Edit tour

Windows Analysis Report
bC7vK74a5a.exe

Overview

General Information

Sample name:	bC7vK74a5a.exe renamed because original name is a hash value
Original sample name:	728c57cf9e4022a270356c0e2341e7f4.exe
Analysis ID:	1538241
MD5:	728c57cf9e4022a270356c0e2341e7f4
SHA1:	4cf9c62cd6fc7bb9a025326831574e3444e6f93f
SHA256:	f44f58459e9f4bb4af9159ec4aae9bb37e4cc8cae779d1a9ff3d755ba0bdaf53
Tags:	64exetrojan
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Excessive usage of taskkill to terminate processes

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

bC7vK74a5a.exe (PID: 5544 cmdline: "C:\Users\user\Desktop\bC7vK74a5a.exe" MD5: 728C57CF9E4022A270356C0E2341E7F4)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1272 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6820 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1352 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6940 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1800 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7012 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5848 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 2664 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5040 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 3400 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1364 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5424 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6036 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1420 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3940 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4444 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3552 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1364 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7012 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

WerFault.exe (PID: 1800 cmdline: C:\Windows\system32\WerFault.exe -pss -s 460 -p 5544 -ip 5544 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cmd.exe (PID: 5576 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1016 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5324 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 1352 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5724 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6168 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2664 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5576 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5324 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6968 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6036 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6940 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5956 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6820 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 5576 cmdline: C:\Windows\system32\WerFault.exe -u -p 5544 -s 996 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: bC7vK74a5a.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Machine Learning detection for sample

Source: bC7vK74a5a.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B9F3D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF6139B9F3D
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139D63F0 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF6139D63F0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B9300 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6139B9300
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139BC1C0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF6139BC1C0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139BC220 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6139BC220
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B9230 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF6139B9230
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139BC210 CryptHashData,	0_2_00007FF6139BC210
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139D5AD0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF6139D5AD0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DEF30 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF6139DEF30
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DCE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF6139DCE40

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF61399F0E0
Source: bC7vK74a5a.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF6139C8B00

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: bC7vK74a5a.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Aim\x64\Release\EpicGames.pdb source: bC7vK74a5a.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF613991530 rand,rand,rand,SetConsoleTitleA,_invalid_parameter_noinfo_noreturn,GetConsoleWindow,GetWindowLongPtrA,SetWindowLongPtrA,SetLayeredWindowAttributes,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,URLDownloadToFileA,system,system,Sleep,exit,URLDownloadToFileA,system,system,Sleep,exit,_invalid_parameter_noinfo_noreturn,

0_2_00007FF613991530

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: bC7vK74a5a.exe	String found in binary or memory: http://185.101.104.122/aimhvcibronkzops.exe
Source: bC7vK74a5a.exe	String found in binary or memory: http://185.101.104.122/aimhvcibronkzops.exeC:
Source: bC7vK74a5a.exe	String found in binary or memory: http://185.101.104.122/aimhvciforabronkz.exe
Source: bC7vK74a5a.exe	String found in binary or memory: http://185.101.104.122/aimhvciforabronkz.exeC:
Source: Amcache.hve.37.dr	String found in binary or memory: http://upx.sf.net
Source: bC7vK74a5a.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: bC7vK74a5a.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace
Source: bC7vK74a5a.exe, 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmp, bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/EL=6

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF6139DCE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF6139DCE40

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF613991530	0_2_00007FF613991530
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139AF590	0_2_00007FF6139AF590
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A7CC0	0_2_00007FF6139A7CC0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A8980	0_2_00007FF6139A8980
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A6980	0_2_00007FF6139A6980
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B9F3D	0_2_00007FF6139B9F3D
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139C9520	0_2_00007FF6139C9520
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B53E0	0_2_00007FF6139B53E0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A3330	0_2_00007FF6139A3330
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF61398D250	0_2_00007FF61398D250
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139CD220	0_2_00007FF6139CD220
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A9840	0_2_00007FF6139A9840
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B2890	0_2_00007FF6139B2890
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF61398973B	0_2_00007FF61398973B
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139BC5D0	0_2_00007FF6139BC5D0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A0600	0_2_00007FF6139A0600
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF61398955D	0_2_00007FF61398955D
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139D15B0	0_2_00007FF6139D15B0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139D0580	0_2_00007FF6139D0580
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B7CC0	0_2_00007FF6139B7CC0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF61398ABFD	0_2_00007FF61398ABFD
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF61398EB70	0_2_00007FF61398EB70
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139D5AD0	0_2_00007FF6139D5AD0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139C49F0	0_2_00007FF6139C49F0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF613998990	0_2_00007FF613998990
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139BA005	0_2_00007FF6139BA005
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF613981000	0_2_00007FF613981000
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B9FFC	0_2_00007FF6139B9FFC
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DEEC0	0_2_00007FF6139DEEC0
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DCE40	0_2_00007FF6139DCE40
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF61398DDE0	0_2_00007FF61398DDE0

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139A8DB0 appears 46 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139A5AF0 appears 323 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139AA2A0 appears 37 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF613993030 appears 49 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139AA330 appears 33 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139A0240 appears 70 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139E0236 appears 47 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139A8E80 appears 35 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139AA410 appears 34 times
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: String function: 00007FF6139A5970 appears 378 times

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 460 -p 5544 -ip 5544

Source: classification engine

Classification label: mal60.evad.winEXE@68/22@1/2

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF613992640 GetLastError,_errno,FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF613992640

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5544
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1800:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\53f70cbc-026b-4400-b7d3-304e0b37b315

Jump to behavior

Source: bC7vK74a5a.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bC7vK74a5a.exe

ReversingLabs: Detection: 36%

Source: bC7vK74a5a.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\bC7vK74a5a.exe "C:\Users\user\Desktop\bC7vK74a5a.exe"
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 460 -p 5544 -ip 5544
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5544 -s 996
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: bC7vK74a5a.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: bC7vK74a5a.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: bC7vK74a5a.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: bC7vK74a5a.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: bC7vK74a5a.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: bC7vK74a5a.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: bC7vK74a5a.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: bC7vK74a5a.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: bC7vK74a5a.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Aim\x64\Release\EpicGames.pdb source: bC7vK74a5a.exe

Source: bC7vK74a5a.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: bC7vK74a5a.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: bC7vK74a5a.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: bC7vK74a5a.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: bC7vK74a5a.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF6139A8660 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF6139A8660

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-47824

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

API coverage: 4.3 %

Source: Amcache.hve.37.dr	Binary or memory string: VMware
Source: Amcache.hve.37.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.37.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.37.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.37.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.37.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.37.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.37.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.37.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.37.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.37.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.37.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.37.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.37.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.37.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.37.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.37.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.37.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.37.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.37.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.37.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.37.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.37.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.37.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.37.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.37.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF6139E00E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6139E00E8

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF6139E00E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6139E00E8

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF6139A8660 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF6139A8660

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DF9F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6139DF9F4
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DFEF4 SetUnhandledExceptionFilter,	0_2_00007FF6139DFEF4
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139DFD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6139DFD4C

HIPS / PFW / Operating System Protection Evasion

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T

Source: C:\Users\user\Desktop\bC7vK74a5a.exe

Code function: 0_2_00007FF6139DFF64 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6139DFF64

Source: Amcache.hve.37.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.37.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.37.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.37.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139B4A60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF6139B4A60
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139CB4F1 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF6139CB4F1
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139CB750 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF6139CB750
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139A7630 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF6139A7630
Source: C:\Users\user\Desktop\bC7vK74a5a.exe	Code function: 0_2_00007FF6139C49F0 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF6139C49F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bC7vK74a5a.exe	37%	ReversingLabs	Win32.Trojan.Generic
bC7vK74a5a.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.37.dr	false	URL Reputation: safe	unknown
https://keyauth.win/api/1.2/EL=6	bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/aimhvcibronkzops.exe	bC7vK74a5a.exe	false		unknown
https://keyauth.win/api/1.1/ace	bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/aimhvciforabronkz.exeC:	bC7vK74a5a.exe	false		unknown
http://185.101.104.122/aimhvciforabronkz.exe	bC7vK74a5a.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html	bC7vK74a5a.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	bC7vK74a5a.exe	false		unknown
https://keyauth.win/api/1.2/	bC7vK74a5a.exe, 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmp, bC7vK74a5a.exe, 00000000.00000002.2249952326.000002E662A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/aimhvcibronkzops.exeC:	bC7vK74a5a.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538241
Start date and time:	2024-10-20 21:27:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bC7vK74a5a.exe renamed because original name is a hash value
Original Sample Name:	728c57cf9e4022a270356c0e2341e7f4.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@68/22@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 226
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: bC7vK74a5a.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.0.5	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.12317.30120.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	172.67.72.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.0.5
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	104.26.0.5

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bC7vK74a5a.exe_3d1df02cfb4a4a20b131a6e5094572abda3813_f313f8e1_86d6d614-7dbd-4c82-b5d8-5051dfa7ebd8\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9982394840034947
Encrypted:	false
SSDEEP:	192:RUGhRB6xr0FsA+jnVm8zuiFRZ24lO8f0:3Rsx4FsA+jZzuiFRY4lO8f
MD5:	78F062BD38A87161B42B05EBB2E68C39
SHA1:	B9A9844BCCF145B4604E0D1689DA41A58E43899B
SHA-256:	6A75743722CCEC80297A732CC7AA97359A3EFA6D96D528635BDADD6D1E0B8D5F
SHA-512:	6D79EA439B755801551F0964597B49CC6D131C85BEF6BF6544E8142D77E0F76C279D2356E81FDF54BDC33D64EA9B23C4CA3670D4B64A138F69759B4703E2B7CF
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.2.6.1.1.1.3.4.5.3.5.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.2.6.1.1.1.9.5.4.7.2.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.d.6.d.6.1.4.-.7.d.b.d.-.4.c.8.2.-.b.5.d.8.-.5.0.5.1.d.f.a.7.e.b.d.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.8.b.b.0.3.c.-.e.a.b.9.-.4.8.6.3.-.9.7.4.0.-.b.1.b.9.1.5.4.3.7.e.b.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.b.C.7.v.K.7.4.a.5.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.a.8.-.0.0.0.1.-.0.0.1.4.-.7.5.c.d.-.e.0.3.9.2.6.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.3.5.d.2.7.3.a.6.d.b.b.c.1.5.a.7.2.7.d.3.4.9.4.f.6.9.9.2.a.8.0.0.0.0.f.f.f.f.!.0.0.0.0.4.c.f.9.c.6.2.c.d.6.f.c.7.b.b.9.a.0.2.5.3.2.6.8.3.1.5.7.4.e.3.4.4.4.e.6.f.9.3.f.!.b.C.7.v.K.7.4.a.5.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E54.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 19:28:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	105812
Entropy (8bit):	1.6107327880710214
Encrypted:	false
SSDEEP:	384:H7Ni/EFW0Zv20tqRuKb5gbkOJukt1RDR8pXURleGx:pLW0dBoRuKb50yURlD
MD5:	F6DD9BEE81B7334624290EAC573F2F62
SHA1:	DE8D162CEBFC912A1CB9408CAE96DD08367AECCF
SHA-256:	D1EC0869755EFFE81416363D2A1F249A4CE257872747600387C79A28C13DA337
SHA-512:	54ECCAC8412B47F3FE5788DA4DB1556BA9053C28F8A3C3D0D590CA28160A99B26982732DDC6AED66E2AE7EFE7FCB8F55D49FE7304296BD5F6D5D4EFD904F5EC5
Malicious:	false
Preview:	MDMP..a..... ........Y.g............$...............,............J..........T.......8...........T...........p'...u.......................!..............................................................................eJ......T"......Lw......................T............Y.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F4F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	3.717381837756507
Encrypted:	false
SSDEEP:	192:R6l7wVeJk3Jb6Y9aHQgmf55Ppr189bFpqh36x5bfHl3m:R6lXJc16YwHQgmf55gF0h36x5bf4
MD5:	18D5BF590236FDE7384705053BAED522
SHA1:	D3C2C2C0C2BB1726D5D6DFD0EA0CD6D73D6C0807
SHA-256:	25BCEAA028331A339AB064423ED43E5ED350CE5BFFFC6ABDF2808E4A2B69620E
SHA-512:	88C0E84956AFB55BC4EBFF6089ED0FCC0893454909C0C837D285D9F305B9A5200AA12B85EAA406D02BAEE5226EDBFC49CEB82945108EF782037B58244B7AF0DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F8E.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.459171110618495
Encrypted:	false
SSDEEP:	48:cvIwWl8zsjJg771I9wLWpW8VYWYm8M4JPaFsoyq851w0svd:uIjf9I7f67VqJIP0svd
MD5:	DDA218003531F2D50239AC2E5C9A502A
SHA1:	31281A0FE34019E08AD6201AEC23CB1803802BA8
SHA-256:	F1B5F3EA6805544A34ED1A80358B949F87F4B4A39A9ED986F92C259B9DC1C37C
SHA-512:	102817598519C21E86E426B893E45F6222CB23194886D91AF18B59CA04130B6EEC8DF40FD66A868AB524C886140470A64F8014B2C81438205DCFAF7D8625F8CF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552151" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465593169957847
Encrypted:	false
SSDEEP:	6144:JIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uN1dwBCswSbt:6XD94zWlLZMM6YFHP+t
MD5:	21E78882BDBB814DDCC27B8D9D9BDD57
SHA1:	4B9C887B22C31263C066E09702C3A32C2FB2E3F7
SHA-256:	477500D384ADCFFD845CCDC704C8F03974F88ACD4A5B028310BC12C6EC42FCBD
SHA-512:	B6AC995AE4F58830F78564527333E5739327D4649F18BF19E9328D18262F5546EE2230A29E905A83E3D03A3EF0287C29929D6523A6725160E4D971A72CCE0D19
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.-#?&#................................................................................................................................................................................................................................................................................................................................................4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.4232273237386295
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bC7vK74a5a.exe
File size:	506'368 bytes
MD5:	728c57cf9e4022a270356c0e2341e7f4
SHA1:	4cf9c62cd6fc7bb9a025326831574e3444e6f93f
SHA256:	f44f58459e9f4bb4af9159ec4aae9bb37e4cc8cae779d1a9ff3d755ba0bdaf53
SHA512:	2a7ffd46a1c13c68ccb7cb1d60a5628bd7de63ae15e17c19c9bd48c2e53b635d0b2ea684c5dc878aef08a02a50662183b16ad031ac1be3ded3fe227985fcf7a2
SSDEEP:	6144:ty8K4ZP3rneV8giiDYviaN4TuNy+m4W70Lzxw2T942uHde9VWWYpQUCgTf1:tDxVtfkYvi3qNRWYLz2m+P4mwUC6f1
TLSH:	F3B46D56A7A907E9D1A7D03CC547C603E7B6B4991310DBDB43A0CA791F63BE12E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14005f9d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670FD9A3 [Wed Oct 16 15:20:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F5EACC6A668h
dec eax
add esp, 28h
jmp 00007F5EACC69F57h
int3
int3
jmp 00007F5EACC6A918h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000178Bh]
dec eax
mov ecx, ebx
call dword ptr [000016F2h]
call dword ptr [00001774h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001770h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001764h]
test eax, eax
je 00007F5EACC6A0E9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018E12h]
call 00007F5EACC6A2AEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EF9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E89h], eax
dec eax
mov eax, dword ptr [00018EE2h]
dec eax
mov dword ptr [00018D53h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E57h], eax
mov dword ptr [00018D2Dh], C0000409h
mov dword ptr [00018D27h], 00000001h
mov dword ptr [00000031h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fda8	0x5fe00	65e11f533488d43dfe674e81ef7a76d8	False	0.5327218464797914	data	6.336096840256917	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	abbe659a7e32925e36856497fc0d3d38	False	0.3798076923076923	data	5.578759151509369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	227ce6cadd4904b7716198186655da5c	False	0.2138671875	data	2.4411408781631465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	50e902fb009b515c9924ff6238b5e51d	False	0.48175048828125	data	5.776998787420237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	39326fb49822ad82593e9e49b5e608b8	False	0.5123697916666666	data	4.849267575521713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:28:26.726006031 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:28:26.726090908 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:26.726156950 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:28:26.769273043 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:28:26.769318104 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.554739952 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.554912090 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:28:27.562243938 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:28:27.562249899 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.562741041 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.565602064 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:28:27.611402988 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.756122112 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.756182909 CEST	443	49734	104.26.0.5	192.168.2.4
Oct 20, 2024 21:28:27.756501913 CEST	49734	443	192.168.2.4	104.26.0.5
Oct 20, 2024 21:29:08.974483013 CEST	49734	443	192.168.2.4	104.26.0.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:28:26.711210012 CEST	64794	53	192.168.2.4	1.1.1.1
Oct 20, 2024 21:28:26.719362020 CEST	53	64794	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 21:28:26.711210012 CEST	192.168.2.4	1.1.1.1	0xce8e	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 21:28:26.719362020 CEST	1.1.1.1	192.168.2.4	0xce8e	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:28:26.719362020 CEST	1.1.1.1	192.168.2.4	0xce8e	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:28:26.719362020 CEST	1.1.1.1	192.168.2.4	0xce8e	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.26.0.5	443	5544	C:\Users\user\Desktop\bC7vK74a5a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 19:28:27 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-20 19:28:27 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 31 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.1&name=loader principal&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	15:28:22
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\bC7vK74a5a.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\bC7vK74a5a.exe"
Imagebase:	0x7ff613980000
File size:	506'368 bytes
MD5 hash:	728C57CF9E4022A270356C0E2341E7F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:28:22
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:28:23
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:28:23
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:28:23
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:28:23
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:28:24
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:28:24
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff69ba80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff69ba80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff7699e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6036, Parent PID: 5424

General

Target ID:	14
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3940, Parent PID: 1420

General

Target ID:	16
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3552, Parent PID: 4444

General

Target ID:	18
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7012, Parent PID: 1364

General

Target ID:	20
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff69ba80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 1016, Parent PID: 5576

General

Target ID:	22
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff69ba80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:28:25
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1352, Parent PID: 5544

General

Target ID:	24
Start time:	15:28:29
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 5724, Parent PID: 1352

General

Target ID:	25
Start time:	15:28:29
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:28:29
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2664, Parent PID: 6168

General

Target ID:	27
Start time:	15:28:29
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:28:29
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 5324, Parent PID: 5576

General

Target ID:	29
Start time:	15:28:29
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff6f98b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:28:30
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6036, Parent PID: 6968

General

Target ID:	31
Start time:	15:28:30
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff69ba80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:28:30
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5956, Parent PID: 6940

General

Target ID:	33
Start time:	15:28:30
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff69ba80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:28:30
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff7d2a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WerFault.exePID: 1800, Parent PID: 1364

General

Target ID:	36
Start time:	15:28:31
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 460 -p 5544 -ip 5544
Imagebase:	0x7ff75a5d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:28:31
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5544 -s 996
Imagebase:	0x7ff75a5d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	92

Executed Functions

Function 00007FF6139AF590 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AF668
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AF675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AF748
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AF7CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AF873
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AF90A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AF9D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AFA0D
strchr.VCRUNTIME140 ref: 00007FF6139AFB87
strchr.VCRUNTIME140 ref: 00007FF6139AFB9A
strchr.VCRUNTIME140 ref: 00007FF6139AFBAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AFCB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AFD23
memcpy.VCRUNTIME140 ref: 00007FF6139AFD4A
strchr.VCRUNTIME140 ref: 00007FF6139AFD5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AFD72
strstr.VCRUNTIME140 ref: 00007FF6139AFFA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B00E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B0259

Part of subcall function 00007FF6139A8DB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A8E23

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B030C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B0391
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B05EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B0600
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B060F

Part of subcall function 00007FF6139B1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19BA

strchr.VCRUNTIME140 ref: 00007FF6139B0BC7
strchr.VCRUNTIME140 ref: 00007FF6139B0BDA
strchr.VCRUNTIME140 ref: 00007FF6139B0BEC

Part of subcall function 00007FF6139B1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19DA
Part of subcall function 00007FF6139B1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19E3

strchr.VCRUNTIME140 ref: 00007FF6139B0E3F
strchr.VCRUNTIME140 ref: 00007FF6139B0E52
strchr.VCRUNTIME140 ref: 00007FF6139B0E64

Part of subcall function 00007FF6139B3F90: strchr.VCRUNTIME140 ref: 00007FF6139B4076
Part of subcall function 00007FF6139B3F90: strchr.VCRUNTIME140 ref: 00007FF6139B4089
Part of subcall function 00007FF6139B3F90: strchr.VCRUNTIME140 ref: 00007FF6139B409B

Strings

%x, xrefs: 00007FF6139B0F65
ftp://%s:%s@%s, xrefs: 00007FF6139B03BB
Content-Range, xrefs: 00007FF6139B023E
File already completely uploaded, xrefs: 00007FF6139B01F9
1.0, xrefs: 00007FF6139B02F0
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF6139B0DC1
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF6139B08E4
POST, xrefs: 00007FF6139AF715
Content-Length: 0, xrefs: 00007FF6139B0A60
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF6139B0298
Range, xrefs: 00007FF6139B00C2
Cookie, xrefs: 00007FF6139AF992
Host:%s, xrefs: 00007FF6139AFDB6
Referer: %s, xrefs: 00007FF6139AF93E
%s%s=%s, xrefs: 00007FF6139B0719
ftp, xrefs: 00007FF6139AFF79
OPTIONS, xrefs: 00007FF6139AF6FB
Proxy-Connection: Keep-Alive, xrefs: 00007FF6139B048F, 00007FF6139B04A4
;type=%c, xrefs: 00007FF6139B0011
Failed sending HTTP request, xrefs: 00007FF6139B0D36
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF6139B116E
PUT, xrefs: 00007FF6139AF708
Content-Type, xrefs: 00007FF6139AFA77, 00007FF6139B0DAD
Accept-Encoding, xrefs: 00007FF6139AF9B1
Transfer-Encoding, xrefs: 00007FF6139AFB1D
Expect, xrefs: 00007FF6139B0B64, 00007FF6139B0DD9
Could only read %I64d bytes from the input, xrefs: 00007FF6139B0215
If-Unmodified-Since, xrefs: 00007FF6139B0854
Accept: */*, xrefs: 00007FF6139B0075
Transfer-Encoding:, xrefs: 00007FF6139AFB3E
Content-Range: bytes %s/%I64d, xrefs: 00007FF6139B02A6
%s , xrefs: 00007FF6139B0323
Range: bytes=%s, xrefs: 00007FF6139B00EE
;type=, xrefs: 00007FF6139AFF9E
chunked, xrefs: 00007FF6139AFBC6
Failed sending PUT request, xrefs: 00007FF6139B0A39
Could not seek stream, xrefs: 00007FF6139B0158
If-Modified-Since, xrefs: 00007FF6139B085D
User-Agent, xrefs: 00007FF6139AF72D
1.1, xrefs: 00007FF6139B02FE
%s, xrefs: 00007FF6139B0B43
Host: %s%s%s, xrefs: 00007FF6139AFE2D
HEAD, xrefs: 00007FF6139AF6D1
?%s, xrefs: 00007FF6139B03FB
Host:, xrefs: 00007FF6139AFD81
Expect:, xrefs: 00007FF6139B0B85, 00007FF6139B0DFA
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF6139B0274
Invalid TIMEVALUE, xrefs: 00007FF6139B0813
%s?%s, xrefs: 00007FF6139AF765
Last-Modified, xrefs: 00007FF6139B084B
Content-Length, xrefs: 00007FF6139B09A4, 00007FF6139B0AF9, 00007FF6139B0D7E
Accept-Encoding: %s, xrefs: 00007FF6139AF9E2
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF6139AFC8C
multipart/form-data, xrefs: 00007FF6139AFABA
%s%s, xrefs: 00007FF6139B07A0
Failed sending POST request, xrefs: 00007FF6139B0A99, 00007FF6139B0CDD
Referer, xrefs: 00007FF6139AF923
Content-Length: %I64d, xrefs: 00007FF6139B09BB, 00007FF6139B0B10, 00007FF6139B0D95
Accept, xrefs: 00007FF6139B0063
GET, xrefs: 00007FF6139AF722
Transfer-Encoding: chunked, xrefs: 00007FF6139AFC7F
Failed sending HTTP POST request, xrefs: 00007FF6139B106B
Proxy-Connection, xrefs: 00007FF6139B0463
Host: %s%s%s:%d, xrefs: 00007FF6139AFE72
Host, xrefs: 00007FF6139AFCB9
http, xrefs: 00007FF6139AFF0B
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6139B05CB
100-continue, xrefs: 00007FF6139B0C06, 00007FF6139B0E86
Cookie: , xrefs: 00007FF6139B06FE, 00007FF6139B0774
0, xrefs: 00007FF6139B0FB6, 00007FF6139B10B5

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 47623950a0bbe64e698ed1ebe928e22b03c269fb12d880581cf83119aadb09f5
Instruction ID: d13517ff76f44a756270f6fd321e2f4c6b0657c11df82530ec67454abbc2fe4f
Opcode Fuzzy Hash: 47623950a0bbe64e698ed1ebe928e22b03c269fb12d880581cf83119aadb09f5
Instruction Fuzzy Hash: E7038F21E08F8285FB548B2598426B927A0BB45FA8F444935CE5FAB79BFF3CE455C340

Function 00007FF6139B9F3D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6139BA098
strchr.VCRUNTIME140 ref: 00007FF6139BA0C4
strchr.VCRUNTIME140 ref: 00007FF6139BA0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139BA122
strchr.VCRUNTIME140 ref: 00007FF6139BA232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139BA24A

Strings

Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF6139BA137
LocalMachine, xrefs: 00007FF6139BA153
CurrentUserGroupPolicy, xrefs: 00007FF6139BA1CD
Services, xrefs: 00007FF6139BA197
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF6139BA4D9
LocalMachineEnterprise, xrefs: 00007FF6139BA20B
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF6139BA622
LocalMachineGroupPolicy, xrefs: 00007FF6139BA1EC
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF6139B9FCB
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF6139BA504
Users, xrefs: 00007FF6139BA1B6
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6139BA733
Microsoft Unified Security Protocol Provider, xrefs: 00007FF6139BA63F
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF6139BA2B0
schannel: unable to allocate memory, xrefs: 00007FF6139BA5BC, 00007FF6139BA847
schannel: ALPN, offering %s, xrefs: 00007FF6139BA775
schannel: Failed to read cert file %s, xrefs: 00007FF6139BA5F9
http/1.1, xrefs: 00007FF6139BA753
CurrentUser, xrefs: 00007FF6139BA112
CurrentService, xrefs: 00007FF6139BA175
http/1.1, xrefs: 00007FF6139BA767
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF6139BA6B5
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF6139BA54F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: d89aac1099c6e6052993711684499b2b5f7c8b83f93c3e0272dea94e26d5bd3d
Instruction ID: 8df4e40ec42edae116220959796813c648b5a4594ddf235fec7364e0ea3dd26e
Opcode Fuzzy Hash: d89aac1099c6e6052993711684499b2b5f7c8b83f93c3e0272dea94e26d5bd3d
Instruction Fuzzy Hash: FB42B121A08F4285FB148B16E852AB927A4FF45FA5F408935CA5FAB796FF3CE544C700

Function 00007FF613991530 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF61399155A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF613991596
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF6139915C2
SetConsoleTitleA.KERNEL32 ref: 00007FF613991640
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613991679
GetConsoleWindow.KERNELBASE ref: 00007FF613991685
GetWindowLongPtrA.USER32 ref: 00007FF613991696
SetWindowLongPtrA.USER32 ref: 00007FF6139916AC
SetLayeredWindowAttributes.USER32 ref: 00007FF6139916C0
GetStdHandle.KERNEL32 ref: 00007FF6139916D0
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6139916DC
GetStdHandle.KERNEL32 ref: 00007FF6139916E7
SetConsoleTextAttribute.KERNELBASE ref: 00007FF6139916F3
GetStdHandle.KERNEL32 ref: 00007FF61399170A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991716

Part of subcall function 00007FF613990680: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6139811FA), ref: 00007FF61399075F

Part of subcall function 00007FF613991A70: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF613991728), ref: 00007FF613991A94
Part of subcall function 00007FF613991A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF613991728), ref: 00007FF613991AB5

