeout, xrefs: 00007FF7E5A22967

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: 796fff929338667895051d4d0396df10a4d59ed21fe22401bcd2d6955a7ab080
Instruction ID: f13f6f1e37489bdeec15033240e0740406933270dbb7635172c77d4eff9ab9ec
Opcode Fuzzy Hash: 796fff929338667895051d4d0396df10a4d59ed21fe22401bcd2d6955a7ab080
Instruction Fuzzy Hash: 7541C221B0868A85FA60AF25A821BB9AB91BF48F94FC44133DE5DD7781EE3CD4458712

Function 00007FF7E5A3948E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

%s%lx, xrefs: 00007FF7E5A394F8

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: fd4fe93a63d81f1eee54e4347bacdfe35ba4eeaea70399024db6a6f81961019a
Instruction ID: 624d6a3b1e64784873fb46c8e005c6f687b300377eb65dad90e035c2f6bae8a3
Opcode Fuzzy Hash: fd4fe93a63d81f1eee54e4347bacdfe35ba4eeaea70399024db6a6f81961019a
Instruction Fuzzy Hash: 1031D011B0D59E4DFB22AF249064B7CAF919F05F48F940533C68AC2AA2EE3DD441C722

Function 00007FF7E5A3976F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Strings

TRUE, xrefs: 00007FF7E5A3990D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: 84cdeb7f4889b0e98a9bc369abe20393a8c158631b938612cc781c0bb33ba72d
Instruction ID: ae26894758b809f49e39333fe2076391c2ceb48424795436d5cb9ef1490512a6
Opcode Fuzzy Hash: 84cdeb7f4889b0e98a9bc369abe20393a8c158631b938612cc781c0bb33ba72d
Instruction Fuzzy Hash: 6D31D621B0C59A89F711DF24946477CAF919F05F98F840633C69AC26D5DF3CD141C322

Function 00007FF7E5A22590 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF7E5A225E2
accept.WS2_32 ref: 00007FF7E5A22601

Part of subcall function 00007FF7E5A14C90: ioctlsocket.WS2_32 ref: 00007FF7E5A14CA9

Strings

Error accept()ing server connect, xrefs: 00007FF7E5A2261E
Connection accepted from server, xrefs: 00007FF7E5A2262F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 7619af5fcb545d30f50fc730d7ce3b53032e15200c454faa69440dbf7a3349ba
Instruction ID: f96302fab1288b943db381c3e8864c8b6673b7567459903133560929ef28767b
Opcode Fuzzy Hash: 7619af5fcb545d30f50fc730d7ce3b53032e15200c454faa69440dbf7a3349ba
Instruction Fuzzy Hash: C831E82270868586EA64AB21E424BAAB791FF48F94F844232DA6D877C5CF7CE0058711

Function 00007FF7E5A14130 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A13B69), ref: 00007FF7E5A141BD

Strings

Failed to alloc memory for big header!, xrefs: 00007FF7E5A141C8
Rejected %zu bytes header (max is %d)!, xrefs: 00007FF7E5A1415B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 7ed45b1ac631cbcc0d59fa2633569d3d6a32ded3c26f3460a93e82a47c38fae9
Instruction ID: 4e0b46d0f54490dd09167d31feb359c6c3f78a20f05c224f6dda130e8d961ded
Opcode Fuzzy Hash: 7ed45b1ac631cbcc0d59fa2633569d3d6a32ded3c26f3460a93e82a47c38fae9
Instruction Fuzzy Hash: 1E216232B08A8986DB04AB29E5507ADA7A1FB49FC4F444036EF4D47B59CF3CD4A1C700

Function 00007FF7E59F4313 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F43A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F43BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F43DB

Strings

:, xrefs: 00007FF7E59F4396

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 9185cdd294420f20cdc6d51fd5518084f5bb34101a95b3ad8653fbf82a5b9ae8
Instruction ID: e425075b928c6f38775d249fc15149b45401af5c85ee17e7b41a25a61ae63ad2
Opcode Fuzzy Hash: 9185cdd294420f20cdc6d51fd5518084f5bb34101a95b3ad8653fbf82a5b9ae8
Instruction Fuzzy Hash: CD217C22709B8A85EB61AF14E9507F9B7A0FB44F94F984132DB9D82784EF3CD4648721