GetStdHandle.KERNEL32 ref: 00007FF613991739
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991745
GetStdHandle.KERNEL32 ref: 00007FF61399175C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991768
GetStdHandle.KERNEL32 ref: 00007FF61399177F
SetConsoleTextAttribute.KERNEL32 ref: 00007FF61399178B
GetStdHandle.KERNEL32 ref: 00007FF6139917A2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6139917AE
GetStdHandle.KERNEL32 ref: 00007FF6139917C5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6139917D1
GetStdHandle.KERNEL32 ref: 00007FF6139917E8
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6139917F4
GetStdHandle.KERNEL32 ref: 00007FF613991817
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991823
GetStdHandle.KERNEL32 ref: 00007FF61399183A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991846
GetStdHandle.KERNEL32 ref: 00007FF61399185D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991869
GetStdHandle.KERNEL32 ref: 00007FF61399188C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF613991898
GetStdHandle.KERNEL32 ref: 00007FF6139918AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6139918BB
GetStdHandle.KERNEL32 ref: 00007FF6139918D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF6139918DE
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF6139918FB
URLDownloadToFileA.URLMON ref: 00007FF61399194F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399195B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613991968
Sleep.KERNEL32 ref: 00007FF613991973
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399197B
URLDownloadToFileA.URLMON ref: 00007FF6139919CD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139919D9
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139919E6
Sleep.KERNEL32 ref: 00007FF6139919F1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139919F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613991A32

Strings

.exe, xrefs: 00007FF613991563
Iniciar Valorant Aim (HVCI HABILITADO): , xrefs: 00007FF61399186F
start C:\Windows\System32\SerceubetisHostDialog.exe, xrefs: 00007FF613991961
##########################################################, xrefs: 00007FF61399176E
C:\Windows\System32\SerceubetisHostDialog.exe, xrefs: 00007FF61399191A
Selecione a opcao: , xrefs: 00007FF6139918E4
http://185.101.104.122/aimhvciforabronkz.exe, xrefs: 00007FF613991909
Iniciar Valorant Aim (HVCI DESLIGADO): , xrefs: 00007FF6139917FA
http://185.101.104.122/aimhvcibronkzops.exe, xrefs: 00007FF613991987
start C:\Windows\System32\SeiebingsHosDialog.exe, xrefs: 00007FF6139919DF
[ Selecione uma opcao: ], xrefs: 00007FF61399174B
C:\Windows\System32\SeiebingsHosDialog.exe, xrefs: 00007FF613991998
##########################################################, xrefs: 00007FF613991728
cd C:\, xrefs: 00007FF613991954, 00007FF6139919D2

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant Aim (HVCI DESLIGADO): $ Iniciar Valorant Aim (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SeiebingsHosDialog.exe$C:\Windows\System32\SerceubetisHostDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/aimhvcibronkzops.exe$http://185.101.104.122/aimhvciforabronkz.exe$start C:\Windows\System32\SeiebingsHosDialog.exe$start C:\Windows\System32\SerceubetisHostDialog.exe
API String ID: 2233566951-1582246269
Opcode ID: 9b615ab752b1db17b677d3e1e2d8fecd8b19d909079fd881a550ae344e632734
Instruction ID: 8178462e3247dde861513908240b863dadb9e471238b6747a8ba24590657e36b
Opcode Fuzzy Hash: 9b615ab752b1db17b677d3e1e2d8fecd8b19d909079fd881a550ae344e632734
Instruction Fuzzy Hash: F7E133A1E08E4386EB009B62E8565FC2365BF85FA4F444A35D51FE66F6FE2CD589C300

Function 00007FF6139A8980 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF6139A89A8
WSACleanup.WS2_32 ref: 00007FF6139A89C3
GetModuleHandleA.KERNEL32 ref: 00007FF6139A8A14
GetProcAddress.KERNEL32 ref: 00007FF6139A8A40
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A8A5A
LoadLibraryA.KERNEL32 ref: 00007FF6139A8A7D
GetProcAddress.KERNEL32 ref: 00007FF6139A8A9A
LoadLibraryExA.KERNELBASE ref: 00007FF6139A8AB0
GetSystemDirectoryA.KERNEL32 ref: 00007FF6139A8AC6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A8ADE
GetSystemDirectoryA.KERNEL32 ref: 00007FF6139A8AF2
LoadLibraryA.KERNEL32 ref: 00007FF6139A8B60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A8B6C
GetProcAddress.KERNEL32 ref: 00007FF6139A8B98
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8C21
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8C34
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8C43
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8C52
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8C62
VerifyVersionInfoA.KERNEL32 ref: 00007FF6139A8C73
QueryPerformanceFrequency.KERNEL32 ref: 00007FF6139A8C8F

Strings

AddDllDirectory, xrefs: 00007FF6139A8A90
if_nametoindex, xrefs: 00007FF6139A8B8E
LoadLibraryExA, xrefs: 00007FF6139A8A2E
iphlpapi.dll, xrefs: 00007FF6139A8A46
kernel32, xrefs: 00007FF6139A89FB

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: 372a1b11eae873ffce80445b4ce260fa558d07d99fefe9c51babf47caa90135e
Instruction ID: 99e7e6cb76bf6f1df694dd7ac05f9d2f2f2ff9289157e38bdb26c4a43d5cc5f1
Opcode Fuzzy Hash: 372a1b11eae873ffce80445b4ce260fa558d07d99fefe9c51babf47caa90135e
Instruction Fuzzy Hash: 56918365E0DF8285E7608B11E4063BA7B91FF88FA4F444A35D94F9A766FF3CE4458600

Function 00007FF6139A7CC0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6139A7D5C
socket.WS2_32 ref: 00007FF6139A7DA5
htons.WS2_32 ref: 00007FF6139A7E31
setsockopt.WS2_32 ref: 00007FF6139A7E93
WSAGetLastError.WS2_32 ref: 00007FF6139A7E9D
getsockopt.WS2_32 ref: 00007FF6139A7F3F
setsockopt.WS2_32 ref: 00007FF6139A7F6E
setsockopt.WS2_32 ref: 00007FF6139A7FAD
WSAIoctl.WS2_32 ref: 00007FF6139A803A
WSAGetLastError.WS2_32 ref: 00007FF6139A8044

Part of subcall function 00007FF6139B4C90: ioctlsocket.WS2_32 ref: 00007FF6139B4CA9

Part of subcall function 00007FF6139AD7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF61399582F), ref: 00007FF6139AD7C7

connect.WS2_32 ref: 00007FF6139A816B
WSAGetLastError.WS2_32 ref: 00007FF6139A8188

Part of subcall function 00007FF613992500: GetLastError.KERNEL32 ref: 00007FF613992522
Part of subcall function 00007FF613992500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399252A

Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C15
Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C30

Part of subcall function 00007FF6139A65D0: closesocket.WS2_32 ref: 00007FF6139A6613

Strings

Immediate connect fail for %s: %s, xrefs: 00007FF6139A81B8
@, xrefs: 00007FF6139A7ED7
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF6139A7FBA
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF6139A804D
Trying %s:%ld..., xrefs: 00007FF6139A7E3F
Could not set TCP_NODELAY: %s, xrefs: 00007FF6139A7EBA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF6139A822E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: a2329d31af6ccdedd8291ba3b20cb9468dd4f4060951aad07901af01d56ef692
Instruction ID: e9b5d99048e4389ccb8d99e4c791ddf5d8af0503771182a89c72edc3df452b2d
Opcode Fuzzy Hash: a2329d31af6ccdedd8291ba3b20cb9468dd4f4060951aad07901af01d56ef692
Instruction Fuzzy Hash: 40F1A172E0CA4286E7509B25D4422BD7790FB44FA4F404A35DA4FABAA6EF3CE545CB00

Function 00007FF6139A8660 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF6139D24BA,?,?,?,?,00007FF6139A89EB), ref: 00007FF6139A8674
GetProcAddress.KERNEL32(?,?,00007FF6139D24BA,?,?,?,?,00007FF6139A89EB), ref: 00007FF6139A8699
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF6139D24BA,?,?,?,?,00007FF6139A89EB), ref: 00007FF6139A86AC

Strings

AddDllDirectory, xrefs: 00007FF6139A86F3
LoadLibraryExA, xrefs: 00007FF6139A868A
kernel32, xrefs: 00007FF6139A866D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 230c0ed0a1b2d880a65c49ba9e4704915758f5ad6352508eade00287004d952d
Instruction ID: a4a02cf2c9e079d53291a170889fb34cf30fc50d71a81f40da1ad6abe6ada575
Opcode Fuzzy Hash: 230c0ed0a1b2d880a65c49ba9e4704915758f5ad6352508eade00287004d952d
Instruction Fuzzy Hash: ED418056F0DF5286EB558B16A4011796B91BF49FF1B084A34CE4E9A7A2FE3CE486C700

Function 00007FF6139B4A60 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF6139B4AA1
htonl.WS2_32 ref: 00007FF6139B4ACE
setsockopt.WS2_32 ref: 00007FF6139B4B05
bind.WS2_32 ref: 00007FF6139B4B20
getsockname.WS2_32 ref: 00007FF6139B4B3C
listen.WS2_32 ref: 00007FF6139B4B51
socket.WS2_32 ref: 00007FF6139B4B68
connect.WS2_32 ref: 00007FF6139B4B87
accept.WS2_32 ref: 00007FF6139B4B9E
send.WS2_32 ref: 00007FF6139B4BEC
recv.WS2_32 ref: 00007FF6139B4C0A
memcmp.VCRUNTIME140 ref: 00007FF6139B4C25
closesocket.WS2_32 ref: 00007FF6139B4C31

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 6e6282c668dcfc894862906e82aaace15aa8d0c260b38d1dd148d6634827d9ca
Instruction ID: b5f91e2fcfd8e2e84646fef20f7c0428ddb93bd9bfdea00558ad6a156196a948
Opcode Fuzzy Hash: 6e6282c668dcfc894862906e82aaace15aa8d0c260b38d1dd148d6634827d9ca
Instruction Fuzzy Hash: 5D515D72608F4682E7509B26E4455A97361FB84FB4F504B30EA7B977EAEF3CD4458B00

Function 00007FF6139A6980 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to connect to %s port %ld: %s, xrefs: 00007FF6139A6EAE
Connection failed, xrefs: 00007FF6139A6D66
connect to %s port %ld failed: %s, xrefs: 00007FF6139A6BFD
Connection time-out, xrefs: 00007FF6139A6A69
After %I64dms connect time, move on!, xrefs: 00007FF6139A6B45

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: e2eedc7052c941d1432b2a018d79d9ac4f8581cfbb25bdcbeb98e85e99d6e6c7
Instruction ID: c1fd38732fcaaa9465f7e74730e9ed035be958c9d77d7874689552f7b8facc71
Opcode Fuzzy Hash: e2eedc7052c941d1432b2a018d79d9ac4f8581cfbb25bdcbeb98e85e99d6e6c7
Instruction Fuzzy Hash: 5DE1C062F08A8282EB148B25D5462B977A1FB85BB4F044735DA5FA77E2EF3CE451C340

Function 00007FF613982AA0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139828A7
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982917
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982977
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139829C7
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982A17

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982C48

Part of subcall function 00007FF6139848C0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613984980

Part of subcall function 00007FF6139DF1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6139843EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF6139DF20A

Part of subcall function 00007FF613984310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982C98
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982CD7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982D25
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982D64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982E18
memcpy.VCRUNTIME140 ref: 00007FF613982E3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982F13
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982F5A
ShellExecuteA.SHELL32 ref: 00007FF613983052
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398305A
MessageBoxA.USER32 ref: 00007FF613983090
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139830A1
Sleep.KERNEL32 ref: 00007FF613983109
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613983111
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF613983118

Part of subcall function 00007FF613983160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398326F
Part of subcall function 00007FF613983160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139832B0

Part of subcall function 00007FF613983C30: memcpy.VCRUNTIME140 ref: 00007FF613983C83

Part of subcall function 00007FF6139832D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139833B0

Part of subcall function 00007FF6139833D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139834B0

Strings

sessionid, xrefs: 00007FF613982E9E
Failure, xrefs: 00007FF613983087
download, xrefs: 00007FF613983015
message, xrefs: 00007FF613982FA3, 00007FF613983061
success, xrefs: 00007FF613982E76
open, xrefs: 00007FF613983049
invalidver, xrefs: 00007FF613982FD9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 1e7466b00c29e06c08f4ea5f87bbe137f5503f3082a7dc0f4c96e7eef9db421e
Instruction ID: e0a62c8ffe61a6d1d47db7eb5b51c71723b26ad9a05b9ba05b7f1f1a910e6a6c
Opcode Fuzzy Hash: 1e7466b00c29e06c08f4ea5f87bbe137f5503f3082a7dc0f4c96e7eef9db421e
Instruction Fuzzy Hash: E602F762A08F8685EB009B64D4463AD2761FF85BB4F405A75DA9E67AD7EF3CD084D300

Function 00007FF6139BB5C0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF6139BBC01
memcpy.VCRUNTIME140 ref: 00007FF6139BBC1D

Strings

schannel: SSL/TLS connection renegotiated, xrefs: 00007FF6139BBA5F
schannel: remote party requests renegotiation, xrefs: 00007FF6139BB9E2
schannel: server closed the connection, xrefs: 00007FF6139BBA94
schannel: server indicated shutdown in a prior call, xrefs: 00007FF6139BB688
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF6139BBBAE
schannel: Curl_read_plain returned error %d, xrefs: 00007FF6139BB961
schannel: failed to decrypt data, need more data, xrefs: 00007FF6139BBB2A
schannel: enough decrypted data is already available, xrefs: 00007FF6139BB645
schannel: unable to re-allocate memory, xrefs: 00007FF6139BB6FD, 00007FF6139BBB66
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF6139BB78D
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF6139BBA18
schannel: can't renogotiate, an error is pending, xrefs: 00007FF6139BBB82
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF6139BBBA2
schannel: renegotiation failed, xrefs: 00007FF6139BBB8E
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF6139BB665
schannel: failed to read data from server: %s, xrefs: 00007FF6139BBB52

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 507de865ae20c84d9630f303409964dba77a077305b430b96329f337efb5b13c
Instruction ID: 5d6e6650ff93a2fbff742921752067d0f546b883f1a9c3f20a51ec855cd3501b
Opcode Fuzzy Hash: 507de865ae20c84d9630f303409964dba77a077305b430b96329f337efb5b13c
Instruction Fuzzy Hash: C002D232A08F4585EB60DB09D485B693BA4FB40FA4F504935DA4EAB7EAEF78D845C700

Function 00007FF6139BAA50 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BAB40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BAB91
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BABD4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BACB7
memcpy.VCRUNTIME140 ref: 00007FF6139BAD59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BADC2
memcpy.VCRUNTIME140 ref: 00007FF6139BAE9A
memset.VCRUNTIME140 ref: 00007FF6139BB067
CertFreeCertificateContext.CRYPT32 ref: 00007FF6139BB0CA

Strings

schannel: unable to allocate memory, xrefs: 00007FF6139BB1BF
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF6139BAEC6
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF6139BAF5E, 00007FF6139BB172
schannel: unable to re-allocate memory, xrefs: 00007FF6139BABE2
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6139BAF2B
SSL: public key does not match pinned public key!, xrefs: 00007FF6139BB0AC, 00007FF6139BB0D4
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6139BB10A
SSL: failed retrieving public key from server certificate, xrefs: 00007FF6139BB0EA
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF6139BAF74

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 43dad6052e7db5d0feb779de27c83d9fe3549c54bc9181445eb254f7299b92d5
Instruction ID: c3f1ab54d67a16de687b6bb9ffd14f47794bc62d961ff3d80ac77ef6f6ab549b
Opcode Fuzzy Hash: 43dad6052e7db5d0feb779de27c83d9fe3549c54bc9181445eb254f7299b92d5
Instruction Fuzzy Hash: 3E129132A08F8285EB608B19D8517AE37A4FB44FA5F504936DA5FAB796EF3CD441C700

Function 00007FF6139B9C70 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6139B9D41
GetProcAddress.KERNEL32 ref: 00007FF6139B9D51

Strings

schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6139B9DE2
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF6139B9D22
ntdll, xrefs: 00007FF6139B9D3A
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF6139BA733
wine_get_version, xrefs: 00007FF6139B9D4A
schannel: unable to allocate memory, xrefs: 00007FF6139BA847
schannel: ALPN, offering %s, xrefs: 00007FF6139BA775
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF6139BA9E9
schannel: SNI or certificate check failed: %s, xrefs: 00007FF6139BA92D
http/1.1, xrefs: 00007FF6139BA753
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF6139BA6EF
http/1.1, xrefs: 00007FF6139BA767
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF6139BA90C, 00007FF6139BA953

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 2338b05bd6f938158b7bbd3647836caff589d68b3deee7ea365616dd5d438d8c
Instruction ID: 32d3de84ee002f814cfaf546dfe9ff8ae3eb074a790dd766d648013a8a6fecae
Opcode Fuzzy Hash: 2338b05bd6f938158b7bbd3647836caff589d68b3deee7ea365616dd5d438d8c
Instruction Fuzzy Hash: 55029132A08F8186E7508B25D4417EE37A4FB45FA4F508936DA5EAB796EF3CE544C700

Function 00007FF61399B2B0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B2E2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B37D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF61399B396

Part of subcall function 00007FF6139B4A60: socket.WS2_32 ref: 00007FF6139B4AA1

DeleteCriticalSection.KERNEL32 ref: 00007FF61399B3D0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B3E4
closesocket.WS2_32 ref: 00007FF61399B402
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B438
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399B43E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399B46D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B487
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399B490
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399B4C5
EnterCriticalSection.KERNEL32 ref: 00007FF61399B4E6
LeaveCriticalSection.KERNEL32 ref: 00007FF61399B4FA
CloseHandle.KERNEL32 ref: 00007FF61399B507
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B532
closesocket.WS2_32 ref: 00007FF61399B54B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B55F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: fe9dc3e15b7135038b309508d58dd590963aa39b29c1eba6b1d019a3f51d2b9f
Instruction ID: 5d9e2fb56b5b4728d93977fb87cac380dce57fee97783cb7b17da999a18f2c41
Opcode Fuzzy Hash: fe9dc3e15b7135038b309508d58dd590963aa39b29c1eba6b1d019a3f51d2b9f
Instruction Fuzzy Hash: 08815A22E09F8187E624DF22E8512A97760FB98B60F445635DB9F567A2EF7CE4D48300

Function 00007FF6139A2920 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

proxy, xrefs: 00007FF6139A2FE2
anonymous, xrefs: 00007FF6139A2AD8
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF6139A3003
No more connections allowed to host %s: %zu, xrefs: 00007FF6139A30B2
No connections available in cache, xrefs: 00007FF6139A331B
No connections available., xrefs: 00007FF6139A30C1
host, xrefs: 00007FF6139A2FF0
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF6139A3172
ftp@example.com, xrefs: 00007FF6139A2ADF
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF6139A31A0

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: efddc1f6dacb3119a96794c8e25f0bd1cf04d4b00aa7f066a4e6263cdbba1fe6
Instruction ID: b7ce55992b147c1b6024fff2dfc600cc62cc7a201a5349ab52cf18a07587749f
Opcode Fuzzy Hash: efddc1f6dacb3119a96794c8e25f0bd1cf04d4b00aa7f066a4e6263cdbba1fe6
Instruction Fuzzy Hash: 2142C222F09FC295EB598B2195413B97790FB45FA4F084A35CE9E977A6EF78E460C300

Function 00007FF6139A18B0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF613991B61,?,?,?,?,00007FF613983591), ref: 00007FF6139A18C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1911

Strings

`, xrefs: 00007FF6139A1BAA
<, xrefs: 00007FF6139A1B58
<, xrefs: 00007FF6139A1A27
<, xrefs: 00007FF6139A1B4E
v, xrefs: 00007FF6139A1BBF

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction ID: 6622714ea84c960c95e32177034d029b11713e384a38f59e4c0a716710d622df
Opcode Fuzzy Hash: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction Fuzzy Hash: 3A915C72908BC186E3008F24D4053E837A4FB55F6CF085738DE995B39ADFBAA194C720

Function 00007FF6139A7300 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF6139A736C
WSAGetLastError.WS2_32 ref: 00007FF6139A7376

Part of subcall function 00007FF613992500: GetLastError.KERNEL32 ref: 00007FF613992522
Part of subcall function 00007FF613992500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399252A

getsockname.WS2_32 ref: 00007FF6139A73F6
WSAGetLastError.WS2_32 ref: 00007FF6139A7400

Strings

getpeername() failed with errno %d: %s, xrefs: 00007FF6139A7396
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF6139A751C
getsockname() failed with errno %d: %s, xrefs: 00007FF6139A7420
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF6139A7486

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 78bda30eb9f00ef79d3851da8f0a2d784c8795b32e686334d913f5884b7e80e3
Instruction ID: 5272cc4dc24c274fcc99f7197f07cea5ecf7f1f5740e1d8c5549ebffcd0de799
Opcode Fuzzy Hash: 78bda30eb9f00ef79d3851da8f0a2d784c8795b32e686334d913f5884b7e80e3
Instruction Fuzzy Hash: D4919F62A18BC186D710CF25D4512ED33A0FB89F98F445236DE8E9762AEF39E185CB10

Function 00007FF6139B86D0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF6139B86F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B875E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8798
memcpy.VCRUNTIME140(?,?,?,00007FF61399B1F5), ref: 00007FF6139B87B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B87BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B87FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8803
freeaddrinfo.WS2_32(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8831
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8845
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B884F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B885C
WSASetLastError.WS2_32(?,?,?,00007FF61399B1F5), ref: 00007FF6139B887D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction ID: 64a5760ec04660a34cf43f0ab4228e0409ea4fc5bb9e3fd3f28d04ef61a6c578
Opcode Fuzzy Hash: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction Fuzzy Hash: B2515036A0DF9187EA658F02A5419396BA4FB48FA4F088835DE5FAB755EF3CE4448700

Function 00007FF6139B5FE0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF6139B603D
Sleep.KERNEL32 ref: 00007FF6139B604E
WSASetLastError.WS2_32 ref: 00007FF6139B61B8
Sleep.KERNEL32 ref: 00007FF6139B61C9
__WSAFDIsSet.WS2_32 ref: 00007FF6139B627C
__WSAFDIsSet.WS2_32 ref: 00007FF6139B6293
__WSAFDIsSet.WS2_32 ref: 00007FF6139B62AE
__WSAFDIsSet.WS2_32 ref: 00007FF6139B62C2
__WSAFDIsSet.WS2_32 ref: 00007FF6139B62DD
__WSAFDIsSet.WS2_32 ref: 00007FF6139B62F1

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction ID: 61046aee6348241872bd3c8eb31bea6d9c9e96db21e4687f418a5c2c4b7c38c8
Opcode Fuzzy Hash: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction Fuzzy Hash: D491FD31A0CE8286FB644E1698419BA6291FB44B74F508934D95FEFBCAFF3CF9418640

Function 00007FF6139A4EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4F3F

Strings

Couldn't resolve proxy '%s', xrefs: 00007FF6139A511C
Unix socket path too long: '%s', xrefs: 00007FF6139A4F96
Couldn't resolve host '%s', xrefs: 00007FF6139A5071

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: d745ec9ae58cf2da707b93dddb6ae0445aae9b10f91d28d0416c49dab86b07c7
Instruction ID: ac1a9f08dd4ad6100d386ef24cfb8f191c4bf018e3fb5d9e1ad39c8d58d12cce
Opcode Fuzzy Hash: d745ec9ae58cf2da707b93dddb6ae0445aae9b10f91d28d0416c49dab86b07c7
Instruction Fuzzy Hash: 7351A421F0CF82C3F6598B25A4513BA7790EB45BA0F140931DB8E977A6EF3DE9518700

Function 00007FF613982840 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139828A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982917
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982977
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139829C7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982A17
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982A88

Strings

.8, xrefs: 00007FF613982A65
h%49, xrefs: 00007FF613982A5E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: e1d3076ed9d51c2f839fb864ec69f16c8f30c31a97545b534a8eb50fa7e2259f
Instruction ID: de1c46a07357b19eb86cdb9951b480fe22274df244e767791afee9bd4f4815bd
Opcode Fuzzy Hash: e1d3076ed9d51c2f839fb864ec69f16c8f30c31a97545b534a8eb50fa7e2259f
Instruction Fuzzy Hash: D5615B63E18BDA88F301CBA9E8461BC7B70BBD9B58F015679CECA75916FF681148C344

Function 00007FF61399B1A0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139B86D0: getaddrinfo.WS2_32 ref: 00007FF6139B86F2
Part of subcall function 00007FF6139B86D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B875E
Part of subcall function 00007FF6139B86D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8798
Part of subcall function 00007FF6139B86D0: memcpy.VCRUNTIME140(?,?,?,00007FF61399B1F5), ref: 00007FF6139B87B1
Part of subcall function 00007FF6139B86D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B87BF
Part of subcall function 00007FF6139B86D0: freeaddrinfo.WS2_32(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8831
Part of subcall function 00007FF6139B86D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B8845
Part of subcall function 00007FF6139B86D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B884F
Part of subcall function 00007FF6139B86D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF61399B1F5), ref: 00007FF6139B885C

WSAGetLastError.WS2_32 ref: 00007FF61399B1FB
WSAGetLastError.WS2_32 ref: 00007FF61399B205
EnterCriticalSection.KERNEL32 ref: 00007FF61399B220
LeaveCriticalSection.KERNEL32 ref: 00007FF61399B22F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399B240
send.WS2_32 ref: 00007FF61399B263
WSAGetLastError.WS2_32 ref: 00007FF61399B26D
LeaveCriticalSection.KERNEL32 ref: 00007FF61399B280

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: bf152be5e74fb760d3c049dad89691837c5dff5b7d510eaca98c6ec77837753b
Instruction ID: 8ae8c0e0618c33d3d24115797a0f02cb8103d4e6b62b7e19636d6db0da8b4ce7
Opcode Fuzzy Hash: bf152be5e74fb760d3c049dad89691837c5dff5b7d510eaca98c6ec77837753b
Instruction Fuzzy Hash: 3D314D72A08B42C6EB508F65E45226E27A0FB84FA8F444531D91FE76A6EF3CD485C740

Function 00007FF6139B5C40 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF6139B5CA6
WSASetLastError.WS2_32 ref: 00007FF6139B5E66
Sleep.KERNEL32 ref: 00007FF6139B5E76
__WSAFDIsSet.WS2_32 ref: 00007FF6139B5F8A
__WSAFDIsSet.WS2_32 ref: 00007FF6139B5FA2
Sleep.KERNEL32 ref: 00007FF6139B5FCD

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction ID: 91b32427de1613c68f55632851a30d91f6f0bf50fb73626adbf7f8397340c3c4
Opcode Fuzzy Hash: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction Fuzzy Hash: 71A1F732A18E92C6EB694A159405BB96295FF44FB4F148A34EA1BDB7CDFF3DD8018700

Function 00007FF6139BBC90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BBD2E
memcpy.VCRUNTIME140 ref: 00007FF6139BBDC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BBEFC

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF6139BBEC4
select/poll on SSL socket, errno: %d, xrefs: 00007FF6139BBEA4

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: fbaa020e30d34ebc4685cf47e22d8be72c4720d4c35440349a4689a0d0d02158
Instruction ID: 74acc5e9465c20f4b827c81e359c701e1c23ea1a5968f79129d6d4a427b43c6e
Opcode Fuzzy Hash: fbaa020e30d34ebc4685cf47e22d8be72c4720d4c35440349a4689a0d0d02158
Instruction Fuzzy Hash: 4B718E72B08B018AEB14CB65D4516AD37A5FB48BB8F004A35DF2EAB7D5EE38E405C740

Function 00007FF6139DF85C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF6139DF8F3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139DF941
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139DF946
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139DF94E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139DF956
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139DF978
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139DF9D2

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction ID: 834a8b6f342f1d4b58219dcf8856edacaeac767bb1da3395d85f8f0adaf38ed5
Opcode Fuzzy Hash: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction Fuzzy Hash: 35314C21E0CA4382FA54AB66D4533B963D0AF45FA4F444C35E64FEB3D7FE2DA8488211

Function 00007FF613996D00 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613996D4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613996D65
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613996E92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613996EBE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF613996F7B
%s, xrefs: 00007FF613996FC7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 25ab57a35ded7b4366cd3229136faa6fbebb1ef31794a7cbe106c78bf5a5e3d9
Instruction ID: c75f2f6247d1b72d807bce26517dfca540ac2e9ac2f56146dbd27abe73a8bf89
Opcode Fuzzy Hash: 25ab57a35ded7b4366cd3229136faa6fbebb1ef31794a7cbe106c78bf5a5e3d9
Instruction Fuzzy Hash: 03916F32B08E8186EB589F2595427B967A4FB44FB4F444935DA4FAB356EF3CE460C380

Function 00007FF6139A1190 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A11BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A11D1

Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A0FED
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A100A
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A101E
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A103A
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A1057
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A107A
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A108E
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A10A2
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A10C8
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A10DC
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A10F0
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A113F
Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A114C

Part of subcall function 00007FF6139A0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A1175

memset.VCRUNTIME140 ref: 00007FF6139A1205

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF6139A13E1
User-Agent: %s, xrefs: 00007FF6139A129F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: b4bb99099c09c2f90696dadfa9133446c6bcfceade5dd8e952d596f6c22118ac
Instruction ID: de74544e15a477825339344b0118de1b8283a7de9168bd21866928c2a274e30d
Opcode Fuzzy Hash: b4bb99099c09c2f90696dadfa9133446c6bcfceade5dd8e952d596f6c22118ac
Instruction Fuzzy Hash: 33716D62E0CFC281E751CF2594122BD3751EB95FA4F484631DE9EAB6A6EF38E4818350

Function 00007FF6139B1710 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B17A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B17B1
memcpy.VCRUNTIME140 ref: 00007FF6139B17CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B192C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B1935

Strings

1.1, xrefs: 00007FF6139B171F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction ID: 779622defb859b64ecc6ffb30511c14cf1f4110b0077d3a3d3b0ed7a82ecb5e5
Opcode Fuzzy Hash: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction Fuzzy Hash: 25518F72708FC586D6648B26E4417AA73A4FB44F94F448431DF9E9B75AEF3CE4948300

Function 00007FF6139A5ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5F96
recv.WS2_32 ref: 00007FF6139A5FC0
send.WS2_32 ref: 00007FF6139A5FE3
WSAGetLastError.WS2_32 ref: 00007FF6139A5FF5

Strings

Send failure: %s, xrefs: 00007FF6139A6025

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: a6506a0d2cd2bf56def8e955f094f9f147e258e37c492eb6729e9695d4306e10
Instruction ID: f4c1ed8f3b761d9cd6e39f4ea723753b333410c11ff5b52b528cecf319e4a70f
Opcode Fuzzy Hash: a6506a0d2cd2bf56def8e955f094f9f147e258e37c492eb6729e9695d4306e10
Instruction Fuzzy Hash: 1C418F62B05B4185EB648F26E8057796690FB48FB8F544A35DEAE973A6EF3CD440C700

Function 00007FF613997DF8 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613997F48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613997F8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613997FBA

Part of subcall function 00007FF613996D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613996D4E
Part of subcall function 00007FF613996D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613996D65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613997FEF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF613997336

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 064f49bb6e255ade0c927bea9155e5f26801896246ecfeb9cc64ea89652f1773
Instruction ID: f52348cb64496ab1d37bed6ddcdd4d15e20dfc634d813a05c1e8f2d8975e0c5c
Opcode Fuzzy Hash: 064f49bb6e255ade0c927bea9155e5f26801896246ecfeb9cc64ea89652f1773
Instruction Fuzzy Hash: C3D17021A08E4289FB248F25D4522BD27A1FF44FA8F045935DE0FAB69BEF39E545C350

Function 00007FF613983550 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139828A7
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982917
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982977
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139829C7
Part of subcall function 00007FF613982840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982A17

MessageBoxA.USER32 ref: 00007FF613983727

Part of subcall function 00007FF613984310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398378A

Strings

keyauth.win, xrefs: 00007FF6139836B3
null, xrefs: 00007FF6139835B2

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: a149f5d0346e2e4d48248f0c08c14f7f6b43faf1cd1bb1cce2e8f79fdbdf0108
Instruction ID: 6c4e9d523da6df9a47b2b971c955723925b928350ad3aa580db480ff44bf3ead
Opcode Fuzzy Hash: a149f5d0346e2e4d48248f0c08c14f7f6b43faf1cd1bb1cce2e8f79fdbdf0108
Instruction Fuzzy Hash: 3D51DE22B08B4586FB04DF75D4563AD2321BB44FA8F404934DE4E67AABEF3C90828340

Function 00007FF6139D2480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139A8660: GetModuleHandleA.KERNEL32(?,?,?,00007FF6139D24BA,?,?,?,?,00007FF6139A89EB), ref: 00007FF6139A8674

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF6139A89EB), ref: 00007FF6139D24D0

Strings

security.dll, xrefs: 00007FF6139D24AA
InitSecurityInterfaceA, xrefs: 00007FF6139D24C6
secur32.dll, xrefs: 00007FF6139D24A3

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: f8e17ba8d6c6c72759de793df64b220ff247381932ecd5de2460a51393658e6d
Instruction ID: 97b6d41e681e0c5f8824a94239248281c29cf306f1022eccc5c69d85fa302c20
Opcode Fuzzy Hash: f8e17ba8d6c6c72759de793df64b220ff247381932ecd5de2460a51393658e6d
Instruction Fuzzy Hash: 00F01960F09F4280FF54971AA8937702A90AF55F64F844974C84EEA692FE3CA1858700

Function 00007FF61399792B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF613997336

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: f84caca69c7972fb98c0df09d891486e401f7fb6e43fed5d7a8f50e34cea5287
Instruction ID: 0ba61448fdf56347543cef3aa313772caf8d0e19862c291d7854a8591a0cde12
Opcode Fuzzy Hash: f84caca69c7972fb98c0df09d891486e401f7fb6e43fed5d7a8f50e34cea5287
Instruction Fuzzy Hash: 1CB16222A0CE4289FB648E25945627D27A5EF41FA8F544935CA0FAB297FE3DE944C340

Function 00007FF6139B12D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B13D0

Part of subcall function 00007FF6139B1960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19BA

Part of subcall function 00007FF6139B1710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B17A8
Part of subcall function 00007FF6139B1710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B17B1

Strings

PROXY %s %s %s %li %li, xrefs: 00007FF6139B13A4
TCP4, xrefs: 00007FF6139B136A
TCP6, xrefs: 00007FF6139B1357

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 576f52932e20a67f69501a890910ecf293095fa115c1143bd2a4251892c664de
Instruction ID: 282ff18354d6386629f2231e467bf5319967d8b99d28e6763c52a33cdf92e75a
Opcode Fuzzy Hash: 576f52932e20a67f69501a890910ecf293095fa115c1143bd2a4251892c664de
Instruction Fuzzy Hash: D841BC72A0CF8286E750DB25A4427B977A1EB45BA4F188436DA4EDB69BFF3CD404C700

Function 00007FF613995BC0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF613991BF6,?,?,?,?,00000000,?,00007FF61398370E), ref: 00007FF613995BDD
closesocket.WS2_32 ref: 00007FF613995CE9
closesocket.WS2_32 ref: 00007FF613995CF6

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 0dc316c9491471f36169ca13040c5426418297ab516acf4aecf8f4c226863d07
Instruction ID: 61e699a27fc9ce690e4d815f6a181d741ea0b244b445ddff84d7dd8135e619bf
Opcode Fuzzy Hash: 0dc316c9491471f36169ca13040c5426418297ab516acf4aecf8f4c226863d07
Instruction Fuzzy Hash: 48414E32A08E4286E740AF35D4522E92361FB88F74F584A31DE5EDA2EBFF38D5458350

Function 00007FF6139B9A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF6139B9BC3
SSL/TLS connection timeout, xrefs: 00007FF6139B9BDC

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: a38cc91fe961a61f807d027dd041507603a95d00c7f28230958b43a3fdfda65b
Instruction ID: 2950d214c0d2b2d871e87cd1afa3d0066bcfbd0d8da092cd94814e0ad347f4b6
Opcode Fuzzy Hash: a38cc91fe961a61f807d027dd041507603a95d00c7f28230958b43a3fdfda65b
Instruction Fuzzy Hash: AF51C421B1CA9689EB549B1185427796691EF45FB8F14CA35CA2F9B3EAFF3CE401C310

Function 00007FF613995DC0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6139961B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139961D7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction ID: ce0460ab274f7dba3e409764f06a09a57f2e07d678b3dc5536c20f30a235446f
Opcode Fuzzy Hash: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction Fuzzy Hash: A9C1D432A08A828AEB258F2594517BE2290FB44BB4F444A35DE9F977C6FF3DE445C700

Function 00007FF6139A1E90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1EF5

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF6139A2034
User-Agent: %s, xrefs: 00007FF6139A1F06

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 14735c8d4da5ff9c77df89ee8aaeda6f25f4d3af1a329b697456f181ecc354f3
Instruction ID: 64a0e7701e43c6a60c90d91570c18c088d413fe71761c46d4760f6d75d2ea3ee
Opcode Fuzzy Hash: 14735c8d4da5ff9c77df89ee8aaeda6f25f4d3af1a329b697456f181ecc354f3
Instruction Fuzzy Hash: 92516F62E08AC181E7418F25D4553A97750EB85FA8F084631DF9EAB3AAEF79D491C310

Function 00007FF6139A5CF0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6139A5CFC
WSAGetLastError.WS2_32 ref: 00007FF6139A5D0B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction ID: 719e6b403857d5314e19fd67b6b654081e8d451448ab661e3ed09cdf9f542eb6
Opcode Fuzzy Hash: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction Fuzzy Hash: 4AE0DFA1F04A0582FF2947B1E8563782190AB44B72F444B34CA3BC63D0EE2C44D24300

Function 00007FF6139A65D0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF6139A6613

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction ID: 89bb53f2d9177d71cdb2cff0e4b086b6b2176fc6ea5aaa54371c4102c81ad621
Opcode Fuzzy Hash: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction Fuzzy Hash: 0D019212F05D4281EB54DB3AE1993AD2390EF88FA4F088531DB0ECB2A7EE2CD491C740

Function 00007FF6139AE0F0 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF6139AE119

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction ID: f5c69c018ccf3eac2c4d1e9d534f2b9b332d39269eadb244df53bcab380327eb
Opcode Fuzzy Hash: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction Fuzzy Hash: F0E09B36F06A1582DE489735C4535B53350AB55B34F844771C63E533D1ED2CE5969B00

Function 00007FF6139B8D50 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B8D6B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction ID: 53325402a8dcadf520c9c56e4c03c2f518b7db79dc0cce0b678dc348b0cc8701
Opcode Fuzzy Hash: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction Fuzzy Hash: A9D02B63B18B00839F20DF72A841069E351B788B74B484738EE7D827F4EF3CD1854600

Function 00007FF6139B4C90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF6139B4CA9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction ID: 7f08b0d58c1320d4ddb69663f7d3c0bc31f5ddd4bc0d1ead8c68c4df57e1ef33
Opcode Fuzzy Hash: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction Fuzzy Hash: 26C08067F14A81C3D3445F7254850C76772BBC4714F955435D24782224FD3CC2E58B40

Non-executed Functions

Function 00007FF6139B2890 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B3A53

Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C15
Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C30

memchr.VCRUNTIME140 ref: 00007FF6139B3B46
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B3C5E
strchr.VCRUNTIME140 ref: 00007FF6139B3C72
strchr.VCRUNTIME140 ref: 00007FF6139B3C9A
strchr.VCRUNTIME140 ref: 00007FF6139B3CB0

Strings

Content-Encoding:, xrefs: 00007FF6139B3291
Persistent-Auth, xrefs: 00007FF6139B35C2
HTTP/, xrefs: 00007FF6139B2B99
HTTP 1.0, assume close after body, xrefs: 00007FF6139B2CF7
HTTP error before end of send, keep sending, xrefs: 00007FF6139B3A79
RTSP/, xrefs: 00007FF6139B2984
HTTP/1.1 proxy connection set close!, xrefs: 00007FF6139B323D
HTTP %3d, xrefs: 00007FF6139B2AF8
Overflow Content-Length: value!, xrefs: 00007FF6139B2E2B
RTSP/%1d.%1d%c%3d, xrefs: 00007FF6139B2C1D
false, xrefs: 00007FF6139B3600
, xrefs: 00007FF6139B2C32
The requested URL returned error: %s, xrefs: 00007FF6139B3CC7
Maximum file size exceeded, xrefs: 00007FF6139B3CEF
HTTP/%1[23] %d, xrefs: 00007FF6139B2A54
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF6139B389C, 00007FF6139B38E8
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF6139B321C
Last-Modified:, xrefs: 00007FF6139B34C7
Retry-After:, xrefs: 00007FF6139B32D3
Received HTTP/0.9 when not allowed, xrefs: 00007FF6139B3BBB
HTTP/%1d.%1d%c%3d, xrefs: 00007FF6139B2A29
Lying server, not serving HTTP/2, xrefs: 00007FF6139B2AAC
Proxy-Connection:, xrefs: 00007FF6139B2EC3, 00007FF6139B2F9C
The requested URL returned error: %d, xrefs: 00007FF6139B3E23
Location:, xrefs: 00007FF6139B365E
Set-Cookie:, xrefs: 00007FF6139B3423
Content-Length:, xrefs: 00007FF6139B2D9F
Connection:, xrefs: 00007FF6139B305B, 00007FF6139B3110
Received 101, xrefs: 00007FF6139B3D2B
Content-Type:, xrefs: 00007FF6139B2E46
close, xrefs: 00007FF6139B3023, 00007FF6139B31A3
HTTP, xrefs: 00007FF6139B3C4E
HTTP error before end of send, stop sending, xrefs: 00007FF6139B3A9D
Unsupported HTTP version in response, xrefs: 00007FF6139B3C31
Got 417 while waiting for a 100, xrefs: 00007FF6139B3A33
Content-Range:, xrefs: 00007FF6139B335E
Mark bundle as not supporting multiuse, xrefs: 00007FF6139B2ACF
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF6139B3846
keep-alive, xrefs: 00007FF6139B2F56, 00007FF6139B30E6
Keep sending data to get tossed away!, xrefs: 00007FF6139B3AEC
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF6139B361C
Invalid Content-Length: value, xrefs: 00007FF6139B3D08
Transfer-Encoding:, xrefs: 00007FF6139B31DA
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF6139B325B
, xrefs: 00007FF6139B2A7C
Proxy-authenticate:, xrefs: 00007FF6139B3551
WWW-Authenticate:, xrefs: 00007FF6139B3526

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: 29391b55335036efc77e5294a79f8f76e0da53b964b828aae9b04ff18febf4e3
Instruction ID: 1d04778042b8c560b5dcf25316e0ad7b1ce7be100f6b6c834672f727e9f0fa3f
Opcode Fuzzy Hash: 29391b55335036efc77e5294a79f8f76e0da53b964b828aae9b04ff18febf4e3
Instruction Fuzzy Hash: 87C27571A08E8285FB50DB2584467B92791EB41FA8F488935CE4FAF69BFE3DE445C310

Function 00007FF6139CD220 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C15
Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C30

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CD2AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CD2E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CD2EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CD309
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CD31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CD325
#22.WLDAP32 ref: 00007FF6139CD336
#211.WLDAP32 ref: 00007FF6139CD3D0
#217.WLDAP32 ref: 00007FF6139CD3EC
#211.WLDAP32 ref: 00007FF6139CD405
#211.WLDAP32 ref: 00007FF6139CD417
#60.WLDAP32 ref: 00007FF6139CD447
#211.WLDAP32 ref: 00007FF6139CD562
#60.WLDAP32 ref: 00007FF6139CD587
#22.WLDAP32 ref: 00007FF6139CD62A
#41.WLDAP32 ref: 00007FF6139CDA46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CDA6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CDA78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CDA98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CDAAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CDAB4
#46.WLDAP32 ref: 00007FF6139CDAC6

Strings

LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF6139CD46B
LDAP local: trying to establish %s connection, xrefs: 00007FF6139CD369
encrypted, xrefs: 00007FF6139CD37E
cleartext, xrefs: 00007FF6139CD35F
Microsoft Corporation., xrefs: 00007FF6139CD240
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF6139CD634
DN: , xrefs: 00007FF6139CD722
;binary, xrefs: 00007FF6139CD8B0
LDAP remote: %s, xrefs: 00007FF6139CD6A7
LDAP local: %s, xrefs: 00007FF6139CD297
There are more than %d entries, xrefs: 00007FF6139CDA56
LDAP local: %s, xrefs: 00007FF6139CD33C
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF6139CD254

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 831d87dee25c1670673b59d4b4179000b4e3fe808a50e4d779f915d0a570c901
Instruction ID: 5ee6e953150b6c6f96a06fee49d20568a9688c540a00a52d59c0da82bc15091a
Opcode Fuzzy Hash: 831d87dee25c1670673b59d4b4179000b4e3fe808a50e4d779f915d0a570c901
Instruction Fuzzy Hash: 13425D66B08F4286FB109B66D4552B927A1FB48FA8F404931DE4FA7B96FE3CE445C340

Function 00007FF61398955D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 978COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF613989F5D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF613989F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A0BB

Strings

object separator, xrefs: 00007FF613989C63, 00007FF61398A49A
array, xrefs: 00007FF61398A17A
object, xrefs: 00007FF61398A309
number overflow parsing ', xrefs: 00007FF613989F80
object key, xrefs: 00007FF613989DEF, 00007FF61398A629

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 5dc6d2020e20b7b7b4f3fd0f005dc465797da0486d902d5c39db5575fa961406
Instruction ID: a8fc54bfdf8596dc0ca4135b3546c85c039218e1c7a6654395f595207e9a87fa
Opcode Fuzzy Hash: 5dc6d2020e20b7b7b4f3fd0f005dc465797da0486d902d5c39db5575fa961406
Instruction Fuzzy Hash: CAA2C862A18F8A85FF108B64D4453ED2361FB85BB4F404A31DA5EA7ADAEF7CD085D300

Function 00007FF6139C9520 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C956F
WSAStartup.WS2_32 ref: 00007FF6139C9610
FreeLibrary.KERNEL32 ref: 00007FF6139C97FD
GetStdHandle.KERNEL32 ref: 00007FF6139C980C
GetFileType.KERNEL32 ref: 00007FF6139C982D
WaitForMultipleObjects.KERNEL32 ref: 00007FF6139C9877
PeekNamedPipe.KERNEL32 ref: 00007FF6139C98FC
ReadFile.KERNEL32 ref: 00007FF6139C9923
ReadFile.KERNEL32 ref: 00007FF6139C99DD
WSAGetLastError.WS2_32 ref: 00007FF6139C9A3E
WSAGetLastError.WS2_32 ref: 00007FF6139C9C3A
FreeLibrary.KERNEL32 ref: 00007FF6139C9C5A
GetLastError.KERNEL32 ref: 00007FF6139C9C64

Part of subcall function 00007FF6139CA490: send.WS2_32 ref: 00007FF6139CA4CD
Part of subcall function 00007FF6139CA490: WSAGetLastError.WS2_32 ref: 00007FF6139CA4D7

Strings

WSAEnumNetworkEvents, xrefs: 00007FF6139C9740
WSACloseEvent, xrefs: 00007FF6139C96CC
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF6139C9A52
failed to load WS2_32.DLL (%u), xrefs: 00007FF6139C968B
Time-out, xrefs: 00007FF6139C9C17
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF6139C9760
WSACreateEvent failed (%d), xrefs: 00007FF6139C977E
WSAStartup failed (%d), xrefs: 00007FF6139C961D
insufficient winsock version to support telnet, xrefs: 00007FF6139C9C9F
WS2_32.DLL, xrefs: 00007FF6139C965E
WSACloseEvent failed (%d), xrefs: 00007FF6139C9C40
failed to find WSACloseEvent function (%u), xrefs: 00007FF6139C96EC
failed to find WSACreateEvent function (%u), xrefs: 00007FF6139C96C3
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF6139C9C6A
, xrefs: 00007FF6139C9C02
WSAEventSelect, xrefs: 00007FF6139C9711
WSACreateEvent, xrefs: 00007FF6139C96A5
failed to find WSAEventSelect function (%u), xrefs: 00007FF6139C9737

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: 3a84ad12ddd9242ef5708b47fd60f2fc0ce5b5ff1c798c18c0fc51936d33e422
Instruction ID: 8cfc0f4ff56d0ba663ddced9dbd2845b575d591861502ce47342ce612f376427
Opcode Fuzzy Hash: 3a84ad12ddd9242ef5708b47fd60f2fc0ce5b5ff1c798c18c0fc51936d33e422
Instruction Fuzzy Hash: E9126C71A0CE8285EB648F16E4463BA63A0FB45FA4F444935DA4FA7796EF3CE544C700

Function 00007FF61398ABFD Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 930COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398B594
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398B5C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398B5D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398B60A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398B667
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398B720
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398B74E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398B75C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398B796
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398B7F3

Part of subcall function 00007FF61398EFB0: memcmp.VCRUNTIME140 ref: 00007FF61398F03D
Part of subcall function 00007FF61398EFB0: memcmp.VCRUNTIME140 ref: 00007FF61398F0C1

Strings

object separator, xrefs: 00007FF61398B500, 00007FF61398BD29
array, xrefs: 00007FF61398BA09
object, xrefs: 00007FF61398BB98
number overflow parsing ', xrefs: 00007FF61398B80F
object key, xrefs: 00007FF61398B68C, 00007FF61398BEB8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: 4b3d2206014de7f61fa1300ad114516bb9951d61e68c3632b4719bc4a50493be
Instruction ID: 6dff163548291fee832aa249a5fa5b917be9175b3628c48efb9d06b26ba0f104
Opcode Fuzzy Hash: 4b3d2206014de7f61fa1300ad114516bb9951d61e68c3632b4719bc4a50493be
Instruction Fuzzy Hash: 7392A762A18F8985EF10DB68E4453AD2361FB85BB4F401631DB5EA7ADAEF7CD085D300

Function 00007FF6139D5AD0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF6139D5C3F
GetLastError.KERNEL32 ref: 00007FF6139D5C52
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF6139D5D04
GetLastError.KERNEL32 ref: 00007FF6139D5D0E
CertGetCertificateChain.CRYPT32 ref: 00007FF6139D5D9B
GetLastError.KERNEL32 ref: 00007FF6139D5DA5
CertGetNameStringA.CRYPT32 ref: 00007FF6139D5F13
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF6139D638B
CertCloseStore.CRYPT32 ref: 00007FF6139D63A0
CertFreeCertificateChain.CRYPT32 ref: 00007FF6139D63B0
CertFreeCertificateContext.CRYPT32 ref: 00007FF6139D63C0

Strings

schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF6139D5C11
schannel: Empty DNS name., xrefs: 00007FF6139D601A, 00007FF6139D61C8
2.5.29.17, xrefs: 00007FF6139D5F73, 00007FF6139D5FA4, 00007FF6139D610F, 00007FF6139D614B
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF6139D5E7A
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF6139D633D
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF6139D605D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF6139D5E25
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF6139D62B9
schannel: CertFindExtension() returned no extension., xrefs: 00007FF6139D5F8B, 00007FF6139D6127
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF6139D5E3C
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF6139D5D28
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF6139D5E0D
schannel: Not enough memory to list all host names., xrefs: 00007FF6139D623C
schannel: Null certificate context., xrefs: 00007FF6139D5F28, 00007FF6139D60D7
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF6139D6253
schannel: failed to create certificate store: %s, xrefs: 00007FF6139D5C6C
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF6139D5DBF
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF6139D6316
schannel: server certificate name verification failed, xrefs: 00007FF6139D62FE
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF6139D5E69
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF6139D5FDE, 00007FF6139D6185
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF6139D62C9
schannel: Null certificate info., xrefs: 00007FF6139D5F63, 00007FF6139D60F4
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF6139D5E52

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: b99ef1342f43ec3ae102a7ff4fd16fab8c957940eb817becddc35c7575eee630
Instruction ID: a7de4078f44b3af9759ef6cb321b1aa21f0f1bbb58f096a8de7b8e9b36311b72
Opcode Fuzzy Hash: b99ef1342f43ec3ae102a7ff4fd16fab8c957940eb817becddc35c7575eee630
Instruction Fuzzy Hash: FA429F72A08F4285EB109B15E4422B977A0FB84FB4F844A31DA5FA7796EF3CE944C740

Function 00007FF6139C49F0 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C4AD1
getsockname.WS2_32 ref: 00007FF6139C4CCA
WSAGetLastError.WS2_32 ref: 00007FF6139C4CD4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C520B

Strings

Failure sending PORT command: %s, xrefs: 00007FF6139C513C
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF6139C4E64
socket failure: %s, xrefs: 00007FF6139C4DCF, 00007FF6139C4FD6
getsockname() failed: %s, xrefs: 00007FF6139C4CEE, 00007FF6139C4EFE
,%d,%d, xrefs: 00007FF6139C50E9
failed to resolve the address provided to PORT: %s, xrefs: 00007FF6139C51F9
EPRT, xrefs: 00007FF6139C5182
%s |%d|%s|%hu|, xrefs: 00007FF6139C5199
Failure sending EPRT command: %s, xrefs: 00007FF6139C51BF
bind() failed, we ran out of ports!, xrefs: 00007FF6139C4EC6
bind(port=%hu) failed: %s, xrefs: 00007FF6139C4F35
PORT, xrefs: 00007FF6139C5112
%s %s, xrefs: 00007FF6139C5119

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: b97dba633d30b4d0c544a2ffe8f3c3dcebe4e1f558373a43b1b957c6b0dbfa42
Instruction ID: e0e23b5886035dc89be9e77dfb5311288d41d7dd3621a6772ea0ff9528407231
Opcode Fuzzy Hash: b97dba633d30b4d0c544a2ffe8f3c3dcebe4e1f558373a43b1b957c6b0dbfa42
Instruction Fuzzy Hash: 71229461B08F8281EB519B22D4522BE67A1FB85FA4F444831EA4FE7697FE3CE545C700

Function 00007FF6139D63F0 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6139D6436

Part of subcall function 00007FF613992640: GetLastError.KERNEL32 ref: 00007FF61399265C
Part of subcall function 00007FF613992640: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613992664

CreateFileA.KERNEL32 ref: 00007FF6139D6490
GetLastError.KERNEL32 ref: 00007FF6139D64A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D67DD

Strings

schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF6139D6765
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF6139D6716
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF6139D6735
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF6139D6781
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF6139D66E0
schannel: failed to open CA file '%s': %s, xrefs: 00007FF6139D64BB
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6139D65DE
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF6139D6502
-----END CERTIFICATE-----, xrefs: 00007FF6139D6609
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF6139D6539
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF6139D67B3
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF6139D6450
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF6139D67A2

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 919779ac502394a4df49bfc1684378c912bd20c5370d5fdb507a62585e4b15d8
Instruction ID: b9c2c82f166eb1020f9d4740c3a9fae00ea80724387612ca62c5b87059d2040c
Opcode Fuzzy Hash: 919779ac502394a4df49bfc1684378c912bd20c5370d5fdb507a62585e4b15d8
Instruction Fuzzy Hash: A6B1A465B08F4182E7109B5AE4026A967A1BF44FB4F800936DD8FA7BA6FF3CE544C740

Function 00007FF6139A3330 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6139A338A
memset.VCRUNTIME140 ref: 00007FF6139A339F
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A33BB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A33E2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3459
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A348C
strchr.VCRUNTIME140 ref: 00007FF6139A3576
strchr.VCRUNTIME140 ref: 00007FF6139A35BB
strchr.VCRUNTIME140 ref: 00007FF6139A35EB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3693

Part of subcall function 00007FF6139BBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBF68
Part of subcall function 00007FF6139BBF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBF8E
Part of subcall function 00007FF6139BBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBFAF
Part of subcall function 00007FF6139BBF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3766
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3795
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A37BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A37E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A37F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A39AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A39B3