Function 00007FF7E59F4498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E59F43A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F43BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F43DB

Strings

:, xrefs: 00007FF7E59F4396

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 7e334ca8de8e4567ccf13a3d1ed7df33fb9ad007e5fdceb3d50289511dc5c3dd
Instruction ID: b172a86f54eabe4660971014e06ce5a50fe14d6b788902c56dcaf067fc55cb82
Opcode Fuzzy Hash: 7e334ca8de8e4567ccf13a3d1ed7df33fb9ad007e5fdceb3d50289511dc5c3dd
Instruction Fuzzy Hash: AF116F22709B8A81EB659F14E6107B9B7A0EB44BA4F984132CF9C82794EF3CD4648721

Function 00007FF7E5A1DEE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF7E5A1DF67
%s%s, xrefs: 00007FF7E5A1DF13

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 95d0198f69160efcdf6ba9fdb2b660f0347d07b19df1605e49ce1a338d018f18
Instruction ID: 28e22d1a44bb8665a4047bd5b2da28183fbe4d2304389f6232cfc70a10acae10
Opcode Fuzzy Hash: 95d0198f69160efcdf6ba9fdb2b660f0347d07b19df1605e49ce1a338d018f18
Instruction Fuzzy Hash: BE11B161B0864A81EA14EB55E560BB9AB60EF48FC4FC80037EE4E87755DF3CE6458352

Function 00007FF7E5A2A490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7E5A2A4CD
WSAGetLastError.WS2_32 ref: 00007FF7E5A2A4D7

Strings

SENT, xrefs: 00007FF7E5A2A4F2
Sending data failed (%d), xrefs: 00007FF7E5A2A4DD

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: b305d28b117c5390196270bb9271faa1f7ae2e309369d4ece08cc852aadb9171
Instruction ID: 9a6cc8c2919ee1ddbbb05119f0f0d20fe9467bf9b0622b4c303983fd02e41db6
Opcode Fuzzy Hash: b305d28b117c5390196270bb9271faa1f7ae2e309369d4ece08cc852aadb9171
Instruction Fuzzy Hash: 0901F532708B8A81DB10AB66E851959BF20FF84FC8B895132CB4D83711DF38D501C792

Function 00007FF7E5A37161 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A37164
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Part of subcall function 00007FF7E5A00240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00292

Strings

Start Date: %s, xrefs: 00007FF7E5A37577
Start Date, xrefs: 00007FF7E5A3755D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 0e1e215d465bdb65dc11ec78cd6772c2a7b85769cfe06162245f5a7cea0827dc
Instruction ID: 023ac23f2d7ae033afeba9c562167f06c0353627b2e80058512b124090e408d3
Opcode Fuzzy Hash: 0e1e215d465bdb65dc11ec78cd6772c2a7b85769cfe06162245f5a7cea0827dc
Instruction Fuzzy Hash: 1D017951B0D2CB41EB15A7609464FBDEF926F05F88FC45833CA0E86251DF3CA2448323

Function 00007FF7E5A12090 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7E5A120F4
strchr.VCRUNTIME140 ref: 00007FF7E5A12107
strchr.VCRUNTIME140 ref: 00007FF7E5A12119
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A1214B
memcpy.VCRUNTIME140 ref: 00007FF7E5A12175

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction ID: 68eb73e40e0e7dd3b6c834a0345b2ddb44db369405d1b07ca10f425aaba949c6
Opcode Fuzzy Hash: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction Fuzzy Hash: 2C21D55170D69A01EE95A61662207BDEAD29F45FC4F8C8132DE8D8B786DF3CE846C221

Function 00007FF7E5A115A0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A115D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A115E1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A1165A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A1166B
memcpy.VCRUNTIME140(?,?,00000000,00007FF7E5A119B5), ref: 00007FF7E5A11694

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: e5aaf608392412e8d4b9a1dc4236b9329a67fb2d8f166538309d8ae37baf092e
Instruction ID: 3948ed69cb46b8d123280b7fa366d37f6d227a15b21233328a2f3827a50472eb
Opcode Fuzzy Hash: e5aaf608392412e8d4b9a1dc4236b9329a67fb2d8f166538309d8ae37baf092e
Instruction Fuzzy Hash: 71314161B09B4981EB10AF11E660B69AB90EF45FE4F980232DE7E877C5DF3DD8508312

Function 00007FF7E5A34290 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A342B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A342D7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A342F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A34300
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A30D25), ref: 00007FF7E5A34312

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction ID: ff1814857cf4997b6a20f6eda9617877b6a3f1a6c982672fc375a2241159b698
Opcode Fuzzy Hash: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction Fuzzy Hash: C7119636608B46C2DB04AF65E9A4A3CB7A4FF94F887544136CE4E87768CF38D895C351

Function 00007FF7E5A0A7B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0A8D0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0A916
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0A978

Strings

chunked, xrefs: 00007FF7E5A0A82E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: 1f55bf3cc2ceb97599b1b13bb89cd2425dee7cbd92ad9f3b9547d39331e686ba
Instruction ID: 9c729f4edeb251f3eec443188f7c2681f9923c994829be251e4933cb8f24c22a
Opcode Fuzzy Hash: 1f55bf3cc2ceb97599b1b13bb89cd2425dee7cbd92ad9f3b9547d39331e686ba
Instruction Fuzzy Hash: 9951B421B1869A45FA55AF21A520B79AE91AF04FC8FC94036DE5D837C5EF3CE446C322

Function 00007FF7E5A38EC0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A391F6

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7E5A38FEA
%s: %s, xrefs: 00007FF7E5A391E1
GMT, xrefs: 00007FF7E5A38F7E

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: b6ca05796940405e3fa667ad57ad962b43d171910b5195631f7c3f8b4d476eaa
Instruction ID: 7a5546feb17a47227f8b23e31343c40d1bbde4ef813ab41a577552fb3d7035d0
Opcode Fuzzy Hash: b6ca05796940405e3fa667ad57ad962b43d171910b5195631f7c3f8b4d476eaa
Instruction Fuzzy Hash: D341E161B0D69A85EA60AB10A424BBDEF91FF41F94F848033DA8D83745CF3CE4468322

Function 00007FF7E59ED4D0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E59ED198), ref: 00007FF7E59ED5AE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E59ED198), ref: 00007FF7E59ED5DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E59ED198), ref: 00007FF7E59ED645

Part of subcall function 00007FF7E5A3F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7E59E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7E59E1B49), ref: 00007FF7E5A3F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59ED652

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: f485f46759ee3c819f91b3d763993f9dcf21cbb8076185c2af80993c6419b380
Instruction ID: 4c5183cc13813cba5dcbde375f05fe4238be028ace5696b215e58520b1866718
Opcode Fuzzy Hash: f485f46759ee3c819f91b3d763993f9dcf21cbb8076185c2af80993c6419b380
Instruction Fuzzy Hash: B541D472719B4985EA14AF65D1243BDA3A0BB45FA4F948636CB2DC37C8DF3CE0518311

Function 00007FF7E5A3A830 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF7E5A1C9DB), ref: 00007FF7E5A3A88E

Strings

%s, xrefs: 00007FF7E5A3A864

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 0d9a4fbca350a2b51e1a3a6bd17f6e341b6717d5cc9ad04e110af83e92be828a
Instruction ID: 1ebe3616e293100a7c52d7d748738531f93e2d10dce5196113c1b63893557cd2
Opcode Fuzzy Hash: 0d9a4fbca350a2b51e1a3a6bd17f6e341b6717d5cc9ad04e110af83e92be828a
Instruction Fuzzy Hash: 37418222A18B4982EA50DF15B4506AEBBA4FB84FA4F540136DF8E43B61DF3CE095C351

Function 00007FF7E59E4D50 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7E59E4E2F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E59E4E6C
memcpy.VCRUNTIME140 ref: 00007FF7E59E4E76
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59E4EA3

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: e60ed55956e50edfbe7ea8bb8067bec7a55e8f8f967eba0faf20a733e55885ad
Instruction ID: 9df1d78b3db01c73f8cb982229689c375866c29d1cbf063d6181fe618098bccd
Opcode Fuzzy Hash: e60ed55956e50edfbe7ea8bb8067bec7a55e8f8f967eba0faf20a733e55885ad
Instruction Fuzzy Hash: 7C31022270D78994EE10AB56A5147A8E691AF04FE0F98073ADF6D8B7D5CF7CE0518322