Strings

_proxy, xrefs: 00007FF6139A36A9
Uses proxy env variable %s == '%s', xrefs: 00007FF6139A34EC, 00007FF6139A374A
NO_PROXY, xrefs: 00007FF6139A34CD
memory shortage, xrefs: 00007FF6139A3467
no_proxy, xrefs: 00007FF6139A34B1
all_proxy, xrefs: 00007FF6139A3719
ALL_PROXY, xrefs: 00007FF6139A3730
http_proxy, xrefs: 00007FF6139A36DD

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 85b546518fe974906508f346c34f15a72552962cb0c771cf6e189cb72353a543
Instruction ID: cc34f001d6b1f7162c896a1abeaf1dfcfaabaf6abca7ea4850089124df0aa0ce
Opcode Fuzzy Hash: 85b546518fe974906508f346c34f15a72552962cb0c771cf6e189cb72353a543
Instruction Fuzzy Hash: 4402B121A0DF8285EA51CB15A4863A97794BF85FA8F480935DE4FA77A6EF7CE404C700

Function 00007FF6139D15B0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1666
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1721
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D172F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1741

Strings

realm, xrefs: 00007FF6139D18C7
digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF6139D195B
WDigest, xrefs: 00007FF6139D15F1, 00007FF6139D1A25

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: 7071650c09dff2dad16001d1756b7afe7cc268e2c7eedb60c4a3bb5df4c44f15
Instruction ID: 924fd2e5ad4f81f624642ada5c0b6c7ca9a76978e7f17eccde8de80b244efce5
Opcode Fuzzy Hash: 7071650c09dff2dad16001d1756b7afe7cc268e2c7eedb60c4a3bb5df4c44f15
Instruction Fuzzy Hash: FE126C72A08F5286EB90CF25E4566A93BA4FB44FA4F440835DA8F97B96EF3CD445C700

Function 00007FF6139A7630 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6139A7702
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A771D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A775C

Strings

Bind to local port %hu failed, trying next, xrefs: 00007FF6139A7A10
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF6139A7928
bind failed with errno %d: %s, xrefs: 00007FF6139A7AE8
Couldn't bind to '%s', xrefs: 00007FF6139A77F2
Local port: %hu, xrefs: 00007FF6139A7B05
getsockname() failed with errno %d: %s, xrefs: 00007FF6139A7AAC
Local Interface %s is ip %s using address family %i, xrefs: 00007FF6139A7817
Couldn't bind to interface '%s', xrefs: 00007FF6139A78A0

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 3e5bc1e74b012f5f58e1374a4c72a9ebe9ef3efd138e2f1c7d373a212fd8c81f
Instruction ID: 537eecc6ea4381d1641cf9b0525623d3201f7cce774f34e50711eb5f59ff8e15
Opcode Fuzzy Hash: 3e5bc1e74b012f5f58e1374a4c72a9ebe9ef3efd138e2f1c7d373a212fd8c81f
Instruction Fuzzy Hash: F7E1A262E18B8285E7108B65D4422BD3760FB85FA8F405A36EA4FA7766FF7CD544C700

Function 00007FF61398973B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF613989F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A0BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A0FA

Strings

array, xrefs: 00007FF61398A17A
object, xrefs: 00007FF61398A309
number overflow parsing ', xrefs: 00007FF613989F80

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 24dbfc32c8dc895f344db0d517b328b1238d857ed911aa6ec1f707056b30ba47
Instruction ID: 2526d59a26313275a85158e084df8bdfaa753d7c6d267705523a8ed05127dc37
Opcode Fuzzy Hash: 24dbfc32c8dc895f344db0d517b328b1238d857ed911aa6ec1f707056b30ba47
Instruction Fuzzy Hash: 9932A762A18F8A85FF108B69D4453ED2361FB85BB4F404631DA5EA7ADAEF7CD085D300

Function 00007FF6139D0580 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF6139D0613
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139D063D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D0702
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D070E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D0772
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D077E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D0881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D088F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139D089A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D08EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D090E

Strings

default, xrefs: 00007FF6139D082D
password, xrefs: 00007FF6139D07B9
, xrefs: 00007FF6139D0651, 00007FF6139D0852
machine, xrefs: 00007FF6139D07D1, 00007FF6139D0812
login, xrefs: 00007FF6139D079E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 95c53613c4b75bead37d9737eb2d18ca3386db0ad298d740e1b388510a37e02d
Instruction ID: 765ac45a9dd4f99b15b9c555785c4950d6803e65dd04f6a4c5f820be1a027f19
Opcode Fuzzy Hash: 95c53613c4b75bead37d9737eb2d18ca3386db0ad298d740e1b388510a37e02d
Instruction Fuzzy Hash: 1BA1B621A0CF8285FA619F25A51337A6A90BF84FE4F480931DE4FA7796FE3DE4448700

Function 00007FF6139B7CC0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B7F3E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B7F46
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6139B7F5C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B7F65
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B7F6D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B7F77

Strings

GMT, xrefs: 00007FF6139B7E37
%02d:%02d%n, xrefs: 00007FF6139B7F1D
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF6139B7D7E
%02d:%02d:%02d%n, xrefs: 00007FF6139B7EE9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: d5ea2b37de5eb515f93575f2e8a4e345096032bb43ad1bb4d757d0c498c82414
Instruction ID: 7eeb6433dc5fbb2e211491eb502679d46d00323b6e2fafe353390ff101bd6a80
Opcode Fuzzy Hash: d5ea2b37de5eb515f93575f2e8a4e345096032bb43ad1bb4d757d0c498c82414
Instruction Fuzzy Hash: D2F1CA72F18A514AEB14CF64D4015BC37A1BF44BA8F548A35DE1FBB7D9EE38A8058740

Function 00007FF6139B9300 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6139B9340
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B935F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B9389
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B93A1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B93C6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B93F2
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B9402
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF6139B92C9), ref: 00007FF6139B9414

Strings

@, xrefs: 00007FF6139B9355

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction ID: 2a481e854a3c123998b87b4be26bb0804dcd95df181c89c4c51ad6584468607b
Opcode Fuzzy Hash: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction Fuzzy Hash: 26316D72618B8186E760CF12E845AAE7761FBC5FD1F048435DE8EA7A59DF3CD4458B00

Function 00007FF613992640 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF61399265C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613992664
FormatMessageA.KERNEL32 ref: 00007FF61399269E
strchr.VCRUNTIME140 ref: 00007FF6139926B3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139926FC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613992706
GetLastError.KERNEL32 ref: 00007FF61399270E
SetLastError.KERNEL32 ref: 00007FF61399271A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF6139926EA

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: 2a26dff799f40e172bf9d9a434e10a599cd41592b269adf14bd1a7543fbd748f
Instruction ID: 330d2d4adb7f33412d7235ee41c0d86452c7e96c32697b4afa6cf907e81c5580
Opcode Fuzzy Hash: 2a26dff799f40e172bf9d9a434e10a599cd41592b269adf14bd1a7543fbd748f
Instruction Fuzzy Hash: 57216662A08F4586EB116F26F80526E7AA0BF55FE0F084875DE8FA3756EE3CD4418710

Function 00007FF6139A0600 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF6139A0ECA
Can not multiplex, even if we wanted to!, xrefs: 00007FF6139A07BA
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF6139A0841
Could multiplex, but not asked to!, xrefs: 00007FF6139A079C
serially, xrefs: 00007FF6139A070E
Found bundle for host %s: %p [%s], xrefs: 00007FF6139A0719
can multiplex, xrefs: 00007FF6139A0702
Server doesn't support multiplex yet, wait, xrefs: 00007FF6139A074B
Multiplexed connection found!, xrefs: 00007FF6139A0E71
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF6139A0866
Server doesn't support multiplex (yet), xrefs: 00007FF6139A076F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 0379ac116aa3b89d2553a78560e2e6e0937a33831639c842719652bd6057e29d
Instruction ID: e92c9e9bf74974b091c7876093aeaeb9fe3f6eac92eff8d4df299dd13bfecf63
Opcode Fuzzy Hash: 0379ac116aa3b89d2553a78560e2e6e0937a33831639c842719652bd6057e29d
Instruction Fuzzy Hash: 4042CA62E0CBC245EBA58A2581513B937D1FB41F58F184A35CB5EA73A7FF2DA854D300

Function 00007FF6139BC5D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF6139BC5C8,?,?,?,?,?,?,00007FF6139D380E), ref: 00007FF6139BC646
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF6139BC5C8,?,?,?,?,?,?,00007FF6139D380E), ref: 00007FF6139BC7AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139BC90C

Strings

%c%c%c%c, xrefs: 00007FF6139BC703
%c%c%c=, xrefs: 00007FF6139BC741
%c%c==, xrefs: 00007FF6139BC773

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: d4663184589d98a712ad90b88dcd5440e845ddca40feda83b796be39e2ad880e
Instruction ID: 178791a95c9cb0aa486b4c991be6b58be8f39d440d4d0e0319dcf33eee8a6254
Opcode Fuzzy Hash: d4663184589d98a712ad90b88dcd5440e845ddca40feda83b796be39e2ad880e
Instruction Fuzzy Hash: F891FC72A0CAD185EB119B25A4417BE7B94EB45FB4F084631DA9E9B7DBEF3CD4018B00

Function 00007FF6139CB4F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CB56E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CB5CB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CB5F3
bind.WS2_32 ref: 00007FF6139CB672
WSAGetLastError.WS2_32 ref: 00007FF6139CB67C

Strings

bind() failed; %s, xrefs: 00007FF6139CB697

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 043503e0fdb1e12a905a901aa78c990b7d9c545350290c38aea68328abc36be4
Instruction ID: 8a0cc7bf945057f87217cf811cf1fbf1d3d284a7684479dc2b11127e0fed8c4c
Opcode Fuzzy Hash: 043503e0fdb1e12a905a901aa78c990b7d9c545350290c38aea68328abc36be4
Instruction Fuzzy Hash: B951C372A08B8186FB159B25D4563E837A0FB48FA4F044835CA4F8B396EF3DE456C740

Function 00007FF6139CB750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CB79F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CB7FC
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CB820
bind.WS2_32 ref: 00007FF6139CB89B
WSAGetLastError.WS2_32 ref: 00007FF6139CB8A5

Strings

bind() failed; %s, xrefs: 00007FF6139CB8C0

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 5e9d399451e69d20be855dd8e9b27b5fe3cdf2e55046a58bcd62b973cec69776
Instruction ID: b9b4e99eab8a4f87c336a7e0dd3eb39c5b64d4d3526daaa4c456ee07d1aeac1d
Opcode Fuzzy Hash: 5e9d399451e69d20be855dd8e9b27b5fe3cdf2e55046a58bcd62b973cec69776
Instruction Fuzzy Hash: 82518032A08F8686EB158B26D4523B977A0FB44FA4F044835CE4E9B796FF3CE4619701

Function 00007FF6139B53E0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%2I64d.%0I64dM, xrefs: 00007FF6139B5429
%4I64dT, xrefs: 00007FF6139B54F0
%4I64dP, xrefs: 00007FF6139B54FD
%2I64d.%0I64dG, xrefs: 00007FF6139B549A
%5I64d, xrefs: 00007FF6139B53F5
%4I64dG, xrefs: 00007FF6139B54D4
%4I64dk, xrefs: 00007FF6139B540E
%4I64dM, xrefs: 00007FF6139B547C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 1a402775ebe9d7af04e26a2663a3cff6c5ec690d9225f72786fb014b8e9cfb9a
Instruction ID: e251076b9bb351862c05ef02f159978e284cd1f980c7be1e2137993a5b10aafb
Opcode Fuzzy Hash: 1a402775ebe9d7af04e26a2663a3cff6c5ec690d9225f72786fb014b8e9cfb9a
Instruction Fuzzy Hash: 82219291E0DE4AC3FE14C796A412BF402225B45FB1F948D36E80FAA3D7FEAC6555C280

Function 00007FF6139B9230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6139B9261
CryptGenRandom.ADVAPI32 ref: 00007FF6139B9275
CryptReleaseContext.ADVAPI32 ref: 00007FF6139B9286
CryptReleaseContext.ADVAPI32 ref: 00007FF6139B929C

Strings

@, xrefs: 00007FF6139B9249

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction ID: 8e8dac3ac443673a243be5a1a0bd37b496788d45e7bf932bdba4bda9e0c54998
Opcode Fuzzy Hash: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction Fuzzy Hash: D5F08665B18A8182E710CB57F44536AA360FFC8BE6F444831DE8D97769EE7CC0858700

Function 00007FF6139A9840 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

(nil), xrefs: 00007FF6139AA0A6
.%ld, xrefs: 00007FF6139A9BA9
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF6139A9883, 00007FF6139A9D54, 00007FF6139A9DBB
%ld, xrefs: 00007FF6139A9B50
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF6139A9D5B, 00007FF6139A9DC6
(nil), xrefs: 00007FF6139AA024

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 5e1eafa53adae3ce6afb8c9d757bf206f60acaa71a792b37c3c2878a97f52238
Instruction ID: 0a8381962c9e8cf4e7d6a527b6dc6eff6d0ea3588deb82b1f553d39f933e9ae8
Opcode Fuzzy Hash: 5e1eafa53adae3ce6afb8c9d757bf206f60acaa71a792b37c3c2878a97f52238
Instruction Fuzzy Hash: 71420536E0CE8686F7604A19944637A77A1FB41FB4F544B30DA5FA76E6FE3CE8418600

Function 00007FF6139BC220 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF6139BC250
CryptGetHashParam.ADVAPI32 ref: 00007FF6139BC276
CryptDestroyHash.ADVAPI32 ref: 00007FF6139BC285
CryptReleaseContext.ADVAPI32 ref: 00007FF6139BC295

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction ID: dd7736d47a6e991da5d99c9d10b896b69c8ab9ab6ad5edb2e3b600ced107b8b1
Opcode Fuzzy Hash: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction Fuzzy Hash: E401B176608A81C2EB10CF62E44576AB330FB85FD9F148831DA8E46A69CF3CC448CB00

Function 00007FF6139BC1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF6139BC1DC
CryptCreateHash.ADVAPI32 ref: 00007FF6139BC1FD

Strings

@, xrefs: 00007FF6139BC1CC

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction ID: a4a3d6afc38d15a9576b41c4128456629ede22e5c05d46da0193542cc8578437
Opcode Fuzzy Hash: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction Fuzzy Hash: 2CE0D861B14A9283F7204B62E402B5A6350FB88F89F448430CE8D4BA19DF3CC1418F04

Function 00007FF6139C8B00 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6139C8B3B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139C8B6F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction ID: 9c5b74a00ef283272dff3e72876a01df3d48da3f5032585f88596f76ffc2ed8c
Opcode Fuzzy Hash: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction Fuzzy Hash: D4112E66A247D0CAD304CF36E5001AD3770FB5CB84F04962AFB8987B19EB78D690C744

Function 00007FF61398EB70 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF61398EC50

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction ID: 3837bd414a68aa1f253397bcb42e81fca30a3cd73c1aee16a136a694a48a0a1d
Opcode Fuzzy Hash: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction Fuzzy Hash: F681CE23B19B9989EB00CB69D0953AC37B0E794F98F584862CF4EA7796EF38D044D350

Function 00007FF61398D250 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction ID: 46778831541a00858b17a09d23dd4dc13fdfab65cae2befafe4656ed608bc09e
Opcode Fuzzy Hash: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction Fuzzy Hash: F1610572B09F8842DA10CB29E44567963A1FB99BE4F109A35DF5E97B89FF3CE1419300

Function 00007FF6139BC210 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction ID: b5eb34cdaf2b712133cd635003e007eb0ebd2680d972c2e22bd7820f2cda98b4
Opcode Fuzzy Hash: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction Fuzzy Hash: 4FA01261A05D458093008702E150D101250F78CB263004031C40D41411CD248081C200

Function 00007FF6139B9430 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 425stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6139B9463
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B94B3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B94D4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B94EA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B9508
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B9526
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B9544
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B955C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B9574

Strings

CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF6139B981F
CALG_RSA_KEYX, xrefs: 00007FF6139B95E5
CALG_AES_192, xrefs: 00007FF6139B992D
CALG_SSL3_MASTER, xrefs: 00007FF6139B97C5
CALG_HASH_REPLACE_OWF, xrefs: 00007FF6139B98F1
CALG_AES_256, xrefs: 00007FF6139B994B
CALG_DES, xrefs: 00007FF6139B9603
CALG_AGREEDKEY_ANY, xrefs: 00007FF6139B9711
CALG_MAC, xrefs: 00007FF6139B956D
CALG_MD5, xrefs: 00007FF6139B951F
CALG_DH_EPHEM, xrefs: 00007FF6139B96F3
CALG_RC4, xrefs: 00007FF6139B9699
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF6139B97E3
CALG_CYLINK_MEK, xrefs: 00007FF6139B9789
CALG_HMAC, xrefs: 00007FF6139B98B5
CALG_SSL3_SHAMD5, xrefs: 00007FF6139B97A7
CALG_TLS1PRF, xrefs: 00007FF6139B98D3
CALG_SSL2_MASTER, xrefs: 00007FF6139B985B
CALG_SEAL, xrefs: 00007FF6139B96B7
CALG_DSS_SIGN, xrefs: 00007FF6139B95A9
CALG_RC5, xrefs: 00007FF6139B9897
CALG_TEK, xrefs: 00007FF6139B976B
CALG_MD2, xrefs: 00007FF6139B94E3
CALG_ECDH, xrefs: 00007FF6139B99DE
CALG_DESX, xrefs: 00007FF6139B965D
CALG_RC2, xrefs: 00007FF6139B967B
CALG_3DES, xrefs: 00007FF6139B963F
CALG_SHA, xrefs: 00007FF6139B953D
CALG_SHA1, xrefs: 00007FF6139B9555
CALG_RSA_SIGN, xrefs: 00007FF6139B958B
CALG_AES_128, xrefs: 00007FF6139B990F
CALG_SKIPJACK, xrefs: 00007FF6139B974D
CALG_3DES_112, xrefs: 00007FF6139B9621
CALG_PCT1_MASTER, xrefs: 00007FF6139B983D
CALG_NO_SIGN, xrefs: 00007FF6139B95C7
CALG_SHA_512, xrefs: 00007FF6139B99C3
CALG_AES, xrefs: 00007FF6139B9969
CALG_TLS1_MASTER, xrefs: 00007FF6139B9879
CALG_ECDH_EPHEM, xrefs: 00007FF6139B9A2F
CALG_ECDSA, xrefs: 00007FF6139B9A14
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF6139B9801
CALG_HUGHES_MD5, xrefs: 00007FF6139B972F
CALG_DH_SF, xrefs: 00007FF6139B96D5
CALG_SHA_256, xrefs: 00007FF6139B9987
CALG_SHA_384, xrefs: 00007FF6139B99A5
CALG_MD4, xrefs: 00007FF6139B9501
CALG_ECMQV, xrefs: 00007FF6139B99F9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: a95fb3a32220d5d2373a41e2be5983f02937563951c6669e17548706725ee269
Instruction ID: 7bf01a1dee2c76bdb27fd09fc65bff15c2e83f4cc0b5bebe2d0071c89dce2f20
Opcode Fuzzy Hash: a95fb3a32220d5d2373a41e2be5983f02937563951c6669e17548706725ee269
Instruction Fuzzy Hash: 4812FB10B2CE5791FB509766D8429B922A5BF11B78F409832E90FFE69BFE2CE505C300

Function 00007FF6139A4A50 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139AD7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF61399582F), ref: 00007FF6139AD7C7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4BDD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4BF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4C91
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4CA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4CB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4CCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4CE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4CF5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D09

Part of subcall function 00007FF6139AEEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AEF1E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D45
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4DA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4DBD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4DD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4DE5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4DF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4E0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4E21

Part of subcall function 00007FF6139A28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2828), ref: 00007FF6139A28BB
Part of subcall function 00007FF6139A28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2828), ref: 00007FF6139A28E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4E4B

Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F061
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F071
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F07F
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F08D
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F09B
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0A9
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0B7
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4E77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4E8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4E9B

Strings

Closing connection %ld, xrefs: 00007FF6139A4B49

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: b9841c2d2f7e244eaf557c7957d55c27c61e3d7d63ad313c88b15d1e5c17b3dc
Instruction ID: 17c48cd44e32a239d3e879d4c5c878a2cab2b79073ba41658831f65e06a67904
Opcode Fuzzy Hash: b9841c2d2f7e244eaf557c7957d55c27c61e3d7d63ad313c88b15d1e5c17b3dc
Instruction Fuzzy Hash: C8C10235A18F9282E7409F21E8512EC3768FB85FA8F484631EE9F5B75ADF3891958310

Function 00007FF6139C0930 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C098E
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C09C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C0A41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C0A5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C0A6A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C0AB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C0AC8

Strings

SMTPUTF8, xrefs: 00007FF6139C0D1A
AUTH=, xrefs: 00007FF6139C0D25
%I64d, xrefs: 00007FF6139C0C7E
<%s>, xrefs: 00007FF6139C0A49, 00007FF6139C0B8D
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF6139C0D5C
Mime-Version, xrefs: 00007FF6139C0C09
SIZE=, xrefs: 00007FF6139C0D31
<%s@%s>, xrefs: 00007FF6139C0A26, 00007FF6139C0B6A
Mime-Version: 1.0, xrefs: 00007FF6139C0C24

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: b7ac18f558916f32379507697334559a0aacd794b5fde6b1c1b46c2a7d01ae62
Instruction ID: 4d5a3db6a9952a86bb18a747a0c0639aaa97e53d029f5efe7da9cffa97b93478
Opcode Fuzzy Hash: b7ac18f558916f32379507697334559a0aacd794b5fde6b1c1b46c2a7d01ae62
Instruction Fuzzy Hash: 39D15922E09F5281FB50CB2198166B927A4BF46FA8F484931DD4FA7796FE3CE549C300

Function 00007FF6139A25B0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A25CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A25E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A25F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A260B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A261F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2633
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2647
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A265B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A266F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2683
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A26AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A26BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A26D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A26E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A26FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A270F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2723
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2737
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A274B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A275F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2773
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A279B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A27AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A27C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A27D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A27EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A27FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2813

Part of subcall function 00007FF6139A28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2828), ref: 00007FF6139A28BB
Part of subcall function 00007FF6139A28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2828), ref: 00007FF6139A28E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A283D

Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F061
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F071
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F07F
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F08D
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F09B
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0A9
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0B7
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A2869
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A287D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A288D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1355b7a7184f64feaaccd16da42868722d35f25f5e110b8e10d39babc2a5a14d
Instruction ID: 7b4dedf94d0065ef88380f2a68be95f0a79033740de84c39b863c1b306627057
Opcode Fuzzy Hash: 1355b7a7184f64feaaccd16da42868722d35f25f5e110b8e10d39babc2a5a14d
Instruction Fuzzy Hash: CA71103561CF81C2D7809F21E8956BC37A8FB84FA9F480435DE8E9B7199F389199C321

Function 00007FF6139D2BB0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6139D2C99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2CE0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2F36
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D2F4D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2F68
htons.WS2_32 ref: 00007FF6139D2FC7

Strings

CNAME: %s, xrefs: 00007FF6139D2EC3
AAAA, xrefs: 00007FF6139D2D06
%s%02x%02x, xrefs: 00007FF6139D2E2E
bad error code, xrefs: 00007FF6139D2CF8
DOH: %s type %s for %s, xrefs: 00007FF6139D2D14
DOH AAAA: , xrefs: 00007FF6139D2DE2
TTL: %u seconds, xrefs: 00007FF6139D2D75
%s, xrefs: 00007FF6139D2E83
DOH Host name: %s, xrefs: 00007FF6139D2D61
DOH A: %u.%u.%u.%u, xrefs: 00007FF6139D2DAE
Could not DOH-resolve: %s, xrefs: 00007FF6139D2C06

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 56bba87fc7c51af6d924c74d1b1b2e1982686a9a0faedffc57aa1329a3a47c90
Instruction ID: 0072e7c0fc1eb07dd0ae2c2cd969ad39cc9f4877b7c2b3f403926e09d7058b60
Opcode Fuzzy Hash: 56bba87fc7c51af6d924c74d1b1b2e1982686a9a0faedffc57aa1329a3a47c90
Instruction Fuzzy Hash: 1EE18132B08A8686EB608F25E4423B977A4FB44FA4F444935DA8FA7756EF3CE544C700

Function 00007FF6139898E8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A0BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A0FA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398AAEE

Strings

array, xrefs: 00007FF61398A17A
object, xrefs: 00007FF61398A309
number overflow parsing ', xrefs: 00007FF613989F80

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: ad25c7a86437acde071c81594076c447ca3aaed47a1884f3f9ceb8d8117a9dab
Instruction ID: 637dd10df27d7a1e4313db94e0382e462e0dfc462e81bccfd05dbe08a93b0613
Opcode Fuzzy Hash: ad25c7a86437acde071c81594076c447ca3aaed47a1884f3f9ceb8d8117a9dab
Instruction Fuzzy Hash: C412B662A18F8585FF108B69D4463ED2361FB85BB4F504A31DA5EA2ADAEF7CD081D300

Function 00007FF6139CDB10 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDB96
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDBBC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDBCD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDC3B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDC6C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDC8C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDC9E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDD00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDD71
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDD88
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDE43
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDEB7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF6139CD2CF), ref: 00007FF6139CDEC0

Strings

onetree, xrefs: 00007FF6139CDDB6
subtree, xrefs: 00007FF6139CDE07
LDAP, xrefs: 00007FF6139CDB56
one, xrefs: 00007FF6139CDDA3
sub, xrefs: 00007FF6139CDDF4
base, xrefs: 00007FF6139CDDC9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: 0558161d3525c0c5b2a966061e87bab19ec401be3912131fe2ef438a4881e9cb
Instruction ID: 7d4ed50f4e6227988591afe93bc7e5004fc4dae5adb14fa2f5845be426869bda
Opcode Fuzzy Hash: 0558161d3525c0c5b2a966061e87bab19ec401be3912131fe2ef438a4881e9cb
Instruction Fuzzy Hash: 8BB18F26A09F8282FB519B1594522792790FF89FA0F488935DE4FA7B86FF3CE455C700

Function 00007FF6139CBCE0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF6139CBD41
memchr.VCRUNTIME140 ref: 00007FF6139CBD77
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6139CBDFB
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6139CBE8B

Strings

blksize is smaller than min supported, xrefs: 00007FF6139CBF0E
%s (%ld), xrefs: 00007FF6139CBE9B
%s (%d), xrefs: 00007FF6139CBF15, 00007FF6139CBF38
blksize, xrefs: 00007FF6139CBDDF
tsize, xrefs: 00007FF6139CBE6F
tsize parsed from OACK, xrefs: 00007FF6139CBE94
blksize is larger than max supported, xrefs: 00007FF6139CBF31
server requested blksize larger than allocated, xrefs: 00007FF6139CBEE8
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF6139CBF67
requested, xrefs: 00007FF6139CBE3A
%s (%d) %s (%d), xrefs: 00007FF6139CBE4D
Malformed ACK packet, rejecting, xrefs: 00007FF6139CBF7A
invalid blocksize value in OACK packet, xrefs: 00007FF6139CBF4E
got option=(%s) value=(%s), xrefs: 00007FF6139CBDBC
%s (%ld), xrefs: 00007FF6139CBEF2
blksize parsed from OACK, xrefs: 00007FF6139CBE33

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: 590790d0129b1d5c45be9896e4dc915168101e99f472bba4d13294d82c54f45f
Instruction ID: fdbf0c0f6856b864f8e12fb15eec3cb6e515e3daefda41522dff079dcf7fa755
Opcode Fuzzy Hash: 590790d0129b1d5c45be9896e4dc915168101e99f472bba4d13294d82c54f45f
Instruction Fuzzy Hash: 85619B61B0CE4685EA14AB66A4022B93250BF44FB0F804E31D96FA77E3EE3CE5459B00

Function 00007FF6139B4480 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B45F7

Strings

%s:%s, xrefs: 00007FF6139B4689
Proxy, xrefs: 00007FF6139B47A4
%s auth using %s with user '%s', xrefs: 00007FF6139B4796
Negotiate, xrefs: 00007FF6139B44BA
Proxy-, xrefs: 00007FF6139B4706
CONNECT, xrefs: 00007FF6139B448E
Authorization:, xrefs: 00007FF6139B45D1
Proxy-authorization, xrefs: 00007FF6139B4563
Server, xrefs: 00007FF6139B478C
Basic, xrefs: 00007FF6139B4757
Authorization: Bearer %s, xrefs: 00007FF6139B4600
Digest, xrefs: 00007FF6139B44FE
%sAuthorization: Basic %s, xrefs: 00007FF6139B4710
NTLM, xrefs: 00007FF6139B44DC
Bearer, xrefs: 00007FF6139B45F0
Authorization, xrefs: 00007FF6139B463A

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: 9d864d28d9e300f388af087b7d8b9fd2095f76582643c860ef49b6a4ced9ffbd
Instruction ID: efeafa899cd1e70ca755a2a0184f33135491ee42a2a8f139e580df1d5fbc3558
Opcode Fuzzy Hash: 9d864d28d9e300f388af087b7d8b9fd2095f76582643c860ef49b6a4ced9ffbd
Instruction Fuzzy Hash: B3917E21E0CF9292FA608B1594427B92794AB41FB4F048935DA4EBB79BFF3CE855D340

Function 00007FF613986310 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613984310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341

memcpy.VCRUNTIME140 ref: 00007FF613986486
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF613986518
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF613986559
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139866A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139866E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613986730
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613986771
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139867CE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613986888

Part of subcall function 00007FF6139DF1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6139843EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF6139DF20A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139868C9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613986996
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139869D7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6139869FA

Strings

; expected , xrefs: 00007FF613986920
; last read: ', xrefs: 00007FF6139865DC
unexpected , xrefs: 00007FF613986813
rsing , xrefs: 00007FF613986468
syntax error , xrefs: 00007FF61398635D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 4e1204277121835ebe4e06a958129741cbb2a0c4066216bae6c9bb7d253b311e
Instruction ID: e58db78605736d2eb51988511ce0a8f1a09b03448ce93bf0b58760927186694f
Opcode Fuzzy Hash: 4e1204277121835ebe4e06a958129741cbb2a0c4066216bae6c9bb7d253b311e
Instruction Fuzzy Hash: 4212C562E08F4581FB109B65E44636D2761EB84BF8F004B35DB6EA76DAEE7CE484D340

Function 00007FF613999A20 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61399A970: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF61399A3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9), ref: 00007FF61399A993
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A9E9
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A9F3
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A9FD
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA07
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA11
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA1B
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA25
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA2F
Part of subcall function 00007FF61399A970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA38

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999B17
strchr.VCRUNTIME140 ref: 00007FF613999B31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999B5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999B68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999B92
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999BA6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999BB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999BCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999BDA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999BE8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999C03
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999C1F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999C3B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999C57
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999C73
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999C8F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999CAB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999CC3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999D5B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF613999D92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999DD3

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: be88be890d69c48f3ab97c3fa41fe16f5b033f2fd1f21b873e75df2716961dc1
Instruction ID: a2549abe48ce3c2fcaa18af25de5ed9e5dac3a45f6289f965b4276ebd3ee8f39
Opcode Fuzzy Hash: be88be890d69c48f3ab97c3fa41fe16f5b033f2fd1f21b873e75df2716961dc1
Instruction Fuzzy Hash: 56B14B22A0AF434AFF558F2695522792B94AF45FB4F080935DE5FA6782EF3CE494C310

Function 00007FF6139CE240 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CE250
strstr.VCRUNTIME140 ref: 00007FF6139CE27F
strchr.VCRUNTIME140 ref: 00007FF6139CE2AB
strrchr.VCRUNTIME140 ref: 00007FF6139CE2C5
strchr.VCRUNTIME140 ref: 00007FF6139CE2DA
strrchr.VCRUNTIME140 ref: 00007FF6139CE33A

Strings

/, xrefs: 00007FF6139CE30E
?, xrefs: 00007FF6139CE2B8
/, xrefs: 00007FF6139CE353
., xrefs: 00007FF6139CE31A
/, xrefs: 00007FF6139CE295

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: 532677097c9836d2ba0a64a8e6dc7d0731298d3760ddfc5c2a40f58a8fc9dc2d
Instruction ID: fd977151db56ad02aa02febcdab703e5b14bd79fd2cf791d13755bf70c78178c
Opcode Fuzzy Hash: 532677097c9836d2ba0a64a8e6dc7d0731298d3760ddfc5c2a40f58a8fc9dc2d
Instruction Fuzzy Hash: 1C81AF12E0CB8246FB658B22950237A6A91AF45FA5F485835DE8FA73C7FE3CB445C310

Function 00007FF6139C9140 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6139C9213
strchr.VCRUNTIME140 ref: 00007FF6139C926A
strchr.VCRUNTIME140 ref: 00007FF6139C9282
strchr.VCRUNTIME140 ref: 00007FF6139C929D
strchr.VCRUNTIME140 ref: 00007FF6139C9319
strchr.VCRUNTIME140 ref: 00007FF6139C9331
strchr.VCRUNTIME140 ref: 00007FF6139C934C
strchr.VCRUNTIME140 ref: 00007FF6139C9367
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C93F4

Strings

CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF6139C924A
default, xrefs: 00007FF6139C92C3, 00007FF6139C938D
/MATCH:, xrefs: 00007FF6139C917A
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF6139C93D5
/DEFINE:, xrefs: 00007FF6139C91CB
Failed sending DICT request, xrefs: 00007FF6139C9401
/FIND:, xrefs: 00007FF6139C91B0
/LOOKUP:, xrefs: 00007FF6139C91FD
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF6139C92FA
lookup word is missing, xrefs: 00007FF6139C92B4, 00007FF6139C937E
/D:, xrefs: 00007FF6139C91E6
/M:, xrefs: 00007FF6139C9195

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 40fc0069801b7dfe2785114d83a4b2d6c3cc27889de5eff3aac2ff71acebb616
Instruction ID: acabaab188a750e042ad2bb38251da4b3135985687f1ad10ac255dec9897a645
Opcode Fuzzy Hash: 40fc0069801b7dfe2785114d83a4b2d6c3cc27889de5eff3aac2ff71acebb616
Instruction Fuzzy Hash: D3818B21A0DF8284FB519B1299522B96681BF45FE4F884931DD4FA7797FF2CE902C320

Function 00007FF6139A5170 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A518C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A51A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A51B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A51C3

Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F061
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F071
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F07F
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F08D
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F09B
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0A9
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0B7
Part of subcall function 00007FF61399F050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A2856), ref: 00007FF61399F0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A51FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5213
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5266
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A527A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A528E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A52A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A530A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A531E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5332
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5346
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A53AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A53EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A53FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5412
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5426
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A543A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A544E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5462
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5476
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5498

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction ID: 80ab52376150946a828d545a61553d1893b98a11c35f11a1dccff9becdc9c1b5
Opcode Fuzzy Hash: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction Fuzzy Hash: 6291D336618F9193E7898F31E9912AC7768F749F58F080135EF9E8B355DF34A2A58310

Function 00007FF6139AE5D0 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 310stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AE6C5
strchr.VCRUNTIME140 ref: 00007FF6139AE765
memcpy.VCRUNTIME140 ref: 00007FF6139AE795
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6139AE7C1
strchr.VCRUNTIME140 ref: 00007FF6139AE80C
memcpy.VCRUNTIME140 ref: 00007FF6139AE86B

Part of subcall function 00007FF61399AB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF61399AB64

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AE984

Strings

Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF6139AE667
%255[^:]:%d, xrefs: 00007FF6139AE651
@, xrefs: 00007FF6139AE856
Resolve address '%s' found illegal!, xrefs: 00007FF6139AE8EB
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF6139AEAAE
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF6139AE8FA
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF6139AEA0B
:%u, xrefs: 00007FF6139AE6D9, 00007FF6139AE998
], xrefs: 00007FF6139AE845
Added %s:%d:%s to DNS cache, xrefs: 00007FF6139AEA7D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: 955c7712c79ff587e7c603a986f10185c6f7a27a7aa30e803e5dd7570a33bcd5
Instruction ID: a4c1018bfb84cd3115802e539993559e87a59973c18aafd1b47c3b8d4bb58556
Opcode Fuzzy Hash: 955c7712c79ff587e7c603a986f10185c6f7a27a7aa30e803e5dd7570a33bcd5
Instruction Fuzzy Hash: 6AD18E22E19A8285FB619B25D4113F93760FB44FA8F444A31DA5FA7AE6EF3CE505C340

Function 00007FF6139A4240 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4562

Strings

socks5h, xrefs: 00007FF6139A42E2
http, xrefs: 00007FF6139A435E
https, xrefs: 00007FF6139A42C4
Unsupported proxy syntax in '%s', xrefs: 00007FF6139A454A
socks, xrefs: 00007FF6139A434A
socks5, xrefs: 00007FF6139A4300
socks4, xrefs: 00007FF6139A4336
Unsupported proxy scheme for '%s', xrefs: 00007FF6139A4371
socks4a, xrefs: 00007FF6139A431B
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF6139A43A4

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: a4b04b913e93c2f9c523f7cf3eae0e2690bd5702689a41c3ee2f1092c1171054
Instruction ID: 51451d722e02193faa1a011ace4c114f851e1aecd15fd0bac53c060f3652cbcc
Opcode Fuzzy Hash: a4b04b913e93c2f9c523f7cf3eae0e2690bd5702689a41c3ee2f1092c1171054
Instruction Fuzzy Hash: E9A15B22E18F5286FB50DB52D8425BD37A4AB44BA4F444A31DE4EB77A6EF3CE5448340

Function 00007FF61399A3A0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A403
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A47D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A4A1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A4F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A52A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A53C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A54F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A56A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A580
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399A589

Strings

%s.%s.tmp, xrefs: 00007FF61399A43A
## Fatal libcurl error, xrefs: 00007FF61399A5B7
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF61399A476
%s, xrefs: 00007FF61399A51B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 1f35a80a99e6fd3e0fec7f91074f21a35dd5555525d88da8c92026e8bc2dde98
Instruction ID: 3cf5295d2103068b71f55c3a2e66322923d4526df0a854c8a12f7fa98ce40f98
Opcode Fuzzy Hash: 1f35a80a99e6fd3e0fec7f91074f21a35dd5555525d88da8c92026e8bc2dde98
Instruction Fuzzy Hash: 01514051B0DE528AFE559F2698162B927A4FF45FE4F444830DD4FA6752FE3CE8458300

Function 00007FF613991D10 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF613991D38
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613991D40

Strings

SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF613992249
%s - %s, xrefs: 00007FF613992299
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF61399219C
No error, xrefs: 00007FF613992190
CRYPT_E_REVOKED, xrefs: 00007FF613992172
Unknown error, xrefs: 00007FF613992230
%s (0x%08X), xrefs: 00007FF613991D95

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 708f498282070d420d337acb99e452de26abb5abd9db17b713cf8609bfd7f0db
Instruction ID: 5f1e9c97656b224c9e8b4a914edabddb2645b59379a69509e99b86e7b001db73
Opcode Fuzzy Hash: 708f498282070d420d337acb99e452de26abb5abd9db17b713cf8609bfd7f0db
Instruction Fuzzy Hash: A251D362A0DF8689E7249F21E4423BE3794BB44F60F444975DA8F96696EF3CE504C710

Function 00007FF6139B6440 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4 connection to %s not supported, xrefs: 00007FF6139B670C
SOCKS4%s request granted., xrefs: 00007FF6139B6A06
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF6139B66AA
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF6139B672B
[, xrefs: 00007FF6139B69D4
Failed to send SOCKS4 connect request., xrefs: 00007FF6139B67ED
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF6139B689A
SOCKS4 communication to %s:%d, xrefs: 00007FF6139B651F
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF6139B6973
SOCKS4: too long host name, xrefs: 00007FF6139B6806
Too long SOCKS proxy name, can't use!, xrefs: 00007FF6139B6607
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF6139B69AD
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF6139B69E4
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF6139B6946
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF6139B65AB
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF6139B6506
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF6139B68E1

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: d8306cbf9e920900b8540f97aa77802167219f0d8489164594f42279dd235b6e
Instruction ID: 6055f00f4fe0d408668cf7646359919158503cb152d941fc3441359d66577e9b
Opcode Fuzzy Hash: d8306cbf9e920900b8540f97aa77802167219f0d8489164594f42279dd235b6e
Instruction Fuzzy Hash: E3E1B062A0CA818AEB548F1590417797B90FB45FB4F448936DA8FAB79AEF3CF444C740

Function 00007FF613985470 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139855CE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF6139855FC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398560A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613985644
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613985695
memset.VCRUNTIME140 ref: 00007FF6139854C3

Part of subcall function 00007FF613984310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341

Part of subcall function 00007FF613986310: memcpy.VCRUNTIME140 ref: 00007FF613986486

Part of subcall function 00007FF613981FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613985802
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398582E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398583C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613985877
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139858CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139859B1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6139859C9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6139859D6

Strings

value, xrefs: 00007FF613985536, 00007FF61398576E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 023b6053358200f424848e61aa4fa9e49c9a7dc309aec37bbb2a978c88a57a66
Instruction ID: 668391eb9f2dbc1fb26a20c288105912144f15adefc26ca28246d798a70fd657
Opcode Fuzzy Hash: 023b6053358200f424848e61aa4fa9e49c9a7dc309aec37bbb2a978c88a57a66
Instruction Fuzzy Hash: 8CF10B22A08F8585FB10DB75D4453AD6761FB85BB4F105631EAAE53AEAEF3CD085D300

Function 00007FF6139BB1E0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6139BB4C7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF6139BB537
CertFreeCertificateContext.CRYPT32 ref: 00007FF6139BB575
CertFreeCertificateContext.CRYPT32 ref: 00007FF6139BB588

Strings

schannel: failed to setup confidentiality, xrefs: 00007FF6139BB272
schannel: failed to retrieve remote cert context, xrefs: 00007FF6139BB5A7
ALPN, server did not agree to a protocol, xrefs: 00007FF6139BB355
schannel: failed to setup sequence detection, xrefs: 00007FF6139BB23A
schannel: failed to setup replay detection, xrefs: 00007FF6139BB256
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF6139BB328
schannel: failed to setup memory allocation, xrefs: 00007FF6139BB291
schannel: failed to retrieve ALPN result, xrefs: 00007FF6139BB2FB
schannel: failed to setup stream orientation, xrefs: 00007FF6139BB2B0
schannel: failed to store credential handle, xrefs: 00007FF6139BB42C
http/1.1, xrefs: 00007FF6139BB33B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 003eef28260a4f8df0df00670386984386231f818a0537bbf2c3299004cc96c5
Instruction ID: 7aa94226e75034ad83f24bd3197565f0e68ec15b0160bef686a2e7143b77f0fe
Opcode Fuzzy Hash: 003eef28260a4f8df0df00670386984386231f818a0537bbf2c3299004cc96c5
Instruction Fuzzy Hash: 01B1A361A08E8285EB708B15D8127B92791FB84FA4F448931D94FEB7EAEF7CD845C700

Function 00007FF6139B1A00 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6139B1AB8
strchr.VCRUNTIME140 ref: 00007FF6139B1ACF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B1B1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B1CE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B1D36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B1D3F

Strings

Content-Type:, xrefs: 00007FF6139B1BBF, 00007FF6139B1BE5
Host:, xrefs: 00007FF6139B1B99
Cookie:, xrefs: 00007FF6139B1C8B
Authorization:, xrefs: 00007FF6139B1C71
1.1, xrefs: 00007FF6139B1A1B
Content-Length:, xrefs: 00007FF6139B1C0B
%s, xrefs: 00007FF6139B1CCC
Connection:, xrefs: 00007FF6139B1C31
Transfer-Encoding:, xrefs: 00007FF6139B1C58

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 7e1ad2abd64872e1a6c8b3d4c2903b2d40eb7b32a9edbe3065d4335cf41a8063
Instruction ID: cd36cf7683ac323eb3e4be1448e5eb745579e2af267a7f617c1153175b86f226
Opcode Fuzzy Hash: 7e1ad2abd64872e1a6c8b3d4c2903b2d40eb7b32a9edbe3065d4335cf41a8063
Instruction Fuzzy Hash: 1D918061A0CE9385FB618B129446BB96790BF41FE4F448831DA4FEB69FFE2DE5458300

Function 00007FF61399F4D0 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399F534
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399F568
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F64F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F65C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F6A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399F71F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399F740
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399F761
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399F782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F819
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399F822

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction ID: 3fc232ab439a080190ee6cb70fb69c0bbe2e3af72d240b4a8e50c78308e3adad
Opcode Fuzzy Hash: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction Fuzzy Hash: 16B16C32A0AF418BEB658F25E44127977A4FB44B65F480935DB8F97B51EF3CE0688300

Function 00007FF6139D7C01 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D7C32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D82AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D82E8

Strings

TRUE, xrefs: 00007FF6139D7C24
-----BEGIN CERTIFICATE-----, xrefs: 00007FF6139D818C
FALSE, xrefs: 00007FF6139D7C1D
Signature, xrefs: 00007FF6139D80CF
-----END CERTIFICATE-----, xrefs: 00007FF6139D8237
%s, xrefs: 00007FF6139D82D6
Signature: %s, xrefs: 00007FF6139D80E7
Cert, xrefs: 00007FF6139D82BE

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 855c74e2298b12dfae87e416f71bfb0fd242813ebbe9111dfcebbe4282bd71ec
Instruction ID: 907f0a7665592b86385644e979203eab1a78cfa05bb9e45a9d4c22b59a7662aa
Opcode Fuzzy Hash: 855c74e2298b12dfae87e416f71bfb0fd242813ebbe9111dfcebbe4282bd71ec
Instruction Fuzzy Hash: DC71B856E0DFC185EB118B2994072BA7FA0EB45F94F584832CA4FAB353EE2DD149C301

Function 00007FF6139D1C70 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1D32
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1D6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1DBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1E72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1E7B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1E86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1F71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1F85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D1FFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D200F

Part of subcall function 00007FF6139D2400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139D42EA,?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D2410
Part of subcall function 00007FF6139D2400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139D42EA,?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D2421
Part of subcall function 00007FF6139D2400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139D42EA,?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D2433

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF6139D201C
WDigest, xrefs: 00007FF6139D1D1C, 00007FF6139D1E34

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: 59aae337aff638c80ea522d502be7416802ba366a363efdf939df804e7f274dd
Instruction ID: b30226b2eded0ec0b3bafd9ec3a593903ce6129d169aa102ba470eddc9e9ff47
Opcode Fuzzy Hash: 59aae337aff638c80ea522d502be7416802ba366a363efdf939df804e7f274dd
Instruction Fuzzy Hash: F6B15072B08F5286EB508B65E8422AD7BA4FB48FA4F440435EE4EA7B59EF3CD545C700

Function 00007FF6139D89C0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8AD3

Strings

dsa, xrefs: 00007FF6139D8B35
rsaEncryption, xrefs: 00007FF6139D8A05
RSA Public Key (%lu bits), xrefs: 00007FF6139D8A8E
dsa(pub_key), xrefs: 00007FF6139D8BE2
dh(pub_key), xrefs: 00007FF6139D8C76
dsa(g), xrefs: 00007FF6139D8BCC
dh(p), xrefs: 00007FF6139D8C2F
dsa(q), xrefs: 00007FF6139D8B9C
dh(g), xrefs: 00007FF6139D8C60
RSA Public Key, xrefs: 00007FF6139D8ABF
rsa(e), xrefs: 00007FF6139D8B0B
dhpublicnumber, xrefs: 00007FF6139D8BF6
dsa(p), xrefs: 00007FF6139D8B6D
rsa(n), xrefs: 00007FF6139D8AE0
%lu, xrefs: 00007FF6139D8AA8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: ee4d974dc3b3459793741b3c071e06878cee760591840d70200e270625e77535
Instruction ID: 595c227a2efe1e6c25f5ce456a5435b92869eeb0362c1d9abfc36d4f9eb611f1
Opcode Fuzzy Hash: ee4d974dc3b3459793741b3c071e06878cee760591840d70200e270625e77535
Instruction Fuzzy Hash: E6712C65A0CF4681EA10DB5294431FA6790FB89FA4F444932DE5EAB78BFF3CE605C640

Function 00007FF6139B88B0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF6139B8B66), ref: 00007FF6139B88CB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B88EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B890C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B8915

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction ID: b0d86548e41d3aa1cdeb3caa192d7005126b9edb3b2ba51d76df8373790b59e9
Opcode Fuzzy Hash: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction Fuzzy Hash: D3618C26A08F91C7EB25CF12A4459697BA4FB48FA0B498835DF4E9B755EF3CE484C300

Function 00007FF6139C19D0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C1AF0

Strings

control connection looks dead, xrefs: 00007FF6139C1CE2
partial download completed, closing connection, xrefs: 00007FF6139C1D23
Failure sending ABOR command: %s, xrefs: 00007FF6139C1C11
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF6139C1DC6
No data was received!, xrefs: 00007FF6139C1E2C
server did not report OK, got %d, xrefs: 00007FF6139C1D5E
Remembering we are in dir "%s", xrefs: 00007FF6139C1B88
ABOR, xrefs: 00007FF6139C1BEB
Received only partial file: %I64d bytes, xrefs: 00007FF6139C1DFE

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: a239f058e62c514e76706a9140ba831bcd74617e94364339e7ba736567eb66f4
Instruction ID: 6c2168eadecf2540a36bc87c5a5c69a20206c2f38a73d732ab9f7ecf1cbf1b5f
Opcode Fuzzy Hash: a239f058e62c514e76706a9140ba831bcd74617e94364339e7ba736567eb66f4
Instruction Fuzzy Hash: 2FD1D4A1A0CF8246FA649B2590523B97251FB45BB0F400A35DAAFE72D3FF3CE8548344

Function 00007FF61398A7A2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613984310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341

Part of subcall function 00007FF613986310: memcpy.VCRUNTIME140 ref: 00007FF613986486

Part of subcall function 00007FF613981FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A851
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A87F
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398A88D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A8C7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A924
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A9DD
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398AA0B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398AA19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398AA53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398AAA4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398AAEE

Strings

value, xrefs: 00007FF61398A7C0, 00007FF61398A949

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 318b2423f1fc7c9365d9dea7f80e65f750f29bf68608046753f263769fa03efc
Instruction ID: c5e1ac1be63de4b98a028c31611f1e355f9dfcb1e08a727145ae969605b7113e
Opcode Fuzzy Hash: 318b2423f1fc7c9365d9dea7f80e65f750f29bf68608046753f263769fa03efc
Instruction Fuzzy Hash: C3A19772A18F8585FB009B65E4463AD2361FB85BB4F101B31DA6E62EDAEF7CD081D700

Function 00007FF613992500 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF613992522
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61399252A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613992549
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613992555
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613992564
strrchr.VCRUNTIME140 ref: 00007FF6139925B5
strrchr.VCRUNTIME140 ref: 00007FF6139925D6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139925EF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139925FA
GetLastError.KERNEL32 ref: 00007FF613992603
SetLastError.KERNEL32 ref: 00007FF61399260F

Strings

Unknown error %d (%#x), xrefs: 00007FF613992597

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 7b9888dc63a3e7c9f678162156a496c77b2712124fc0888817af1d5cf78b4351
Instruction ID: e9288a876a6959128c38dc09440207d17b54943a247f573296085f090ac520a5
Opcode Fuzzy Hash: 7b9888dc63a3e7c9f678162156a496c77b2712124fc0888817af1d5cf78b4351
Instruction Fuzzy Hash: 3331B261A08B4689FB156F22E81227D6691BF84FA0F484875DE8FE7797FE3CE4418301

Function 00007FF6139D4930 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D49A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D49C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D49E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D49EF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D4A76
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D4AC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D4B26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D4CAC

Strings

CompleteAuthToken failed: %s, xrefs: 00007FF6139D4D07
HTTP, xrefs: 00007FF6139D4930
Negotiate, xrefs: 00007FF6139D4934, 00007FF6139D4A3C, 00007FF6139D4AE3
InitializeSecurityContext failed: %s, xrefs: 00007FF6139D4CCA
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF6139D4B76

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: f6aa1fc959be3f9f3a446533eda4e5d1b2324a14c444640e397b44d0ad8ee9cd
Instruction ID: 19b4328d5c75a6d49314d87ec322224eadb049590887b5bd7f7581cf2203b62e
Opcode Fuzzy Hash: f6aa1fc959be3f9f3a446533eda4e5d1b2324a14c444640e397b44d0ad8ee9cd
Instruction Fuzzy Hash: 95C15176A08F5186EB50CF65E4422AD3BA4FB44FA8F500836DE4EA7759EF38E845C740

Function 00007FF6139D6810 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D68C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6929
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D694C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D69AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6A1C

Strings

TRUE, xrefs: 00007FF6139D6A81
Version: %lu (0x%lx), xrefs: 00007FF6139D6A2E
Subject, xrefs: 00007FF6139D68FA
%lx, xrefs: 00007FF6139D69EC
Issuer, xrefs: 00007FF6139D6980
%2d Subject: %s, xrefs: 00007FF6139D6914
Issuer: %s, xrefs: 00007FF6139D699A
Version, xrefs: 00007FF6139D6A07

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: d66a8e2a531d88578f19dc84826a95064c5f9f86ba4d3b4d7cb9b6f8f2967699
Instruction ID: de90732a052e536ff82e4184a405da0dc058f870b2f1cfef3cff90a5e55e0757
Opcode Fuzzy Hash: d66a8e2a531d88578f19dc84826a95064c5f9f86ba4d3b4d7cb9b6f8f2967699
Instruction Fuzzy Hash: FF619162B08B8285EB118B21A4467FA27A1BB45BA4F844D35CD5FAB797FF3CE544C300

Function 00007FF6139C9D20 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6139C9D8B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C9EB5

Part of subcall function 00007FF613995730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF61399FD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF613991B61), ref: 00007FF613995757
Part of subcall function 00007FF613995730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF61399FD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF613991B61), ref: 00007FF613995763

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C9E6F

Part of subcall function 00007FF613995690: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139956A0

Strings

Unknown telnet option %s, xrefs: 00007FF6139C9FAD
USER,%s, xrefs: 00007FF6139C9DB0
XDISPLOC, xrefs: 00007FF6139C9E8B
%127[^= ]%*[ =]%255s, xrefs: 00007FF6139C9E30
Syntax error in telnet option: %s, xrefs: 00007FF6139C9FC6
TTYPE, xrefs: 00007FF6139C9E45
BINARY, xrefs: 00007FF6139C9F5E
NEW_ENV, xrefs: 00007FF6139C9ED1
%hu%*[xX]%hu, xrefs: 00007FF6139C9F39

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: 1fef72c7444546989d73c0875fbfa1f9dd609a4fb55574ababa5f96400690454
Instruction ID: c3de7c65aa1feb8b30d1fe436a2fda8e1cdcffcb282598253dcedf52251d1338
Opcode Fuzzy Hash: 1fef72c7444546989d73c0875fbfa1f9dd609a4fb55574ababa5f96400690454
Instruction Fuzzy Hash: 10717D32A0CEC695FB218F15D4427E96360FF84BA4F880532DA8EA725AFF38D555C750

Function 00007FF6139CC5A3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CC6A3

Strings

%s%c%s%c, xrefs: 00007FF6139CC6BA
%I64d, xrefs: 00007FF6139CC736
timeout, xrefs: 00007FF6139CC965
blksize, xrefs: 00007FF6139CC878
TFTP file name too long, xrefs: 00007FF6139CC68F
tsize, xrefs: 00007FF6139CC7B2
TFTP buffer too small for options, xrefs: 00007FF6139CC79F, 00007FF6139CC8E8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: 8bff296f59c387a8d797001e2b4b23bc00947aaa51299eb1c46842c7a3ab6500
Instruction ID: f86e8c69f0ab45cd79689f1ec271bdbbb3c2996f6f1af9a18ae666f7e3427b3d
Opcode Fuzzy Hash: 8bff296f59c387a8d797001e2b4b23bc00947aaa51299eb1c46842c7a3ab6500
Instruction Fuzzy Hash: 04D15E62A08AC295EF11CF24D0413B97BA1FB45FA8F849532CA4EA7796EF3CD546C710