Function 00007FF7E5A261CD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A26204

Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C15
Part of subcall function 00007FF7E5A05AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7E5A05C30

Strings

%s%s, xrefs: 00007FF7E5A261D4
Wildcard - "%s" skipped by user, xrefs: 00007FF7E5A2626D
Wildcard - START of "%s", xrefs: 00007FF7E5A2620D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 8299427a5ad266f79722ea9ef5ffcf9a9fc35c8886571f6f63a6ff16aa18c0a4
Instruction ID: 20e8cce585148c8f701a6a9eedd19cb778d20f9c4bdea9201495aacf4cf8c51b
Opcode Fuzzy Hash: 8299427a5ad266f79722ea9ef5ffcf9a9fc35c8886571f6f63a6ff16aa18c0a4
Instruction Fuzzy Hash: C9418276B09A8AC0E710EF55E4A5BADABA0EF44F84F854037DE0E9B345DE39D4418362

Function 00007FF7E59F0580 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7E59E11FA), ref: 00007FF7E59F05B8
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7E59E11FA), ref: 00007FF7E59F0659
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E59F0677

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: de1c6875f200540c7d25ef907db20005fdec5c9f83ccc6c164fa8115f0418b6c
Instruction ID: 1a21c8d92a00bc75b568169316448830772680f842c6cccaa157306d6b372503
Opcode Fuzzy Hash: de1c6875f200540c7d25ef907db20005fdec5c9f83ccc6c164fa8115f0418b6c
Instruction Fuzzy Hash: 5921EA62B0A74E44E915BB52A5103B896889F44FE4F940732DE6E477C1DF7CA4A18322

Function 00007FF7E5A38E05 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A391F6

Strings

%s: %s, xrefs: 00007FF7E5A391E1
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7E5A38EA9
GMT, xrefs: 00007FF7E5A38E59

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: 5bf4d807dab3c4c4c80c6444e0c9514796da9ea9dd13b643f44312d4cc7cdbe3
Instruction ID: 4be6f3baf9248c447752200729a62fca29f0d3bdde2be40a971a9d686e423fae
Opcode Fuzzy Hash: 5bf4d807dab3c4c4c80c6444e0c9514796da9ea9dd13b643f44312d4cc7cdbe3
Instruction Fuzzy Hash: 8F31C121B09B8A89E760AB50E464BADAB91FF45F88FD50033CB4D93241CF7CE549C322

Function 00007FF7E5A00240 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00292
memcpy.VCRUNTIME140 ref: 00007FF7E5A002CD

Part of subcall function 00007FF7E59F5620: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F5635

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00302

Part of subcall function 00007FF7E59F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E59F1B61), ref: 00007FF7E59F5757
Part of subcall function 00007FF7E59F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E59F1B61), ref: 00007FF7E59F5763

Strings

%s:, xrefs: 00007FF7E5A002AC

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 1b73f9cfeb138da4e2e179966cb669f2fdf5ab84fc2fa84ad0d24e29dda246a4
Instruction ID: 4bd263771c0227c617732e6a15dc6da5d9cad55d8dfee9b80b5ed06576a40583
Opcode Fuzzy Hash: 1b73f9cfeb138da4e2e179966cb669f2fdf5ab84fc2fa84ad0d24e29dda246a4
Instruction Fuzzy Hash: E421B422B08A8981DB00DF12E950AAABBA4FF54FE8FC80132DE5D47795DF38D5458351

Function 00007FF7E5A39D3D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A39D78
memcpy.VCRUNTIME140 ref: 00007FF7E5A39D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A39EBF

Strings

TRUE, xrefs: 00007FF7E5A39EC9

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 1937b63237afc5f6f21e48b4429b9b86981b2e9b08ff3c4b24e74200198c31d2
Instruction ID: e75d6496a15d0fb3f5f4baf643fc3440eed82acc617dc44f93ebf27ce3b99ecb
Opcode Fuzzy Hash: 1937b63237afc5f6f21e48b4429b9b86981b2e9b08ff3c4b24e74200198c31d2
Instruction Fuzzy Hash: E221F465B0974A48FF269E16A520778AB52AF44FE8F944533CD1E837C4DE7CE0858322

Function 00007FF7E5A3953A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39541
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A39947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A399AE

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: 733391f2657efa35da2d8d8438dedb358714d88d68be73f8003184230d9818b7
Instruction ID: c35f1a678c3cbaeece350ef88e22d780fc9a8676d7c9d168150a590c52c20ffe
Opcode Fuzzy Hash: 733391f2657efa35da2d8d8438dedb358714d88d68be73f8003184230d9818b7
Instruction Fuzzy Hash: DD219A61F0D59A8DFB22EF249464B7CEF918F15F48F980532C68AC1AA5EE3C9545C332

Function 00007FF7E5A39051 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3908C
memcpy.VCRUNTIME140 ref: 00007FF7E5A390B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A391F6

Strings

%s: %s, xrefs: 00007FF7E5A391E1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 6fde202d0c3394d4d3b152cbdee7f1931a83e8931206ff3ebd1cffdcec02409d
Instruction ID: 981a08a6c985de64fae65d59c34aa8ff409a1c1feffed7a262b2829a1b203eb9
Opcode Fuzzy Hash: 6fde202d0c3394d4d3b152cbdee7f1931a83e8931206ff3ebd1cffdcec02409d
Instruction Fuzzy Hash: 00210410B0C78645EA74AB16A424BB9DB91BF85FE4F844133CE1E47B85DE3CE0458312

Function 00007FF7E5A370AA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A37589

Strings

Start Date: %s, xrefs: 00007FF7E5A37577
%s%lx, xrefs: 00007FF7E5A37105
Start Date, xrefs: 00007FF7E5A3755D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: a1b6b3256ead3aeb3d1a1e51bff87909139f67e609f50f31950d91eaa5aa90a4
Instruction ID: 00b5c0a7b19c5caa28ae1d24dde8a1185c46472a723e4af630847cd348fca82a
Opcode Fuzzy Hash: a1b6b3256ead3aeb3d1a1e51bff87909139f67e609f50f31950d91eaa5aa90a4
Instruction Fuzzy Hash: 7221A951B0D2DA45EE14A7259464BFDEF92AF05F88FC45833CA0E8B642DE3DA1448363

Function 00007FF7E5A092DD Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A0910F

Strings

I32, xrefs: 00007FF7E5A090E5
I64, xrefs: 00007FF7E5A09105

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 43a352a892712fe73208679e218960c350d0e5422f0842123306e9b92ba5ab5c
Instruction ID: cca326750d4bae13c9f03f551653327dd17eac6624f55b1698bc87f71625b8cc
Opcode Fuzzy Hash: 43a352a892712fe73208679e218960c350d0e5422f0842123306e9b92ba5ab5c
Instruction Fuzzy Hash: 8A21C232B1D55A4AE7246B31D470BB9BE94AF09F4CF899136CB49832C4DE3CE504CB62

Function 00007FF7E5A33130 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A33E99,00000000,?,?,00007FF7E5A33456), ref: 00007FF7E5A33159
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A33E99,00000000,?,?,00007FF7E5A33456), ref: 00007FF7E5A33190
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A33E99,00000000,?,?,00007FF7E5A33456), ref: 00007FF7E5A331A2
memcpy.VCRUNTIME140(?,?,?,00007FF7E5A33E99,00000000,?,?,00007FF7E5A33456), ref: 00007FF7E5A331CA

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction ID: b034d7a228087bb0b6781ea5d8d91e904769c7947f80c142a79fca7c12a8d711
Opcode Fuzzy Hash: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction Fuzzy Hash: 34216D26709B8582DB44CF16F46062DA7A0FB48FC8F888432DE5E47758EF38D491C311

Function 00007FF7E5A224B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A224CD
strstr.VCRUNTIME140 ref: 00007FF7E5A2250C
strstr.VCRUNTIME140 ref: 00007FF7E5A22524