Function 00007FF6139CA850 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF6139CAA4C
WSAGetLastError.WS2_32 ref: 00007FF6139CAA5E
send.WS2_32 ref: 00007FF6139CAB56
WSAGetLastError.WS2_32 ref: 00007FF6139CAB60

Strings

%c%s%c%s, xrefs: 00007FF6139CA9F0
%127[^,],%127s, xrefs: 00007FF6139CA9B8
%c%c%c%c, xrefs: 00007FF6139CA92D
%c%c, xrefs: 00007FF6139CAA28
Sending data failed (%d), xrefs: 00007FF6139CAA64, 00007FF6139CAB66
#, xrefs: 00007FF6139CAACE
%c%c%c%c%s%c%c, xrefs: 00007FF6139CAB2F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: 00404623e120793d597db3c352179d0aa63a3864e2c814257e5a1cf65cb6576d
Instruction ID: 9409fa99073e97e05c830ffc417986605c82abb7f809a6a4ae714b5f6cfab910
Opcode Fuzzy Hash: 00404623e120793d597db3c352179d0aa63a3864e2c814257e5a1cf65cb6576d
Instruction Fuzzy Hash: 8191CF32A08AC285F7218F15E4067EA67A1FB44BB8F480631EE8E57B96EF3CD145C740

Function 00007FF6139CC200 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF6139CC378
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139CC393
sendto.WS2_32 ref: 00007FF6139CC3FA
sendto.WS2_32 ref: 00007FF6139CC4B1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139CC4E9

Strings

tftp_rx: internal error, xrefs: 00007FF6139CC24E
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF6139CC4F1
Received last DATA packet block %d again., xrefs: 00007FF6139CC445
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF6139CC272

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 082182b0c608b5dd753e2c0b4bfb06eb638cf906bf23a4cf43ef42e9b11363e8
Instruction ID: 794562643c62833ee0688080aaecd92c124c4241aa79b03d3a4fe76c8a0dc6b4
Opcode Fuzzy Hash: 082182b0c608b5dd753e2c0b4bfb06eb638cf906bf23a4cf43ef42e9b11363e8
Instruction Fuzzy Hash: FF915D76608B81C5EB51CF29D4413A93BA0FB88F98F448532DA8E9B769EF39D506C710

Function 00007FF6139AB9D0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6139ABD66

Strings

Moving trailers state machine from initialized to sending., xrefs: 00007FF6139ABA11
%zx%s, xrefs: 00007FF6139ABC87
Signaling end of chunked upload after trailers., xrefs: 00007FF6139ABDB0
Read callback asked for PAUSE when not supported!, xrefs: 00007FF6139ABBC9
Unable to allocate trailing headers buffer !, xrefs: 00007FF6139ABA43
Successfully compiled trailers., xrefs: 00007FF6139ABAAA
operation aborted by trailing headers callback, xrefs: 00007FF6139ABB5D
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF6139ABCFA
read function returned funny value, xrefs: 00007FF6139ABC0B
operation aborted by callback, xrefs: 00007FF6139ABB3D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: 6c3bbffbfaa8afe039b59d5f2ad093e3cc1498ca40d8528e7d0893ab42bc7699
Instruction ID: 97dd536c307d00ad97a1dd12d97b6764366387b395240fc2ff8940a7de95cb64
Opcode Fuzzy Hash: 6c3bbffbfaa8afe039b59d5f2ad093e3cc1498ca40d8528e7d0893ab42bc7699
Instruction Fuzzy Hash: 6FA15072E08E8681E7509F2594423F93791EB85FA4F484A31DD4FAB2A6FE7CE4458310

Function 00007FF6139BD9E0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BDB10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BDB26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BDB89

Strings

Cannot APPEND with unknown input file size, xrefs: 00007FF6139BDC87
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF6139BD9F8
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF6139BDCBD
Mime-Version, xrefs: 00007FF6139BDC16
Cannot SELECT without a mailbox., xrefs: 00007FF6139BDB3F
SELECT %s, xrefs: 00007FF6139BDB75
Cannot APPEND without a mailbox., xrefs: 00007FF6139BDBB4
Mime-Version: 1.0, xrefs: 00007FF6139BDC31

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 2bc415dddcf2fbc5f9affb62417552fc3cfeb8ceedfac8cd1da88004e01584b9
Instruction ID: b23fdae6c0144a9b9ad9e722d97dc479eb33ab69a085ab54e7a2fc6738721ba4
Opcode Fuzzy Hash: 2bc415dddcf2fbc5f9affb62417552fc3cfeb8ceedfac8cd1da88004e01584b9
Instruction Fuzzy Hash: A8916121B0CF8286FB649F2594527B96290EF45FA4F448835DA4FAB68BFF6CE440C341

Function 00007FF6139A4590 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A5584
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A559A
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55AE
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55C2
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55D6
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55EA
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55FE
Part of subcall function 00007FF6139A5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A5612

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A4612

Part of subcall function 00007FF6139CE540: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE555
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE56F
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE58A
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5A6
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5C2
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5DA
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5F2
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE60A
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE622
Part of subcall function 00007FF6139CE540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE63A
Part of subcall function 00007FF6139CE540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE654

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A4816
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A4859
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6139A499E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A4A1B

Strings

file, xrefs: 00007FF6139A4903, 00007FF6139A497C
%s://%s, xrefs: 00007FF6139A461F
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF6139A475F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 2ca85521c9ecdf955f9429382aae5dedbdb67b063789061bcb64614b8007046f
Instruction ID: 8eb7c657bbbbe3547ad784ac58ad121f8e1019a8587d902935f8c285dbe5c5d4
Opcode Fuzzy Hash: 2ca85521c9ecdf955f9429382aae5dedbdb67b063789061bcb64614b8007046f
Instruction Fuzzy Hash: 87C17531F08E8286EB649A2595563F97690FB85B64F040A31CA1FFB7A6FF3CE5548340

Function 00007FF6139AE160 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AE1F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AE238
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AE2D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AE2EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AE30B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AE35A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139AE3AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AE3DF

Strings

:%u, xrefs: 00007FF6139AE36E
Shuffling %i addresses, xrefs: 00007FF6139AE1DA

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 1c6b2c5cffc96e1f2faa13328d5cbc488b8c058bf72ff2addcdcbf0fc35252f0
Instruction ID: 7b10817d9186142873a3f4e6bb84defec302dbb793b7acc05bc8782e402d4cf7
Opcode Fuzzy Hash: 1c6b2c5cffc96e1f2faa13328d5cbc488b8c058bf72ff2addcdcbf0fc35252f0
Instruction Fuzzy Hash: E4719C72E19E8282EB508B11E4557A977A4FB48FA8F444A31DE4F977A6EF3CE445C300

Function 00007FF6139DB680 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DBB4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DBBA3

Strings

XOAUTH2, xrefs: 00007FF6139DBA05
OAUTHBEARER, xrefs: 00007FF6139DB992
EXTERNAL, xrefs: 00007FF6139DB79B
LOGIN, xrefs: 00007FF6139DBAC3
GSSAPI, xrefs: 00007FF6139DB816
CRAM-MD5, xrefs: 00007FF6139DB8D2
PLAIN, xrefs: 00007FF6139DBA5A
DIGEST-MD5, xrefs: 00007FF6139DB8B3
NTLM, xrefs: 00007FF6139DB909

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: bcc6fd5a38e36d593fabfc2fa539815a04fff9fc478c505d022e484110f194b5
Instruction ID: 22a62c061b75d671db67f1ecd5b40b5014e0e298771128bcdbef99225bb8dbff
Opcode Fuzzy Hash: bcc6fd5a38e36d593fabfc2fa539815a04fff9fc478c505d022e484110f194b5
Instruction Fuzzy Hash: D5D17D72A09B8285EB60CF15E4427B977A0FB84B68F040936DE8E6779AEF3CD445C704

Function 00007FF6139BD6B0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139BC080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6139A340F), ref: 00007FF6139BC0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BD94E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BD958
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BD9B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BD9BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BD9CA

Strings

SECTION, xrefs: 00007FF6139BD8C8
PARTIAL, xrefs: 00007FF6139BD906
UID, xrefs: 00007FF6139BD846
MAILINDEX, xrefs: 00007FF6139BD887
UIDVALIDITY, xrefs: 00007FF6139BD805
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF6139BD6B8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 529f760526342dc532923641d4e7bfe965fc7578af4e37c6f5efba9c0881beb6
Instruction ID: 340023922128741dc29e717baa33446e1c858ee9a08d96479f74292ff4a606bc
Opcode Fuzzy Hash: 529f760526342dc532923641d4e7bfe965fc7578af4e37c6f5efba9c0881beb6
Instruction Fuzzy Hash: FFA18662909F8285EB518F25D445BB82B90FB44FA8F445831EE4FAB69BEF3DD494C301

Function 00007FF6139CF1F1 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF16F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF26D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF2D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF2EE

Part of subcall function 00007FF6139CE240: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CE250

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF316
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF32D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF39F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CF3B4

Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF4FC
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF506
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF510
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF51A
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF524
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF52E
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF538
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF542
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF54C
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF556
Part of subcall function 00007FF6139CF4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF560

Strings

,, xrefs: 00007FF6139CF234
:, xrefs: 00007FF6139CF217

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction ID: 708a8a770d96960d22d50beedd0768112b4c8d09fc94e57b2bf4dc818c0727e6
Opcode Fuzzy Hash: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction Fuzzy Hash: F1517012E1CF8643E7619B3595162B96750BB55FA8F04AA30DE8FA6647FF2CF1C88300

Function 00007FF61399C930 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF61399C977
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF61399C987
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399C99E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399CA1A
strrchr.VCRUNTIME140 ref: 00007FF61399CA37
strrchr.VCRUNTIME140 ref: 00007FF61399CA47
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399CA77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399CA83
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399CA92
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399CAA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399CAB9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 65c608ef1fe535978de831929790de7b27f3758338418f5053a35891be0bad24
Instruction ID: b44eb301c585202dcbab8a4613c60173655bd92c326fff6f0bff272f9de0c6e7
Opcode Fuzzy Hash: 65c608ef1fe535978de831929790de7b27f3758338418f5053a35891be0bad24
Instruction Fuzzy Hash: 0F415221B09F828AFF509F12A8522792694FF48FA0F484934DA4F97796FF3CE9558700

Function 00007FF6139CE540 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE555
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE56F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE58A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5DA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE5F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE60A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE622
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE63A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A45B5,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139CE654

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: b29704e7a7bafcfd67e48d247ff31038bc34b79da22b3b3364008b4691575eec
Instruction ID: 30a0552e493f80d9299662d498edd24f52c69e5d8a50d0cc717aae323d6fa9c9
Opcode Fuzzy Hash: b29704e7a7bafcfd67e48d247ff31038bc34b79da22b3b3364008b4691575eec
Instruction Fuzzy Hash: A1313A65F1AF0283EFA9DB56A15257826A4FF48F61B0C1834DA0F96742FF3CE4648360

Function 00007FF6139A1C60 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6139A1C98
strchr.VCRUNTIME140 ref: 00007FF6139A1CBF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1D74
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1DBB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1DCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1DD5
memcpy.VCRUNTIME140 ref: 00007FF6139A1DF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1E07
memcpy.VCRUNTIME140 ref: 00007FF6139A1E24
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1E39
memcpy.VCRUNTIME140 ref: 00007FF6139A1E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A1E66

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction ID: 78d083cf2741022ce24a408d0f59eda5aa2609f8e9c6a13879cb2f070a5a8025
Opcode Fuzzy Hash: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction Fuzzy Hash: BC519F66B09F8142EA658F16A50627A7695BF44FE4F484930DE4FAB766FF3CE4058300

Function 00007FF6139A3B80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF6139A3D09

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 97b97c4f9b03deb6ba4f315342eb381be36a29c9834092b213fdfb9fd5abec28
Instruction ID: ec8343198b0f8b62f83503d3e900814cb29beff34255935cd161e5ec7cd66d81
Opcode Fuzzy Hash: 97b97c4f9b03deb6ba4f315342eb381be36a29c9834092b213fdfb9fd5abec28
Instruction Fuzzy Hash: 22716022E08F8286E7658B25D4953B977A0FB44BA4F180A35DB4E977A2EF7DE454C300

Function 00007FF6139A3B29 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A3C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A3C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF6139A3D09

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 06bdd3633e5708c44053d2bde8a132e77b6d53fc0ee967ead5b8041a6449c34a
Instruction ID: 05097b5de168bf4de58712c35f22f5b8fec5d9aa24fd0b1f1794fbf91b9fb009
Opcode Fuzzy Hash: 06bdd3633e5708c44053d2bde8a132e77b6d53fc0ee967ead5b8041a6449c34a
Instruction Fuzzy Hash: 5461B223A0CF8286E7558B25D8953A97BA0FB44FA4F094935DB8E97362EF7CE455C300

Function 00007FF6139C4590 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 00007FF6139C45D0
Couldn't set desired mode, xrefs: 00007FF6139C45AE
NLST, xrefs: 00007FF6139C468B
%s%s%s, xrefs: 00007FF6139C46B5
LIST, xrefs: 00007FF6139C4692

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 467d5c9c31773df116a706cbdf672d776cac5ef44452e7be24205e671929127c
Instruction ID: 4bfd121dd9d4fbf423de8138b00e3022ef3025d1885e4d3b8b4951e0d3c6baa9
Opcode Fuzzy Hash: 467d5c9c31773df116a706cbdf672d776cac5ef44452e7be24205e671929127c
Instruction Fuzzy Hash: 0B41A122B08B9286FB219B5AE5421BD6360BF45FA0F844831DA4FB7657FF7CE9448700

Function 00007FF6139A84A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6139B450A), ref: 00007FF6139A851F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6139B450A), ref: 00007FF6139A8571
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6139B450A), ref: 00007FF6139A8595
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6139B450A), ref: 00007FF6139A85E5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF6139B450A), ref: 00007FF6139A8628

Strings

%sAuthorization: Digest %s, xrefs: 00007FF6139A8605
Proxy-, xrefs: 00007FF6139A85FB
Digest, xrefs: 00007FF6139A84AB
%.*s, xrefs: 00007FF6139A857E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: 991cca11e921deaf2fb3f742e1aed303678f25a5ce7169caec8dc6d57ca1d1d1
Instruction ID: c32b0caebba69ccbf44df2b06405e6ff1ffbf80ca3fd30c2dd096e10d6d4eeee
Opcode Fuzzy Hash: 991cca11e921deaf2fb3f742e1aed303678f25a5ce7169caec8dc6d57ca1d1d1
Instruction Fuzzy Hash: 63419122B0CF8582E6209F01E4453AA7BA4FB45F94F440935DE8E9B755EF3CD556C300

Function 00007FF6139D75CE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D7602
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

TRUE, xrefs: 00007FF6139D75F0
FALSE, xrefs: 00007FF6139D75F7
Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 9dc0b852f7038322631c9ff623631b1be7e00c642b1ca7ddf154faf074b028e8
Instruction ID: b75f5ac77ea7f700f3e77d847b46b04d0c32340e0da39a10f9410f6f63779eed
Opcode Fuzzy Hash: 9dc0b852f7038322631c9ff623631b1be7e00c642b1ca7ddf154faf074b028e8
Instruction Fuzzy Hash: 9D413D66B08F8245EB119B6594461FA2B65BB45FA8F480C35CE4FAB757FF3CE5448300

Function 00007FF6139C77B0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C7A08

Part of subcall function 00007FF6139A5840: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF6139B1655,?,?,00000000,00007FF6139B19B5), ref: 00007FF6139A5855
Part of subcall function 00007FF6139A5840: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF6139B1655,?,?,00000000,00007FF6139B19B5), ref: 00007FF6139A586B

memcpy.VCRUNTIME140 ref: 00007FF6139C7828
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C7979
memcpy.VCRUNTIME140 ref: 00007FF6139C7A42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C7A4E

Strings

Failed writing RTP data, xrefs: 00007FF6139C7943
Cannot pause RTP, xrefs: 00007FF6139C794C
Got an error writing an RTP packet, xrefs: 00007FF6139C795B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: f3879a8a08388b93ace09444e092abff1d8c4238582cb68e877fd15ded32fa93
Instruction ID: a7c5db3e51a239e5ee755e10a0535674ba492e3a0227ceb09fa63d0d2906fc3f
Opcode Fuzzy Hash: f3879a8a08388b93ace09444e092abff1d8c4238582cb68e877fd15ded32fa93
Instruction Fuzzy Hash: E9715F32B09F859AE658CB25D8413AD67A4FB49BA0F444835EF9E97755EF3CE460C300

Function 00007FF61399A970 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF61399A3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6139A10B9), ref: 00007FF61399A993
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A9E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A9F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A9FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399AA38

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction ID: 8745e25900fb199f6d70221e646cd2f3e12c0bf6cec86bb9f1390e4f45e586c7
Opcode Fuzzy Hash: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction Fuzzy Hash: F3216136A19F5186EB509F12E8415796B74FB48FA4F090831EE8F97716EE3CD885C340

Function 00007FF6139873F9 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF613987797
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF613987947

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 3ff7f47f9996d535c6382d0025158cafa12b24fe735b2f180ded5116634d41eb
Instruction ID: 6a8df083cb3146ca7a1284cec0b122833ef4f3f3b50e5ea98f4cbe461081bd4c
Opcode Fuzzy Hash: 3ff7f47f9996d535c6382d0025158cafa12b24fe735b2f180ded5116634d41eb
Instruction Fuzzy Hash: 6DB1B062908E89C1E7248F28D08127C3762FB95F68F644971C65F932DAEF3CE8A5D350

Function 00007FF6139DE240 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DE30A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DE358
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DE3BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DE4F9

Part of subcall function 00007FF6139D22A0: strchr.VCRUNTIME140(00000000,?,?,00007FF6139D185F), ref: 00007FF6139D22E6
Part of subcall function 00007FF6139D22A0: strchr.VCRUNTIME140(00000000,?,?,00007FF6139D185F), ref: 00007FF6139D22F6
Part of subcall function 00007FF6139D22A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF6139D185F), ref: 00007FF6139D2320
Part of subcall function 00007FF6139D22A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2355
Part of subcall function 00007FF6139D22A0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D237A
Part of subcall function 00007FF6139D22A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D239C

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139DE584

Strings

GSSAPI, xrefs: 00007FF6139DE243
Kerberos, xrefs: 00007FF6139DE2D3, 00007FF6139DE375
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF6139DE403

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 765f7b10c892f1fb1e6010970bd4640316ed08fb1ae60ff5c030ea6a027f76d4
Instruction ID: 7ee935f399b4cddcea8e4f947dda7f1077043fcd0b89be71be5229824fa19888
Opcode Fuzzy Hash: 765f7b10c892f1fb1e6010970bd4640316ed08fb1ae60ff5c030ea6a027f76d4
Instruction Fuzzy Hash: 8EA15D32A08F5586EB508F65E4422AD77A5FB48FA8F040835EE4EA7B59EF38E445C740

Function 00007FF6139991B5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139991FA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399921A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399926B

Part of subcall function 00007FF61399AA80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399AA86

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999371

Strings

Added, xrefs: 00007FF61399960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF613999617
Replaced, xrefs: 00007FF613999601
FALSE, xrefs: 00007FF61399934B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 328f28ee43acbe02e3b55e4857f65d3be118cca83605d292f44299386820e1f1
Instruction ID: 4b928952786892bcdf586d4d08d069d69ea635228cf95a1073b818dccee53b7a
Opcode Fuzzy Hash: 328f28ee43acbe02e3b55e4857f65d3be118cca83605d292f44299386820e1f1
Instruction Fuzzy Hash: 5F915221A0DF978EFF718F2690463B96794AF45F64F480835CA8F96693FE2CE4448350

Function 00007FF6139B24B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B257C

Strings

Authentication problem. Ignoring this., xrefs: 00007FF6139B26BD
Negotiate, xrefs: 00007FF6139B2526
Digest, xrefs: 00007FF6139B2614
NTLM, xrefs: 00007FF6139B25AC
Bearer, xrefs: 00007FF6139B2698
Ignoring duplicate digest auth header., xrefs: 00007FF6139B262D
Basic, xrefs: 00007FF6139B2671

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 2edee1d6d6b9369a94ec35f2711a8e3ce3417dfda42f4832661bacb91708de52
Instruction ID: e631dd88706a21717c648555532cd14924c352e2a7032aed03fd4a40ba0f4d18
Opcode Fuzzy Hash: 2edee1d6d6b9369a94ec35f2711a8e3ce3417dfda42f4832661bacb91708de52
Instruction Fuzzy Hash: C071E76190CB8286F7145612954367A7AD0FB01FA4F04C8B5DE9BEE6CBFF2CE4548701

Function 00007FF6139992C3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139992C6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999371

Strings

Added, xrefs: 00007FF61399960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF613999617
__Host-, xrefs: 00007FF6139992FD
Replaced, xrefs: 00007FF613999601
FALSE, xrefs: 00007FF61399934B
__Secure-, xrefs: 00007FF6139992E0

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 8bdde5ae7f6a45b5a7f26c8991cb0c6dd01dc0cbdf0c72bd889af76c7a23e672
Instruction ID: 6dc28a2e183e345f7c15217e8394accd2562fa12bab8edc43f7f2929e6f60376
Opcode Fuzzy Hash: 8bdde5ae7f6a45b5a7f26c8991cb0c6dd01dc0cbdf0c72bd889af76c7a23e672
Instruction Fuzzy Hash: 1D715E21A0DF938AFF718F2690463BA2794AF45F64F494835CA8F96693FF2DE4448350

Function 00007FF6139C06A0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C075F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C07A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C0860

Strings

SMTPUTF8, xrefs: 00007FF6139C070D, 00007FF6139C0815
EXPN, xrefs: 00007FF6139C06E7
HELP, xrefs: 00007FF6139C0895
%s %s%s, xrefs: 00007FF6139C0729
VRFY %s%s%s%s, xrefs: 00007FF6139C082E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: ec7dde51753d90db8e99e92e45708158327cfa7a3992d6b3b56b6418e18a2dea
Instruction ID: 27b8a401e5aa1c1ce6ed11ca859196988b1cfd9f51c6318c9ea2e966786851bc
Opcode Fuzzy Hash: ec7dde51753d90db8e99e92e45708158327cfa7a3992d6b3b56b6418e18a2dea
Instruction Fuzzy Hash: E8519262E08F8281EB15CB15E4117B967A0FB46FA4F844631DA8FA3796EF2DE544C340

Function 00007FF6139C6371 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF6139C6383
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C639E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C63CA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C63EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C64CC

Strings

Wildcard - Parsing started, xrefs: 00007FF6139C6467

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 7821651418ac284b7fe37018b700e1dd8bffd1ee22ba97486258aa5e4425af75
Instruction ID: fb37cd6b9caa5504b35849f1c3075adfe8d9213f094ffbd86474c8752ac08bbf
Opcode Fuzzy Hash: 7821651418ac284b7fe37018b700e1dd8bffd1ee22ba97486258aa5e4425af75
Instruction Fuzzy Hash: EA515732A08F8285EB55CF15E4421B836A5FB84FB4F494835CA8FAB392EF38E555C350

Function 00007FF6139D6A9C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D6AC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Strings

Signature Algorithm: %s, xrefs: 00007FF6139D7011
FALSE, xrefs: 00007FF6139D6AB8
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: 595424baaf0bc46a46dd7db77f120e4f57f80110cac3368c3dfe95d5b267a38e
Instruction ID: ac39276ef3fcbc35b91e7be6a73691b9a0c64d8eda81ddc2156b61f304b94590
Opcode Fuzzy Hash: 595424baaf0bc46a46dd7db77f120e4f57f80110cac3368c3dfe95d5b267a38e
Instruction Fuzzy Hash: A7418E62B08F8285EB118B6594461FA2B65BB05FA8F880C35DE4FAB757EF3CE1448300

Function 00007FF6139996A0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139996CD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139996F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF613999701
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399970B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF613999715
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399971F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF613999729
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF613999733
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF61399973D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF613999746
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6139A10B9,?,?,00000000,00007FF6139A15F5), ref: 00007FF613999761

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: dca2646a6d4bee659c796f93a2f38fa2669d1fcc608c2bf197bd4bbed9a2a8d6
Instruction ID: 5bb70ccfdd58e1bdd361185c8b7a0bdf06908b398a5b70c7a69a014266fede5e
Opcode Fuzzy Hash: dca2646a6d4bee659c796f93a2f38fa2669d1fcc608c2bf197bd4bbed9a2a8d6
Instruction Fuzzy Hash: 8121F836A18F5182DB509F22E8855686B74FB88FA0F480431EE8FA7725DE3CD889C300

Function 00007FF6139CF4F0 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF4FC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF506
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF510
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF51A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF524
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF52E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF538
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF542
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF54C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF556
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139CE522,?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CF560

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction ID: a047f219bfb41ef4a7a836ae910049db6e322bb93d4240fba66c29d235a38e53
Opcode Fuzzy Hash: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction Fuzzy Hash: 9A01B926728E11C3D7549F25DC554782B34FF88F65B581431DE4F9A225EE38D899C340

Function 00007FF6139CE8E0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CEA35
memcpy.VCRUNTIME140 ref: 00007FF6139CEA52

Strings

%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF6139CEC22
https, xrefs: 00007FF6139CE970
file, xrefs: 00007FF6139CE8FB
%%25%s], xrefs: 00007FF6139CEA62
file://%s%s%s, xrefs: 00007FF6139CE92E
%ld, xrefs: 00007FF6139CE99E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: 69b0ccfb545972a865a62a18da8bb8aafa5613a807871fdf383be4992c4471e4
Instruction ID: 4b53ef4f47895fa28026435d82e2d1dd62f9a87bc4709a4c09340cbfe581a666
Opcode Fuzzy Hash: 69b0ccfb545972a865a62a18da8bb8aafa5613a807871fdf383be4992c4471e4
Instruction Fuzzy Hash: 2EA17062E09F8285EA658F11A5423A973A4FB44FA5F044935DE8FA379AFF3CE440C700

Function 00007FF6139DA500 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6139DA5A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA5B9
memcpy.VCRUNTIME140 ref: 00007FF6139DA6F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA754
memcpy.VCRUNTIME140 ref: 00007FF6139DA771

Strings

response reading failed, xrefs: 00007FF6139DA791
cached response data too big to handle, xrefs: 00007FF6139DA7F1
8, xrefs: 00007FF6139DA7A3
Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF6139DA6D1

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: ac4d52a539b15f27428fc5d89cc48acd8341c1d8d3da493b39954d9423c2a7b7
Instruction ID: 94affb554dc9db49de4db44cc3977b4671624ab0cc851415c64de0d5c1626ee8
Opcode Fuzzy Hash: ac4d52a539b15f27428fc5d89cc48acd8341c1d8d3da493b39954d9423c2a7b7
Instruction Fuzzy Hash: 27818236A08F81C1EA548B26D4427AA67A4FB55FA4F444835DF8FA7742EF7CD4A1C340

Function 00007FF6139C7B10 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61399AB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF61399AB64

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C7C2D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C7C85
memcpy.VCRUNTIME140 ref: 00007FF6139C7CAA

Strings

Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF6139C7C3E
CSeq:, xrefs: 00007FF6139C7B2D
Session:, xrefs: 00007FF6139C7B9E
: %ld, xrefs: 00007FF6139C7B51
Got a blank Session ID, xrefs: 00007FF6139C7BD7
Unable to read the CSeq header: [%s], xrefs: 00007FF6139C7B82

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 6e76f70bd5b8103ca8f58d44c944ae791c305b292061b6a87a6ed5ada98c8c51
Instruction ID: d27c0a9a80212af90307dab084b58e0d7ef71ec3eef741a7e2c6642ad21ef39a
Opcode Fuzzy Hash: 6e76f70bd5b8103ca8f58d44c944ae791c305b292061b6a87a6ed5ada98c8c51
Instruction Fuzzy Hash: 4D418125A0CE8386EA508B2694422BD6790AF45FE4F444931EA9FE7397FF3CE905C710

Function 00007FF6139DBC20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DBCB8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DBD14
strchr.VCRUNTIME140 ref: 00007FF6139DBEFC
strchr.VCRUNTIME140 ref: 00007FF6139DBF6A