Strings

;type=, xrefs: 00007FF7E5A224FF, 00007FF7E5A2251D

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 0222ecf549d9eab6eeb32d814db4a0ad4109cacb1d6406b327078b4eadc27f5b
Instruction ID: 304144ba544c51092effcbe97f680e2e7f41159f26c9491c4d32908fc2151edd
Opcode Fuzzy Hash: 0222ecf549d9eab6eeb32d814db4a0ad4109cacb1d6406b327078b4eadc27f5b
Instruction Fuzzy Hash: 5F21C73170868681EB159B24F0607A8BBA1FF48F84F888136DB9E877C5DF7CE4918321

Function 00007FF7E5A3D320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7E5A3D35D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3D36D
WideCharToMultiByte.KERNEL32 ref: 00007FF7E5A3D39C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3D3A9

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction ID: bac887ee905818ff2792ef3f781718fcf9ad7ddead412af9da62ba568a89b6c4
Opcode Fuzzy Hash: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction Fuzzy Hash: 2D115131B09B45C6E7109F52B91062DBBA0FF88FC0B984039DB4A87B14DF78D9018751

Function 00007FF7E5A3D550 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3D576
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A3D587
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3D5B6

Part of subcall function 00007FF7E5A3D5E0: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7E5A3D5A0), ref: 00007FF7E5A3D64F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A3D5AD

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 7cab5db05de9ca3a6ba704ce4dbf99f699dd45310a38cd1de36bc81fa6730da7
Instruction ID: bbae68499199df0d4a27416bb637103d4cecd62c406fbeba556a7d45b33f25e9
Opcode Fuzzy Hash: 7cab5db05de9ca3a6ba704ce4dbf99f699dd45310a38cd1de36bc81fa6730da7
Instruction Fuzzy Hash: 5E017951F0D74682FF55AB157965A3C96906F44FD8F880036ED4E87744DE3CD4858612

Function 00007FF7E59FB130 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF7E59FB0E2,?,?,?,00000000), ref: 00007FF7E59FB141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB0E2,?,?,?,00000000), ref: 00007FF7E59FB14A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E59FB0E2,?,?,?,00000000), ref: 00007FF7E59FB154
closesocket.WS2_32 ref: 00007FF7E59FB172

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction ID: 9cb5f65ebeaa486a3af0b7db4d87e95cf7d13e456d010132a1c42975aa654eca
Opcode Fuzzy Hash: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction Fuzzy Hash: 97015212E18B8683EB04DF71D9302786320FFE9F18B556322DD6E411A59F78A5E48211

Function 00007FF7E5A091CA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A0910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A09152

Strings

I32, xrefs: 00007FF7E5A090E5
I64, xrefs: 00007FF7E5A09105

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 99a124b7da873222bd242a2a80f7ee9b642aaf26a40535330719751bb5e961a6
Instruction ID: 66f268ee6806116596ed4ab3a122104472b039bc790fbf34530d3835d4d6c94b
Opcode Fuzzy Hash: 99a124b7da873222bd242a2a80f7ee9b642aaf26a40535330719751bb5e961a6
Instruction Fuzzy Hash: 98F0542172D54645E6206B61D874B75AE94AF09F88F855137C90DC2294DE3CE204C722

Function 00007FF7E5A091D2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7E5A08FA8), ref: 00007FF7E5A0910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A09152

Strings

I32, xrefs: 00007FF7E5A090E5
I64, xrefs: 00007FF7E5A09105

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: a47212c89471e80574d32abf2d57b142d35ca8e7c22bef0864889be9cf398db5
Instruction ID: 5cc239cd0bd0dce30b6f075ea0e1f303c8141071b53d5b386d5b2c31bcf5e2cb
Opcode Fuzzy Hash: a47212c89471e80574d32abf2d57b142d35ca8e7c22bef0864889be9cf398db5
Instruction Fuzzy Hash: BCF0542172954645E7206B61D874B76AE94AF09F88F855137C91DC2294DE3CE204C722

Function 00007FF7E5A311C0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7E5A06576), ref: 00007FF7E5A311D4

Strings

%lx, xrefs: 00007FF7E5A314BA

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: c18ae29bb276a8ad680b31d530baec24a6480b71590a79a41d77ef7598f730cd
Instruction ID: 36e69dd4f1b3b0e62bc8d996558c8098afc095795c1516b6d93c2cbf2271364f
Opcode Fuzzy Hash: c18ae29bb276a8ad680b31d530baec24a6480b71590a79a41d77ef7598f730cd
Instruction Fuzzy Hash: 0B817A62B1C1D985E7689A259460B7DFED0EF85B88F584237E79EC22C1DE3CC4418722

Function 00007FF7E5A1CEE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7E5A1C8C3), ref: 00007FF7E5A1CFB2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7E5A1C8C3), ref: 00007FF7E5A1D003

Strings

(){ %*], xrefs: 00007FF7E5A1CEFD

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction ID: ee882ad8ba4f906950f6fe16bbb1c8e1a1642ca2c9f8c75ff11cbd58b27da90c
Opcode Fuzzy Hash: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction Fuzzy Hash: E9310751B0D7AE54FE216A245270B79AF819F56F94FD84136DA8F832C1CE3DA905C232

Function 00007FF7E5A2E75F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A2E855
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A2E8B7

Strings

%ld, xrefs: 00007FF7E5A2E78C

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: ac70dd28215ecf0eaff7103c99b32800d312326dd7842514aad38126b35053d6
Instruction ID: 2139937c16cf4a8021ad5f621a2fc828eb6ece46f0c6216ad42fbb38efeeef7a
Opcode Fuzzy Hash: ac70dd28215ecf0eaff7103c99b32800d312326dd7842514aad38126b35053d6
Instruction Fuzzy Hash: 6831A826B09A4A81FB65EB50D171B79AF90AF44F54F850037DE8D93A85EF3CE484C722

Function 00007FF7E5A0A680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A0A6F9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0A792

Strings

identity, xrefs: 00007FF7E5A0A6B4, 00007FF7E5A0A723, 00007FF7E5A0A78B

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: f93b67b2edb0c97d754ad6eb4325252d7f86d04025bba17c1a817ce8625e0f09
Instruction ID: d7ce9d2e7717db3dd18807ad38351c6dca19a366d5b5438a7aaf8724d78e373e
Opcode Fuzzy Hash: f93b67b2edb0c97d754ad6eb4325252d7f86d04025bba17c1a817ce8625e0f09
Instruction Fuzzy Hash: 2831CA25F19A4A81EB05AF259560779EBA1EF54FE8F898132CE2D833D4DE3CE4418311

Function 00007FF7E5A07010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF7E5A0708F
setsockopt.WS2_32 ref: 00007FF7E5A070BE

Strings

@, xrefs: 00007FF7E5A0701F

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction ID: 7fe1e16ec30ab6b65ad3a68b72a4d2b9d45b007c059a2a9f203589b1fe03814e
Opcode Fuzzy Hash: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction Fuzzy Hash: BE116371B1818A86E7109F11E410F7AFFA0FF80B48F940131DA4887A94DB7DD549CB11

Function 00007FF7E5A054C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A05505
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A0552C

Strings

%I64d-, xrefs: 00007FF7E5A05517

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: 1b09a0f9ec2cdcf79c216dadba7648dfc26f4f2795125d582cdf8d7fb230f003
Instruction ID: b763c9e99bdd95c20f17795486c9fb63d35b459cc8a5ec0bbb3d68cbef02531f
Opcode Fuzzy Hash: 1b09a0f9ec2cdcf79c216dadba7648dfc26f4f2795125d582cdf8d7fb230f003
Instruction Fuzzy Hash: 37112972B16986C1EB10AB7894157F45BA2EF58F48F580036C90D8E251DE3D94968332

Function 00007FF7E59F8520 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E59F87EA
memcpy.VCRUNTIME140 ref: 00007FF7E59F891C
memcpy.VCRUNTIME140 ref: 00007FF7E59F8938

Part of subcall function 00007FF7E5A0DDD0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E59F66F3,?,?,00000000,00007FF7E5A00FC2,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A0DE0C

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: c4f4cead081543eee998664c6e26dde1d499f2edb648bd068f105d442ca860eb
Instruction ID: 6b5a88d725a65386932779e386eb03ff7db34bdbe634591dd3c63a5b79c1e98f
Opcode Fuzzy Hash: c4f4cead081543eee998664c6e26dde1d499f2edb648bd068f105d442ca860eb
Instruction Fuzzy Hash: FDC18C32B14A068AEB54AB65D4107FC77A1BB44BA8F844236CE2DA77C8DF3CD416C761