Strings

APM0123456789:, xrefs: 00007FF6139DBEF5
<DIR>, xrefs: 00007FF6139DBE40
0123456789-, xrefs: 00007FF6139DBF63

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: b87fbd036890b47f9b0cd1bab2e43e5707946047c1b405ef22310b67469fa962
Instruction ID: 85d7ce92110357a38b3dfe51bb1a8d6136be0780539f60d53b6d814bb43015de
Opcode Fuzzy Hash: b87fbd036890b47f9b0cd1bab2e43e5707946047c1b405ef22310b67469fa962
Instruction Fuzzy Hash: B6B14976A08B4686EB649F29D05333967A0FB44FA8F144839CA4F97796EF38E451CB40

Function 00007FF6139AD370 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AD3CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AD4CE
WSAIoctl.WS2_32 ref: 00007FF6139AD627
setsockopt.WS2_32 ref: 00007FF6139AD64F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AD746

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF6139AD4E0
We are completely uploaded and fine, xrefs: 00007FF6139AD6BA

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: ee81accd4b847cd42e6af56fc2334136a251d3c0f8ce0672d0cf2a3ae3100591
Instruction ID: a93fb9e810f8b240c8046d0d7f256c179f2ea1fe09c455a77e37a53c2016e752
Opcode Fuzzy Hash: ee81accd4b847cd42e6af56fc2334136a251d3c0f8ce0672d0cf2a3ae3100591
Instruction Fuzzy Hash: 8FB18232E08F8286EB659F25D0553F93790EB44F69F080635CE4E9A7AAEF3C9485C710

Function 00007FF61398AB70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398C26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398C29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398C2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398C2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398C333

Strings

value, xrefs: 00007FF61398C1D8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 8139019e80c5ec88f17aeb8915c878c5d1d47a621de3c7b0d0edb2625798ab54
Instruction ID: 37fd4c2c5545e2be10836b1c8cd7b646c4ffb90be9bf19d766983e49d25824db
Opcode Fuzzy Hash: 8139019e80c5ec88f17aeb8915c878c5d1d47a621de3c7b0d0edb2625798ab54
Instruction Fuzzy Hash: 7761B562A18F8585EB10CB75E4463ED6361FB85BB4F005731EA5EA6ADAEF38D081D700

Function 00007FF6139894D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398A9DD
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398AA0B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF61398AA19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398AA53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398AAA4

Strings

value, xrefs: 00007FF61398A949

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 595543e97e4f44316877afba9dfb2750bd3319d5226b2b7634a77da9004cd7a0
Instruction ID: 263a52fba9c3387e2a81c5320ac97d8e9d42c8e0545d2365a01622646db22a88
Opcode Fuzzy Hash: 595543e97e4f44316877afba9dfb2750bd3319d5226b2b7634a77da9004cd7a0
Instruction Fuzzy Hash: 4761A572A18E8585FB108B75E4463ED2361FB85BB4F105B31DA6E66ADAEF7CD081D300

Function 00007FF6139D97B5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D97F8
memcpy.VCRUNTIME140 ref: 00007FF6139D981D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D98EF
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

TRUE, xrefs: 00007FF6139D990D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: b52c7bb7d1c7cac77b7c8d046bf2007316f3759b90af48cd7ee6a67ced8cd261
Instruction ID: c37b6906467d83bc66641b899896e647d64d32b7ec57076e1e0faf8bd52992a7
Opcode Fuzzy Hash: b52c7bb7d1c7cac77b7c8d046bf2007316f3759b90af48cd7ee6a67ced8cd261
Instruction Fuzzy Hash: B6511711E0DA9245FB1A9B25815B3786F93EB11FB0F044A35C6AFE6AC7EE2D9445C300

Function 00007FF6139C6BC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF6139C6BF6
_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139C6C4B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF6139C6CBC
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139C6CC9
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139C6DDB

Strings

Can't get the size of %s, xrefs: 00007FF6139C6CD2
Can't open %s for writing, xrefs: 00007FF6139C6C5B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 13e5b1f758b492002390f4d21743b9d9be13eeb5f45215b79f59d9c128932a50
Instruction ID: 5530d95a2d893c9f423f87ec5fcf65fe34cbcc667444581c7343b9b1d1653366
Opcode Fuzzy Hash: 13e5b1f758b492002390f4d21743b9d9be13eeb5f45215b79f59d9c128932a50
Instruction Fuzzy Hash: 27517462B08E4681EA149B25D8127B96391FB84FF4F484935DA5FA7396FE3CF4458340

Function 00007FF6139CA6A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6139CA70C
htons.WS2_32 ref: 00007FF6139CA722
send.WS2_32 ref: 00007FF6139CA7C8
WSAGetLastError.WS2_32 ref: 00007FF6139CA7DC
send.WS2_32 ref: 00007FF6139CA81E
WSAGetLastError.WS2_32 ref: 00007FF6139CA828

Strings

Sending data failed (%d), xrefs: 00007FF6139CA7E2, 00007FF6139CA82E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: befb03195a2148d1b1ff0ac0ac481479d5c72445e3b291bc39e30fad092fb3ed
Instruction ID: 47ab98c2344e0c9478033e4452fbfcc01b8d9c23d83d5e2c03561d6ee547db5f
Opcode Fuzzy Hash: befb03195a2148d1b1ff0ac0ac481479d5c72445e3b291bc39e30fad092fb3ed
Instruction Fuzzy Hash: 2D41BF32A08E8685E7015F76D411AAC3730F754FA9F848932DB9A93756EF7CE456C301

Function 00007FF6139D76BE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D76C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: af7acaef84084e0d3a6a94bc248c2c0a1cef4ae4d46cb6da752fa977f64bedcd
Instruction ID: eaa5e5b9110eba3428f7978592cc2a052704fec0aab2f8bc68cd82a4929efe0a
Opcode Fuzzy Hash: af7acaef84084e0d3a6a94bc248c2c0a1cef4ae4d46cb6da752fa977f64bedcd
Instruction Fuzzy Hash: E2312865A08F8245EB159B6198470FA2BA5BF05FA8F480C35DE4FAB757FF3CA5488300

Function 00007FF6139D6B6E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D6B71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Signature Algorithm: %s, xrefs: 00007FF6139D7011
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: bbb5a7a9f1b646046fe03c8c4798a3fb899d3ca6497a6504817b76176552b82e
Instruction ID: 2109513d34bc074a350ecb8bfe0f6b7b9066c581e6db3d5d8c6917fd407e6727
Opcode Fuzzy Hash: bbb5a7a9f1b646046fe03c8c4798a3fb899d3ca6497a6504817b76176552b82e
Instruction Fuzzy Hash: 44314951E09F8245EB119B6594461FA2BA5BF05FA8F880C35DE0FAA797FF3CA5488300

Function 00007FF613981BA0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF613981D6A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613981E2D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613981E7B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613981EBB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613981F0A

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: ed39c7d1c51f3db297fe99c6e755470af78e6e1de6504059e5262683a49ffbc1
Instruction ID: c07f161c297f8f4740bbc5cda88ee349d463827ad52dd7608e23d91ee07a8776
Opcode Fuzzy Hash: ed39c7d1c51f3db297fe99c6e755470af78e6e1de6504059e5262683a49ffbc1
Instruction Fuzzy Hash: 0CB1B262B18F4685EB10CB65E4023AD2361EB84BB8F404A75DE6E67AD7EF3CD095D340

Function 00007FF6139D77BD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6139D78F1
Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7
GMT, xrefs: 00007FF6139D787E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: c6ae9fa0a038b8fac058063dacbcb7526f06a8394d406d1e43624cac3139f064
Instruction ID: 27799b27ccdf6106aa0459f69f105e7c16d2ce9144bcf7e7d9f1cd6b5907e3b5
Opcode Fuzzy Hash: c6ae9fa0a038b8fac058063dacbcb7526f06a8394d406d1e43624cac3139f064
Instruction Fuzzy Hash: 7A715A62E08BD244EB108F2595461FD6BA5BB05BA4F444C36DA8FAB756FF3CE545C300

Function 00007FF6139D6C5D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6139D6D81
Signature Algorithm: %s, xrefs: 00007FF6139D7011
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C
GMT, xrefs: 00007FF6139D6D0E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 83c56e755e620055c0fa3659b43fafff221207177ab0696b05b148a0a566e44a
Instruction ID: b6afb97f305cf561c66860c84ecb24cc79509682829c74e85a4dc6d8a54a8803
Opcode Fuzzy Hash: 83c56e755e620055c0fa3659b43fafff221207177ab0696b05b148a0a566e44a
Instruction Fuzzy Hash: 75618062E0CF9244EB108B2595461B96BA5BB05FA4F844835DA4FAA75BEF3CE544C340

Function 00007FF6139D76F4 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

GMT, xrefs: 00007FF6139D7756
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6139D77A9
Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 59f460ac5380dd79f6a867ac5ef20a454ae35efbab770c3c74f0f6e64463f9e0
Instruction ID: 53edafb0765af92a2c63831688d1217ad89088fe0af4415e830f2c3929cd41bb
Opcode Fuzzy Hash: 59f460ac5380dd79f6a867ac5ef20a454ae35efbab770c3c74f0f6e64463f9e0
Instruction Fuzzy Hash: 4E514E62A08F8284EB109F6594421ED6B65BB45FA8F884C35CA4FAB357FF3CE6448300

Function 00007FF6139D6B97 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Strings

GMT, xrefs: 00007FF6139D6BF6
Signature Algorithm: %s, xrefs: 00007FF6139D7011
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6139D6C49
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 718e0edb844c39f72f5a5453fececd066911b5f4b0fc70f80471252c26b35449
Instruction ID: 197fec0376d2c4eb84b9f6449a1efe15f27bac425650b670126bb6d3ea933b04
Opcode Fuzzy Hash: 718e0edb844c39f72f5a5453fececd066911b5f4b0fc70f80471252c26b35449
Instruction Fuzzy Hash: 1B512E62E0DF8284EB108B6594421F96BA5BB45FA4F884835DA4FAB757EF3CE544C340

Function 00007FF6139D7954 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D798F
memcpy.VCRUNTIME140 ref: 00007FF6139D79B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 2ceff9df3f33277577f0104260bbffde3566e5b22424af7c496f0e4332a6a445
Instruction ID: 6543eeaf735b44c30bc3225e18add0988f7707fbd1aa90b4a260071c0ac0fb9e
Opcode Fuzzy Hash: 2ceff9df3f33277577f0104260bbffde3566e5b22424af7c496f0e4332a6a445
Instruction Fuzzy Hash: 34418E65A08B8245EF159B6294061FD2BA6BF15FA8F480D35CD4FAB797FF3CA5048300

Function 00007FF6139C57B6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C57DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C5895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C58A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C58D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C594C

Strings

Entry path is '%s', xrefs: 00007FF6139C58AE, 00007FF6139C58E5
Failed to figure out path, xrefs: 00007FF6139C5952
SYST, xrefs: 00007FF6139C5876

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: 1cc48e0c41870337beabcd0a033c8b29a8aea442c7c760e77b31f6e6c80b91b2
Instruction ID: 1bf8b0f5f8d8f492d8cb7ea18d10f69c5764aba687e4ea9c6963ee72f6786b03
Opcode Fuzzy Hash: 1cc48e0c41870337beabcd0a033c8b29a8aea442c7c760e77b31f6e6c80b91b2
Instruction Fuzzy Hash: 11417471A0CFC6C2EB618B26E4422B86794BB45FA4F544831CE8FA7657EE3CD445C310

Function 00007FF6139BC930 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BC9FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA18
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA34
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA50
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BCA6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 725999a47900e04c1776c750a0a3892cffa72dc707c286e8c641b5765a13ecac
Instruction ID: 743c575ae5cd47e3bf7170c99563dba9822b41c9989a5dd7c647338d5cf64740
Opcode Fuzzy Hash: 725999a47900e04c1776c750a0a3892cffa72dc707c286e8c641b5765a13ecac
Instruction Fuzzy Hash: 48414632908F9282FB618F21D44167937A8FB49F64F448935DE8EA7359EF38D850C740

Function 00007FF613999870 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139998EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139998F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139998FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999912
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399991C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999926
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999930
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999939

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction ID: 6aa4521f9c914727a0210982be95090a74019989c1e611fdabe2a004c3c0bc6e
Opcode Fuzzy Hash: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction Fuzzy Hash: B6311E36A18F5186E7509F12E8156697B64FB88FE4F480431DE8EA7B59EF3CD845C700

Function 00007FF613999790 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139997D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139997E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139997EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139997F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139997FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999809
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999813
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399981D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613999826

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6a71efeabdaa36d73244b4352c5f5012b7b3ec64435facd515957462087f5632
Instruction ID: 8b2ca0ee2467ef36611bd66665eb4f343b382000203c51cd6c4ca3834db54a94
Opcode Fuzzy Hash: 6a71efeabdaa36d73244b4352c5f5012b7b3ec64435facd515957462087f5632
Instruction Fuzzy Hash: 0D21EA36618F5186D7509F22E8554697B78FB88FA4F480831DE8E97729DF3CD489C700

Function 00007FF6139D36A0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF6139D2AB3), ref: 00007FF6139D3748
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF6139D2AB3), ref: 00007FF6139D378A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF6139D2AB3), ref: 00007FF6139D382F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF6139D2AB3), ref: 00007FF6139D3842
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D3D27

Strings

%s?dns=%s, xrefs: 00007FF6139D3818
Failed to encode DOH packet [%d], xrefs: 00007FF6139D3881

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: a8182fd0dfdacbe33f9d3f9c7374c26c3e360a6d2655ff1bf9f5d1c61c0da78b
Instruction ID: b4426a4d3808661923a73d4a1da79daf11152e5751767ac17b65b9d0dcf60af2
Opcode Fuzzy Hash: a8182fd0dfdacbe33f9d3f9c7374c26c3e360a6d2655ff1bf9f5d1c61c0da78b
Instruction Fuzzy Hash: 2A02A452B08FC386F7119AA6D4877BA2795AF45FA8F444831DE0EE7787FE68D8448340

Function 00007FF6139B7900 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF61399A92A,?,?,?,?,?,?,?,00007FF61399A6F7), ref: 00007FF6139B7911
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6139B7AB3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6139B7AD0

Strings

TRUE, xrefs: 00007FF6139B7A3C
0123456789abcdef, xrefs: 00007FF6139B7AA2, 00007FF6139B7AAC
0123456789ABCDEF, xrefs: 00007FF6139B7AC2, 00007FF6139B7AC9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 6731cf7eb79fe99fc956e7da2918d2a85c4fd8fba441eb85d481e59dff622fac
Instruction ID: 9a64ba2fd963b2791cde84b02517ec8dcc91d6440f7428428b3bffcd0de733b4
Opcode Fuzzy Hash: 6731cf7eb79fe99fc956e7da2918d2a85c4fd8fba441eb85d481e59dff622fac
Instruction Fuzzy Hash: 31512612E0DBD741EE218B25A41257E7690AF45FA8F9C8A31DA4FAE74AFE3CD541C700

Function 00007FF61399917C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999182
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999371

Strings

Added, xrefs: 00007FF61399960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF613999617
Replaced, xrefs: 00007FF613999601
FALSE, xrefs: 00007FF61399934B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 90133f61e9f3a2972452251f6a672964b389b412b9e8e14f35b27df89e8546ac
Instruction ID: a8c1d324c3a3be7b2f000fc34131bf9e45f6d67299d469d415a9bc48b391cddf
Opcode Fuzzy Hash: 90133f61e9f3a2972452251f6a672964b389b412b9e8e14f35b27df89e8546ac
Instruction Fuzzy Hash: 33615121A09F938AFF718F2690463BA6794AF44F64F090835DA8F92693FF2DE4448350

Function 00007FF6139D962A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

TRUE, xrefs: 00007FF6139D990D
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6139D9751
GMT, xrefs: 00007FF6139D96DE

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 526dd6a61990846182b873f93f743bd90d9af5d28ecef45840b88224687b0280
Instruction ID: fbf8c51e5f72d4ed0a826e67c8b8a1736e16dc8bb34e0dba0bd2de270aff6a13
Opcode Fuzzy Hash: 526dd6a61990846182b873f93f743bd90d9af5d28ecef45840b88224687b0280
Instruction Fuzzy Hash: A8610861E0CE9644FB11AF2595072797BA6EB11FA4F944831C68FE2A96FF3CD941C300

Function 00007FF613999319 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF61399931C

Part of subcall function 00007FF6139B76F0: strchr.VCRUNTIME140 ref: 00007FF6139B7726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999371

Strings

Added, xrefs: 00007FF61399960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF613999617
Replaced, xrefs: 00007FF613999601
FALSE, xrefs: 00007FF61399934B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 62dffb43bf084e46f221ed9f2adcc8f6b7e67df89a3940d09ae168eab1eb17b1
Instruction ID: b8b7be36e436ec45f7a4c490c3353ce073c631944b639ebb1f8e0109254d0276
Opcode Fuzzy Hash: 62dffb43bf084e46f221ed9f2adcc8f6b7e67df89a3940d09ae168eab1eb17b1
Instruction Fuzzy Hash: B4615361A09B978AFF718F2590463BA6794EF44F64F090835DE8F92693FF2DE4448350

Function 00007FF6139C3400 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF6139C34C3

Strings

Maxdownload = %I64d, xrefs: 00007FF6139C355C, 00007FF6139C35FB
RETR response: %03d, xrefs: 00007FF6139C3458
Getting file with size: %I64d, xrefs: 00007FF6139C3575
Data conn was not available immediately, xrefs: 00007FF6139C35B7
, xrefs: 00007FF6139C3467
bytes, xrefs: 00007FF6139C34B9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 6e3d0a3c5aa691337795dccfca836fcde4962f08d3d7d525d14d9e7aa75dc6f1
Instruction ID: cc5de1e832b4aaf00f88a4a47cf909157bff119e5b5bb3bb87d1e1f7f9033dd6
Opcode Fuzzy Hash: 6e3d0a3c5aa691337795dccfca836fcde4962f08d3d7d525d14d9e7aa75dc6f1
Instruction Fuzzy Hash: 3751E762B08F8242FB259719A4862B87390FB45F74F440A31DA5F92AD3FF7CE5858700

Function 00007FF6139C02C0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C030A
memcpy.VCRUNTIME140 ref: 00007FF6139C0421
memcpy.VCRUNTIME140 ref: 00007FF6139C0492
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C04BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C04D0

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF6139C0320

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 983475b5252fee3b519ee8893d5ff2ec22a28cab796edf3ac853c7e78d6e9305
Instruction ID: 60c17c51544002dadaa7db461119dd6bce054a313ee7574a7aa5eb950b1f9905
Opcode Fuzzy Hash: 983475b5252fee3b519ee8893d5ff2ec22a28cab796edf3ac853c7e78d6e9305
Instruction Fuzzy Hash: E551A032618BC196EA258B65E4016EA7794FB49B94F440935DF8EA7752EF3CE164C300

Function 00007FF6139C31D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF6139C3376

Part of subcall function 00007FF6139DA500: memcpy.VCRUNTIME140 ref: 00007FF6139DA5A8
Part of subcall function 00007FF6139DA500: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA5B9

Strings

FTP response timeout, xrefs: 00007FF6139C33E3
QUOT string not accepted: %s, xrefs: 00007FF6139C339F
We got a 421 - timeout!, xrefs: 00007FF6139C33B5
FTP response aborted due to select/poll error: %d, xrefs: 00007FF6139C3384
*, xrefs: 00007FF6139C3344

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: fa97018fce896f81ca5d4429d1ceceda691d05f0cb1cad433c6317878a5e6d84
Instruction ID: d72eab64d6df6ed8de46d54f95e7724c1cf08e6b53b8080b71a6cc3ef3d32c24
Opcode Fuzzy Hash: fa97018fce896f81ca5d4429d1ceceda691d05f0cb1cad433c6317878a5e6d84
Instruction Fuzzy Hash: 1D518221B0CE8285FB649A1595823B92290BB45FA4F888935DE4FE76D7FF2CE945C300

Function 00007FF6139A8420 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2144
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D216A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2178

Strings

Digest, xrefs: 00007FF6139A8448
stale, xrefs: 00007FF6139D20CF
true, xrefs: 00007FF6139D20E4

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 29f2d144675f23a553318cadf2dbd3e2c172a0bf61d37d97765e181fdbbf1ba6
Instruction ID: 2c23bfb073f6062da46ff6a227162ce23e4e0fd9cb7ae9160dd94a564b44e18e
Opcode Fuzzy Hash: 29f2d144675f23a553318cadf2dbd3e2c172a0bf61d37d97765e181fdbbf1ba6
Instruction Fuzzy Hash: 20516121A0CE4286EB608B25E8523B977A0FF44FA4F484571DADE976D2FF2CE555C700

Function 00007FF613982370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613986DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6139823CB), ref: 00007FF613986E4E
Part of subcall function 00007FF613986DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6139823CB), ref: 00007FF613986E5C
Part of subcall function 00007FF613986DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF6139823CB), ref: 00007FF613986E72

Part of subcall function 00007FF613983BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF613981D8B), ref: 00007FF613983BF6

Part of subcall function 00007FF613985DD0: memcpy.VCRUNTIME140(?,?,?,00007FF613981DBA), ref: 00007FF613985E61

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982469
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139824A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139824F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982544

Strings

, column , xrefs: 00007FF6139823F9
at line , xrefs: 00007FF6139823BC

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: 57100d119804690e628be863f834d55bd5b6b334a7ff37d4b486aad42ae39a7f
Instruction ID: 263a33be92955d0171b33eb2b00096053eafcfc9f8584c3b48d69557b9370122
Opcode Fuzzy Hash: 57100d119804690e628be863f834d55bd5b6b334a7ff37d4b486aad42ae39a7f
Instruction Fuzzy Hash: F3517162F04F4585FB00DB75E4463AC2362EB84BB8F005675DA6E63BEAEE38D4959340

Function 00007FF613984A00 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984A93
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984AE7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984B0E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984B36
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984B83
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF61398314B,?,?,?,00007FF613983104), ref: 00007FF613984B90

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction ID: 8a23f3e9c78c221383757e0ba48bc1c2962500b78f452bf41e47e745b3414a18
Opcode Fuzzy Hash: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction Fuzzy Hash: B8517332608E4581EB208B1AD58227CA7A0FFC4FA5F15CA75CA5FA77A2DF3DD4469304

Function 00007FF6139D0B30 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6139B44C6), ref: 00007FF6139D0C8D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF6139B44C6), ref: 00007FF6139D0CA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D0CB5

Strings

%sAuthorization: Negotiate %s, xrefs: 00007FF6139D0C6E
Negotiate, xrefs: 00007FF6139D0B36, 00007FF6139D0C12
Proxy-, xrefs: 00007FF6139D0C5D
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF6139D0BE1

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: 41c08fb2ae54d73b9aad3b1fb28f7d5162b95befd8a93294c5f9c0ba9144d006
Instruction ID: fb550ce0af918a9d6de16f8a8887e03aee9483a1c836dec7fa8b48c12fd0b7d3
Opcode Fuzzy Hash: 41c08fb2ae54d73b9aad3b1fb28f7d5162b95befd8a93294c5f9c0ba9144d006
Instruction Fuzzy Hash: CF517F22A08B8296FB11CB25D4832B92B95FB41FA4F444831DA8EA7782EF3DE455C351

Function 00007FF6139CCB00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139CCB18
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139CCC81

Strings

gfff, xrefs: 00007FF6139CCBF8
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF6139CCC5C
gfff, xrefs: 00007FF6139CCB8C
Connection time-out, xrefs: 00007FF6139CCB3B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 5603a38b167ad5d39fbdc1c17dec4cf10488a2e3eb711140c002149bca51ea0d
Instruction ID: 35cae594aa7b6b1849a25081d67b0038296d122bfcc25e396ed3e582134d6254
Opcode Fuzzy Hash: 5603a38b167ad5d39fbdc1c17dec4cf10488a2e3eb711140c002149bca51ea0d
Instruction Fuzzy Hash: 67412D76B14A5682DB20CF2AE00156877A0F798F98F505831DE0DD7B55EE39E942CB40

Function 00007FF6139AC360 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139AC4AA

Strings

seek callback returned error %d, xrefs: 00007FF6139AC3FE
ioctl callback returned error %d, xrefs: 00007FF6139AC46F
necessary data rewind wasn't possible, xrefs: 00007FF6139AC4B5
the ioctl callback returned %d, xrefs: 00007FF6139AC455
Cannot rewind mime/post data, xrefs: 00007FF6139AC4E0

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 636c29a6ac46b64cd287b79ad26834ec061afeb8b3ebe0566f26f826e7c36bbb
Instruction ID: 32b002eddaf477a9795720c9bcf977066f0d52a0b31270ad4aa96addb2db5100
Opcode Fuzzy Hash: 636c29a6ac46b64cd287b79ad26834ec061afeb8b3ebe0566f26f826e7c36bbb
Instruction Fuzzy Hash: 8D413461F14E8181FB549F2A94463B92391EB85FA4F481531DE0FDF796EE2DD480C744

Function 00007FF6139D7610 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

%s%lx, xrefs: 00007FF6139D766D
Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: 0b765e0755920559e9d2752ae23419eff446ece7a23fa35f3ed63ae1d9cff77a
Instruction ID: f8f692cfcc58db9b5ae943db12a15ebe108f085e2dc66e60f02ac96d0556126b
Opcode Fuzzy Hash: 0b765e0755920559e9d2752ae23419eff446ece7a23fa35f3ed63ae1d9cff77a
Instruction Fuzzy Hash: A4414A62A08B9245EA109B6594471FE2BA5BB05FA8F844C35CE4FAB757FE3CE1488300

Function 00007FF6139D7D0E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C

Strings

GMT, xrefs: 00007FF6139D7D64
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6139D7DA4
Signature, xrefs: 00007FF6139D80CF
Signature: %s, xrefs: 00007FF6139D80E7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 2d839c62f561e1cb6da38a300fc64ca3975719bf1c477f748898bce26a61f6bd
Instruction ID: 48b86bb686c4e1181234c5d5e89cd180192ecd000b07d652eecef7ec8ff02064
Opcode Fuzzy Hash: 2d839c62f561e1cb6da38a300fc64ca3975719bf1c477f748898bce26a61f6bd
Instruction Fuzzy Hash: E0414F26A0CF8281EB108B15E4461EA67A5FB45FA4F584832DA4EAB75BEE3CE545C700

Function 00007FF6139D6AD1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Strings

Signature Algorithm: %s, xrefs: 00007FF6139D7011
%s%lx, xrefs: 00007FF6139D6B26
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 43aff7a05e90a007a98c231397dc463d57d0ef91e1f3fe74e4c719b20d4e5bc1
Instruction ID: 0d7a6353548d43bafc5ec4c6b8040e26f5301a7387cab0fb8b67c94da76aa248
Opcode Fuzzy Hash: 43aff7a05e90a007a98c231397dc463d57d0ef91e1f3fe74e4c719b20d4e5bc1
Instruction Fuzzy Hash: D6417B52B09F8244EE109B6694471F92BA1AB05FA4F884C35DE4FAB797FE3CE1488340

Function 00007FF6139D97BD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D97F8
memcpy.VCRUNTIME140 ref: 00007FF6139D981D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

TRUE, xrefs: 00007FF6139D990D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: 8ef32bb30e83b178644582b19e9688f8a4366afb6a486a2f55abccd6880cd497
Instruction ID: 9d53b75d3ead2faea8efcf3a65b7fb36c096daae4c7387da4c98b8167db5c438
Opcode Fuzzy Hash: 8ef32bb30e83b178644582b19e9688f8a4366afb6a486a2f55abccd6880cd497
Instruction Fuzzy Hash: 8431D311E0DE9245FB16DB2685473786B93AB15FB0F040E31C99FE6AC7EE2D9841C300

Function 00007FF6139D0430 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139BBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBF68
Part of subcall function 00007FF6139BBF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBF8E
Part of subcall function 00007FF6139BBF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBFAF
Part of subcall function 00007FF6139BBF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A04B9,?,?,?,?,00007FF61399F85B), ref: 00007FF6139BBFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D04CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D0518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D0521

Strings

HOME, xrefs: 00007FF6139D0469
%s%s_netrc, xrefs: 00007FF6139D04E4
%s%s.netrc, xrefs: 00007FF6139D048F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: ce33ce03b15b08335ee075b48f2ac132f7423bfbe585d713eb93ca792406d6ff
Instruction ID: fc05431279652c78fd1ae04d8baa8eccdc1e2722dae3ceec1bc7934b7f4cfbd3
Opcode Fuzzy Hash: ce33ce03b15b08335ee075b48f2ac132f7423bfbe585d713eb93ca792406d6ff
Instruction Fuzzy Hash: FB318462A0CF4182EA50DB17B8070AA76A4BF45FE4F484931ED8EA7756FF3CE4458700

Function 00007FF6139BE936 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61399AB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF61399AB64

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BE974
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139BE986

Strings

OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF6139BE958
Mailbox UIDVALIDITY has changed, xrefs: 00007FF6139BE9BE
Select failed, xrefs: 00007FF6139BEA18

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 3aaf3bd9c98613ab1b966e3da1ed5605299526585c756a4ca27d5f183527908c
Instruction ID: 691e0366417988bbe5197a0ff1bf238191d129297e89c8292fdc6ba618874874
Opcode Fuzzy Hash: 3aaf3bd9c98613ab1b966e3da1ed5605299526585c756a4ca27d5f183527908c
Instruction Fuzzy Hash: 29313221E0CE5281EA649B11A0525B93358FF44FB4F548832DA4FAB65BFF3CE855C341

Function 00007FF6139D7CE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D7CE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Signature, xrefs: 00007FF6139D80CF
Signature: %s, xrefs: 00007FF6139D80E7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: e1078ee6254317aa7f302fe12d14b7c1b0a0c2898ed5fbaf491c85de4fe40530
Instruction ID: 47a4d8ab1ab9f17cb5b37d59c2d85a12332f4a66f77eb2167fa65dd82d0458e5
Opcode Fuzzy Hash: e1078ee6254317aa7f302fe12d14b7c1b0a0c2898ed5fbaf491c85de4fe40530
Instruction Fuzzy Hash: 2A212166B0CF8242EA508B15A4466EA6764BB85FA4F440832DE4F6B717EE3CD1458700

Function 00007FF6139A5640 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139A5675
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139A56A1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139A56A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139A56CB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6139A29BC), ref: 00007FF6139A56E2

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF6139A56B4

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: c0c8fcb44667ca2c8fe23aa92df2b9262a7bcb97f9c91f97d65f5fb040fd2184
Instruction ID: f11c6bbad2b037b7b7400586fd7c313a45957085ddc47f01a6f8978e7acedb14
Opcode Fuzzy Hash: c0c8fcb44667ca2c8fe23aa92df2b9262a7bcb97f9c91f97d65f5fb040fd2184
Instruction Fuzzy Hash: F0116362F0DE4282EB50AB21D4416B93760FF85F68F584931DA5FA7666EF2DD884C700

Function 00007FF6139A5570 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A5584
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A559A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55AE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55C2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55D6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A55FE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139A5612

Part of subcall function 00007FF6139CE510: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A562B,?,?,00000000,00007FF6139A1073,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139CE525

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction ID: cac5f20e5cdbfda1ec24346c6ece3383c1937cae0d5296887ce8f3aa35392051
Opcode Fuzzy Hash: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction Fuzzy Hash: A2119736618F81C2D7409F21ED954EC37A8FBC9FEAB580435EE4F8F655AF3480958210

Function 00007FF61399A7B0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A7F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399A803

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 76e9e92d93f0c8c719248e6433bf710fa477ed7a141f7287600a96dac61d5d71
Instruction ID: a6a2c1b343cdd1a27cdfda8f827cedb1a4eebbc8f55be531e50e5a095b7fd0f3
Opcode Fuzzy Hash: 76e9e92d93f0c8c719248e6433bf710fa477ed7a141f7287600a96dac61d5d71
Instruction Fuzzy Hash: 59F0F726B28E1183D7549F22EC564782B34FB88F65B581431DD4F9A225DE3CD899C340

Function 00007FF6139D73DC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D741F
memcpy.VCRUNTIME140 ref: 00007FF6139D7445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7589

Strings

Start Date: %s, xrefs: 00007FF6139D7577
Start Date, xrefs: 00007FF6139D755D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: 320c2bfa95c58a3e1609ac9c22957941cfe5e410ed8167142616c93d932a3e4d
Instruction ID: 4418cce8f6f0648c49ebc5945170c5ed0d13638d934cdde0960799c2e7abac38
Opcode Fuzzy Hash: 320c2bfa95c58a3e1609ac9c22957941cfe5e410ed8167142616c93d932a3e4d
Instruction Fuzzy Hash: ED412551A09AD206EB198B1584172BD2B52EB15FB4F484E35CA6FAB7D7FE3CE0498301

Function 00007FF61398C600 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF61398C6EA
memcpy.VCRUNTIME140 ref: 00007FF61398C6F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF61398C72D
memcpy.VCRUNTIME140 ref: 00007FF61398C734
memcpy.VCRUNTIME140 ref: 00007FF61398C743
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF61398C768

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 56b14bdc5f89045d4f7b2da786287d42a27f2024155c1ece33cbbf5de22e5f5c
Instruction ID: c503f205d21490eef0689af614b65c90d58fd3e4dc24f95e489ba2457cb34262
Opcode Fuzzy Hash: 56b14bdc5f89045d4f7b2da786287d42a27f2024155c1ece33cbbf5de22e5f5c
Instruction Fuzzy Hash: 5B31F062709F8A80EE14AB16A5022A9A255FB84FF0F440E31DE6F977D6EF3CE041D300

Function 00007FF6139A8800 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF6139A88E5
VerSetConditionMask.KERNEL32 ref: 00007FF6139A88F4
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8906
VerSetConditionMask.KERNEL32 ref: 00007FF6139A8918
VerSetConditionMask.KERNEL32 ref: 00007FF6139A892E
VerifyVersionInfoA.KERNEL32 ref: 00007FF6139A8941

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: b6c6db3b816de679375f91f2878e76babe7d6183a69cc8df1fcf61702d0bf89d
Instruction ID: 033268eb3d0018b0cff202ebf5cbcf75251a2742d5a566f1e6986feb27bc292d
Opcode Fuzzy Hash: b6c6db3b816de679375f91f2878e76babe7d6183a69cc8df1fcf61702d0bf89d
Instruction Fuzzy Hash: 2F410922E1CB8286F2708B16E4157BA7B50FBD5B10F015639D9DE56B56EF3DE4848B00

Function 00007FF6139D790F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: a7dcf3b872bca8685f5961ceb99f1390aa710949134b2c2dcb5dcad2218fd221
Instruction ID: b3b2852e4fde8b40da2e11d6d5bcf0f4ffe6e4196d0690d5735a68b408f8955f
Opcode Fuzzy Hash: a7dcf3b872bca8685f5961ceb99f1390aa710949134b2c2dcb5dcad2218fd221
Instruction Fuzzy Hash: 40417166B08BC245EB109B6194461FD2B65BB05FA8F484D35DE5FAB797EF3CD1448300

Function 00007FF6139D22A0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF6139D185F), ref: 00007FF6139D22E6
strchr.VCRUNTIME140(00000000,?,?,00007FF6139D185F), ref: 00007FF6139D22F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF6139D185F), ref: 00007FF6139D2320
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D2355
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D237A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D239C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 701b562d305d28b033affdddbf65d7e14a7e199027673d6d929ac0e14e4089d7
Instruction ID: 21da8ede095618977e0866c4caa7c2da8df2dac767eaaf818d0dbc244ffd27e4
Opcode Fuzzy Hash: 701b562d305d28b033affdddbf65d7e14a7e199027673d6d929ac0e14e4089d7
Instruction Fuzzy Hash: E7316221A09F8186EA55DF12A5522797B90AB49FA0F085A35DE8F97796FF3CE0818300

Function 00007FF6139DD850 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DD8F9
memcpy.VCRUNTIME140 ref: 00007FF6139DD915
memcpy.VCRUNTIME140 ref: 00007FF6139DD92C
memcpy.VCRUNTIME140 ref: 00007FF6139DD947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DD97A

Strings

PLAIN, xrefs: 00007FF6139DD85B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 8f06fc03e41532ca5b0a05e7a0119cb7575dcb3cf368c3afc8c923dc2a594b74
Instruction ID: 43a119ff0aaf0cc403f0d7774ec52a99f9e053fe0206b257a1b5ed788a94d8cc
Opcode Fuzzy Hash: 8f06fc03e41532ca5b0a05e7a0119cb7575dcb3cf368c3afc8c923dc2a594b74
Instruction Fuzzy Hash: CE319366A08F8182EB118F56E4413AAA794FF45FE4F848A31DF9E97796EE3CD445C300

Function 00007FF6139D7685 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Strings

Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: b659deefd899a68d928ef1cf79296cef25cdd2965dd7581ad9d560776997bfc4
Instruction ID: f58cf7f7c2c1b40b239c8d4d3fc1df28b0537fede14188dd595f07b1b98aa3db
Opcode Fuzzy Hash: b659deefd899a68d928ef1cf79296cef25cdd2965dd7581ad9d560776997bfc4
Instruction Fuzzy Hash: F0311A61A08B8245EB159B6194471FE2BA5BB05FA8F480C35DE4FAB75BFF3CA5488300

Function 00007FF6139BF931 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BF9B6
memcpy.VCRUNTIME140 ref: 00007FF6139BF9D1
strchr.VCRUNTIME140 ref: 00007FF6139BF9ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BF9FE

Strings

CAPA, xrefs: 00007FF6139BFA14
Got unexpected pop3-server response, xrefs: 00007FF6139BF951

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: d495897bbb32fb7900f169f29c428b922d118fd228e5394bd397820622a21d4f
Instruction ID: e25c77da5eef8b85c7a49133231d05381fd28245067502d5d7d00a228ad994b8
Opcode Fuzzy Hash: d495897bbb32fb7900f169f29c428b922d118fd228e5394bd397820622a21d4f
Instruction Fuzzy Hash: 19319761B09B8291FA198B2590426B92694BB02FB0F444935CA1FBB7D7FF3DE569C301

Function 00007FF6139D76D6 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139D8800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: e0429e70490afcf1625c8906fbbcc74cc03aec47c80e042e40f4a1758fe81c31
Instruction ID: 468f8e3b5701bfca8f9d2bbb86b1c0802037d21923c72fe1c07f9a2dd4388617
Opcode Fuzzy Hash: e0429e70490afcf1625c8906fbbcc74cc03aec47c80e042e40f4a1758fe81c31
Instruction Fuzzy Hash: 53313B61A08B8245EB109B6198471FA2BA5BB05FA8F480C35DE4FAB757FF3CE5488300

Function 00007FF6139D76A3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139DA310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7BC2

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Expire Date, xrefs: 00007FF6139D7ACD
Public Key Algorithm, xrefs: 00007FF6139D7B78
Public Key Algorithm: %s, xrefs: 00007FF6139D7B92
Expire Date: %s, xrefs: 00007FF6139D7AE7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 5a34c979c22d99fa642846dc252d67e8bd6e08a4038edfdd442936c0c994fb53
Instruction ID: 00a0ad6715f0a47e20263ff9a0f109e2b42c03f774982363bd3c5c61f3cd8b47
Opcode Fuzzy Hash: 5a34c979c22d99fa642846dc252d67e8bd6e08a4038edfdd442936c0c994fb53
Instruction Fuzzy Hash: 2C311D61A08B8245EB119B6194471FE2BA5BB45FA8F440C35DE4FAB757FF3CE5488300

Function 00007FF6139D7C40 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C

Strings

%s%lx, xrefs: 00007FF6139D7C9D
Signature, xrefs: 00007FF6139D80CF
Signature: %s, xrefs: 00007FF6139D80E7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 9fc0538b7c30dbcaa3927dab1fb2c74c56b0476ae2a7839a957097e179856c7b
Instruction ID: c89a289d685996d0813ea6fec99d8a8665d951197022d09dfb5ebe01962f8b3a
Opcode Fuzzy Hash: 9fc0538b7c30dbcaa3927dab1fb2c74c56b0476ae2a7839a957097e179856c7b
Instruction Fuzzy Hash: A7317222B0CF8246EE508B25A4462F967A4FB45FA4F540831DE4FAB757FE2DE0448740

Function 00007FF6139C7CD0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C7CE1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139C7D4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C7D5F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction ID: d5a8e340ce7e7eceb360a82f2e2cc5eda7d27b7b1cfd34277e58ca18e9ef2069
Opcode Fuzzy Hash: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction Fuzzy Hash: 1531C632A08F8586EB41CB25D0613BD27A0FB85F94F584830DE4E9B796EF3DD5858700

Function 00007FF6139D6B41 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Strings

Signature Algorithm: %s, xrefs: 00007FF6139D7011
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 635089f868349817a7395d826d5566bd80108ba5fabe08628d655c3201992dc9
Instruction ID: e3b9724c894c4418fea8f9b654c45260591091e560ddb2ba8476e341d3304a46
Opcode Fuzzy Hash: 635089f868349817a7395d826d5566bd80108ba5fabe08628d655c3201992dc9
Instruction Fuzzy Hash: E8315A51E09F8244EB109B6594431FA2BA5BB05FA8F480C35DE0FAB797FE3CE5488300

Function 00007FF6139D6B7F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139D8800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Signature Algorithm: %s, xrefs: 00007FF6139D7011
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: c27b730ff3cde937318ceaca94d7d2e2050f88c6b36777fabcdc2f85280fb528
Instruction ID: 935d62d52b0c196bf02e0451fc649c6a6ee2e3ea6321c4d4a258e3738cfa3fa6
Opcode Fuzzy Hash: c27b730ff3cde937318ceaca94d7d2e2050f88c6b36777fabcdc2f85280fb528
Instruction Fuzzy Hash: 22315B51A09F8244EB109B6594421FA2BA5BB05FA8F480C35DE0FAB797FF3CE5488300

Function 00007FF6139D6B59 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139DA310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D6F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7023

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Signature Algorithm: %s, xrefs: 00007FF6139D7011
Serial Number, xrefs: 00007FF6139D6F52
Signature Algorithm, xrefs: 00007FF6139D6FF7
Serial Number: %s, xrefs: 00007FF6139D6F6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 228067bf5d3222deb49f6ad5301e89e894cbfdd00d5943fb9e2fc26564e16a64
Instruction ID: 2ccc35fd14348fb0fad40acc9289e8da9de6052ec64b70e384cc4bbab2cbcc98
Opcode Fuzzy Hash: 228067bf5d3222deb49f6ad5301e89e894cbfdd00d5943fb9e2fc26564e16a64
Instruction Fuzzy Hash: 4E313952A09F8245EB119B6594461FA2BA5BB05FA8F484C35DE0FAB797FF3CE5488300

Function 00007FF6139C5963 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C597F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C59FB

Strings

OS/400, xrefs: 00007FF6139C59C9
SITE NAMEFMT 1, xrefs: 00007FF6139C59DC

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 8c691ee043a9838d7f606555e5d370af31043bb70f99fac059963eb7e74f2456
Instruction ID: 856fda21c983756ff6f236af67bea5a1aca5b5ac6e9745f7b332e7a98412f724
Opcode Fuzzy Hash: 8c691ee043a9838d7f606555e5d370af31043bb70f99fac059963eb7e74f2456
Instruction Fuzzy Hash: 44316121A0CB8286F7718B1694523B86750BB49F74F844871DA8FA7697EE3CE946C710

Function 00007FF6139992A8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139B77A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B77C1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999371

Strings

Added, xrefs: 00007FF61399960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF613999617
Replaced, xrefs: 00007FF613999601
FALSE, xrefs: 00007FF61399934B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 82631bb3135a2ad10e17f086c294e470c804b6d2ccea4246878ff724b50622f8
Instruction ID: b5af4a1050ba2bd507ad0f72e187fb526a53d4a9a9696f3a524fc0a590d005cd
Opcode Fuzzy Hash: 82631bb3135a2ad10e17f086c294e470c804b6d2ccea4246878ff724b50622f8
Instruction Fuzzy Hash: AF615121A09B978AFF718F2690423BA6794AF44F64F494835DE8F92693FE2DE444C350

Function 00007FF61399919D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139B76F0: strchr.VCRUNTIME140 ref: 00007FF6139B7726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF613999371

Strings

Added, xrefs: 00007FF61399960D
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF613999617
Replaced, xrefs: 00007FF613999601
FALSE, xrefs: 00007FF61399934B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: c2ab3cbf1cffc3fc9e4ce8172e99c2bf4d11b967c886fdd51e25c4ea2097fbec
Instruction ID: 08690b95ffccfb1060084de4a011546e6387d4a6caea5d8c6bbf83dacb812aeb
Opcode Fuzzy Hash: c2ab3cbf1cffc3fc9e4ce8172e99c2bf4d11b967c886fdd51e25c4ea2097fbec
Instruction Fuzzy Hash: AE615261A09B938AFF718F2690463BA6794AF44F64F090835DF8F92693FF2DE4448350

Function 00007FF6139B21A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B23AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139B23C5

Strings

Forcing HTTP/1.1 for NTLM, xrefs: 00007FF6139B2269
The requested URL returned error: %d, xrefs: 00007FF6139B234E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 0e0eaa027d3d22a4a8d4ec68c5691ab6803c475b566300ff1cb4639a436c852e
Instruction ID: cc749f576c5ea717478615d89f458f5ccf5262270506759a9c2ff77feb0bd974
Opcode Fuzzy Hash: 0e0eaa027d3d22a4a8d4ec68c5691ab6803c475b566300ff1cb4639a436c852e
Instruction Fuzzy Hash: 3851CB31A0CFC281FB648A249041ABD3791EB45F64F584475DACEDE68FEF2DD4508320

Function 00007FF613982610 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613984310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341

Part of subcall function 00007FF613983C30: memcpy.VCRUNTIME140 ref: 00007FF613983C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139826E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613982730
__std_exception_copy.VCRUNTIME140 ref: 00007FF613982780
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139827CD

Strings

out_of_range, xrefs: 00007FF613982656

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 011e101c21e85212f65616117e2b30cad61de5ca062f2b3863d0ff6025111508
Instruction ID: c4c338fe427ebb3d0863e2a112caddad5791b38a573c8d0c4ee96f6a006be44f
Opcode Fuzzy Hash: 011e101c21e85212f65616117e2b30cad61de5ca062f2b3863d0ff6025111508
Instruction Fuzzy Hash: 8051A132A14F4599FB00CF65E4423AC3361FB44BA8F405A75EA5E52ADAEF38E195C300

Function 00007FF6139CF580 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CF5F8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CF62A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CF69A

Part of subcall function 00007FF6139B7900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF61399A92A,?,?,?,?,?,?,?,00007FF61399A6F7), ref: 00007FF6139B7911

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CF715

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF6139CF5EE

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 843ade515a0bd07329736349e60a03f950eedd840701748e77495a0b5ca17848
Instruction ID: 4db8cf246e0c9366d1b7eedd6c89645b60d50735857adccfae41fa7709e9574e
Opcode Fuzzy Hash: 843ade515a0bd07329736349e60a03f950eedd840701748e77495a0b5ca17848
Instruction Fuzzy Hash: 3341E612A0DEC985FF218B1495163B93B90EB05F64F480931DA8F976C3EF2CE459C701

Function 00007FF6139D9568 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

GMT, xrefs: 00007FF6139D95C4
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6139D9616

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 18548420aa55df9f48917c6983994d8601e4b2c51c1ca09d28ffe1cdaf2f51e4
Instruction ID: 903ea119b4699d5c1a6becb6810ba01e517b2ea775e409cb0b53e0ebf927d75a
Opcode Fuzzy Hash: 18548420aa55df9f48917c6983994d8601e4b2c51c1ca09d28ffe1cdaf2f51e4
Instruction Fuzzy Hash: 4F41C722E0CE8695F711DB259147278BB92EB41FA0F584931C68FB2A97EF3CD945C300

Function 00007FF613984310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984341
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF613984406
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF61398445A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF613984461

Part of subcall function 00007FF6139DF1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6139843EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF6139DF20A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF613984312

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 060c81ddfd111417c5091a61c3a1e0148c2aa5dfc69f83c4e14a55458c154890
Instruction ID: c5cc62e914599587d0e3a10de25f539c04e1bce5155f452fcb918aa9cecdd9ce
Opcode Fuzzy Hash: 060c81ddfd111417c5091a61c3a1e0148c2aa5dfc69f83c4e14a55458c154890
Instruction Fuzzy Hash: EF31E622B05F4944FE199B65D6462781241AF44FF4F580A75CE2E77BD7EE7CE0829300

Function 00007FF613990680 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6139811FA), ref: 00007FF61399075F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6139811FA), ref: 00007FF61399079C
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF6139811FA), ref: 00007FF6139907A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6139907D9

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF613990682

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: e4ce4394363e5324866952fb85af2f58288ab99f1bf50804098d43e406ae33b8
Instruction ID: f90fda5ff6ecbbfac110aba161644a4ea7f05762b9b8cf638654d6a6599641f5
Opcode Fuzzy Hash: e4ce4394363e5324866952fb85af2f58288ab99f1bf50804098d43e406ae33b8
Instruction Fuzzy Hash: 4531C362B09B4599EE109F16AD023AD6296AB04FF0F584A35DE6F577C7EE7CE0518300

Function 00007FF6139C6A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139BC080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF6139A340F), ref: 00007FF6139BC0AE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139C6ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C6B1B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139C6B32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C6B4B

Strings

Couldn't open file %s, xrefs: 00007FF6139C6AF9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: f3f8fc9c30668e38bf7e1b4fc36f559d2a38759315c738994b48983c7e84d7f3
Instruction ID: cdb5c12389825f119afd88d613a58d36c7a6570b0fb52bc13448e0fe504035ea
Opcode Fuzzy Hash: f3f8fc9c30668e38bf7e1b4fc36f559d2a38759315c738994b48983c7e84d7f3
Instruction Fuzzy Hash: A141847160CF8681EB148F25E40127967A1FB49FF4F188931DA9E97796EF7CE4418740

Function 00007FF6139AA510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AA599
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AA62F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AA657

Strings

identity, xrefs: 00007FF6139AA553, 00007FF6139AA5C3, 00007FF6139AA628
Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF6139AA645

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: df79667446998cfa9fe32aac958eaa7bfc2909eaa380d159321fe0720fedef74
Instruction ID: f805cfe239ab742fc43458e9713b0ce6f310d6b61067a86da16c49ed4569ed3d
Opcode Fuzzy Hash: df79667446998cfa9fe32aac958eaa7bfc2909eaa380d159321fe0720fedef74
Instruction Fuzzy Hash: 36419D21E09F42C6FB518B159901278B7A0FB45FB4F495A31CE6EA77A6FF2CD4058700

Function 00007FF6139AC810 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AC905
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AC964

Strings

Connection died, retrying a fresh connect, xrefs: 00007FF6139AC8EF
Connection died, tried %d times before giving up, xrefs: 00007FF6139AC8C8
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF6139AC89B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: 04786302b464ce4458984dfce92d798d726ef78eb1baf23cf9b6393892aed6c8
Instruction ID: d191569f19f5e4986bfb22999ac11485440f3b64af0eb50409daacc82f0881d1
Opcode Fuzzy Hash: 04786302b464ce4458984dfce92d798d726ef78eb1baf23cf9b6393892aed6c8
Instruction Fuzzy Hash: FA416222F0CEC281EB558B29E0413A97790FB84F98F484531DA4EEB766EF79D495CB40

Function 00007FF6139D9459 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9480
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

FALSE, xrefs: 00007FF6139D9475

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: e075efb9f471538cf5fea25a544e13b80d27f3e372c79109e91b7771380f9fd1
Instruction ID: 8889539185377827a07e88b4d6f549a878eb6322e7c825692b2179a87c2431c8
Opcode Fuzzy Hash: e075efb9f471538cf5fea25a544e13b80d27f3e372c79109e91b7771380f9fd1
Instruction Fuzzy Hash: 6E31D422E0CE9645FB12DB2994473786B929B01FB4F440E31CA9FA1AD7EE3CD981C310

Function 00007FF6139D8D00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D8D2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D91F6

Strings

TRUE, xrefs: 00007FF6139D8D1B
FALSE, xrefs: 00007FF6139D8D22
%s: %s, xrefs: 00007FF6139D91E1

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 325b3fe2c30e5458511042f25abbcc62c3653c67faaa361f4360c8e5e1acd019
Instruction ID: 76feffee99aea43e535ddc8680cc1d46d5a6fb658d0f19a655514c8e8718906c
Opcode Fuzzy Hash: 325b3fe2c30e5458511042f25abbcc62c3653c67faaa361f4360c8e5e1acd019
Instruction Fuzzy Hash: 67016552B0CF9285EA659B56A8467B52751BB06FA0F444831CE4F97353EE3CD1858300

Function 00007FF6139907E0 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613983D70: memcpy.VCRUNTIME140(?,?,0000000100000000,00007FF61399083D), ref: 00007FF613983E22
Part of subcall function 00007FF613983D70: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF613983E47

Part of subcall function 00007FF613983D70: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0000000100000000,00007FF61399083D), ref: 00007FF613983E04

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613990A50
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613990A57
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613990A5E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613990A65
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF613990A6C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 5e99ca1bde4e1416277db961ec109b41f83edf1a84fdc12d99675d70987ffbfa
Instruction ID: 51afc2a99bf8391e243e105fa42914802a885f38835a6f314682256d128d3979
Opcode Fuzzy Hash: 5e99ca1bde4e1416277db961ec109b41f83edf1a84fdc12d99675d70987ffbfa
Instruction Fuzzy Hash: 9D61AF62A04F8589EB20DF21E48A3BD3365FB45F94F404431DA9E96BAAEF7DD494C340

Function 00007FF6139D4330 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139D4290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D42B6
Part of subcall function 00007FF6139D4290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D42D7
Part of subcall function 00007FF6139D4290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D42F2
Part of subcall function 00007FF6139D4290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D4300
Part of subcall function 00007FF6139D4290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D4312

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D43B6

Strings

HTTP, xrefs: 00007FF6139D433A
NTLM, xrefs: 00007FF6139D436E, 00007FF6139D4420

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 39a23f78fe25a4d256fce5b592c7a67188582c1c21e97960aec82a00448847b9
Instruction ID: 8cee779cf80a7859b76fa4d7ef4e3558ae15dfa3be7093962ce4b4ab580d8235
Opcode Fuzzy Hash: 39a23f78fe25a4d256fce5b592c7a67188582c1c21e97960aec82a00448847b9
Instruction Fuzzy Hash: 94614B32608F8582EB608F15E4427AA77A4FB88F94F544935DE8EA7B59EF3CD454CB00

Function 00007FF6139C1A3B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C1AF0

Strings

control connection looks dead, xrefs: 00007FF6139C1CE2
Failure sending ABOR command: %s, xrefs: 00007FF6139C1C11
Remembering we are in dir "%s", xrefs: 00007FF6139C1B88
ABOR, xrefs: 00007FF6139C1BEB

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 466439d91d0d7739ce5d2f9dc11d5886e8c0a76dfe12478b16c418ff8186dc87
Instruction ID: 579269f021976323804397b5349ebc84944a027fd594b1a412c58bc3b4db0200
Opcode Fuzzy Hash: 466439d91d0d7739ce5d2f9dc11d5886e8c0a76dfe12478b16c418ff8186dc87
Instruction Fuzzy Hash: 6A51A5A2A0CF8285FA64D73490523B96250EB41B74F404A35DAAFA76D7FF7CE4858344

Function 00007FF6139D9D35 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9D78
memcpy.VCRUNTIME140 ref: 00007FF6139D9D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9E6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9EBF

Strings

TRUE, xrefs: 00007FF6139D9EC9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 2de0af5476a8bee818dfaffc51287aacab6865fda698d13ebbfacdef7cd6ec0c
Instruction ID: 6b3250bb64a74268aa944e5eb97e593121042d51bb7307b5d7be06f74830b3b2
Opcode Fuzzy Hash: 2de0af5476a8bee818dfaffc51287aacab6865fda698d13ebbfacdef7cd6ec0c
Instruction Fuzzy Hash: FD413362A19A9205FB099A2685173782B53EB45FF0