Function 00007FF7E5A38DD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E5A38DDF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A391F6

Part of subcall function 00007FF7E5A00240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7E5A00292

Strings

%s: %s, xrefs: 00007FF7E5A391E1

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: 6fd051ae12b54f2a92270519f6d97962798999720b261752d85002a3e6645c6b
Instruction ID: e7e515607b0411bde23a38e667c4d4da9d8fb8533473f0d7c21278930b891daa
Opcode Fuzzy Hash: 6fd051ae12b54f2a92270519f6d97962798999720b261752d85002a3e6645c6b
Instruction Fuzzy Hash: DAF08151B0C68A81EA70AB52F824FA99B907F45F94FC80033CE4E973528F3CD1858322

Function 00007FF7E5A3D270 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E5A303A8), ref: 00007FF7E5A3D2A1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7E5A303A8), ref: 00007FF7E5A3D2B4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E5A303A8), ref: 00007FF7E5A3D2DB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7E5A303A8), ref: 00007FF7E5A3D2E8

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction ID: 1d746e7b2076aa440ca250f2a989c85674b30e36cf7b194774a303431b2e87da
Opcode Fuzzy Hash: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction Fuzzy Hash: 6B117321B0874682E7209B5AF85056AEAA0FF88FD8B980536DB5E87B58DF3CD4508710

Function 00007FF7E5A3AE10 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A1CC93), ref: 00007FF7E5A3DDA6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A1CC93), ref: 00007FF7E5A3DDC5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A1CC93), ref: 00007FF7E5A3DDDF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E5A1CC93), ref: 00007FF7E5A3DDED

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction ID: 01fab81d16806a7b44d4e0b789aa0d4762e3d2dfd52edc6ac55bfd28fa1d44db
Opcode Fuzzy Hash: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction Fuzzy Hash: 1C11F436B09A45C1EB54AF25E860B3CB7A4FF94F88F944032CA4E42754CE3CD4548352

Function 00007FF7E5A34840 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A3093E), ref: 00007FF7E5A34866
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A3093E), ref: 00007FF7E5A34887
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A3093E), ref: 00007FF7E5A348A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A3093E), ref: 00007FF7E5A348B0

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2124235a9113e76acb7eecb01da0754f535a2c886931aa00cef68c70ac2a9cfc
Instruction ID: 31d47524e55bcc545a0a51568140a250c2d66bbd6b2dc2f2f65a732a4c91844b
Opcode Fuzzy Hash: 2124235a9113e76acb7eecb01da0754f535a2c886931aa00cef68c70ac2a9cfc
Instruction Fuzzy Hash: 3C11BA36604B45C2DB04EF25E8A592CBBA5FF94F887504026CE4E83768CF38D895C391

Function 00007FF7E5A321E0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A08405,?,?,00000000,00007FF7E5A010C1,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A321F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A08405,?,?,00000000,00007FF7E5A010C1,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A32216
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A08405,?,?,00000000,00007FF7E5A010C1,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A32224
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7E5A08405,?,?,00000000,00007FF7E5A010C1,?,?,00000000,00007FF7E5A015F5), ref: 00007FF7E5A32232

Memory Dump Source

Source File: 00000000.00000002.2285575037.00007FF7E59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E59E0000, based on PE: true

Associated: 00000000.00000002.2285523949.00007FF7E59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285629226.00007FF7E5A41000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285657315.00007FF7E5A58000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2285675119.00007FF7E5A59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e59e0000_oMBUxRQ4cj.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction ID: 73f1def55cdbd6d4c21004e11932ed06e7ddf90496a95f891226e7e6b0883b81
Opcode Fuzzy Hash: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction Fuzzy Hash: 6AF0C936604B05C2DB049F21F9A5928B7B4FF98F887A14122CE9E83764CF38C4A4C351

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oMBUxRQ4cj.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oMBUxRQ4cj.exe_5fd8cc97a3ec791a464adc62fb4cece4561dc271_c6605313_0bdab154-a71e-4fa1-b277-03f59eb49450\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3693.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3740.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER379F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
oMBUxRQ4cj.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre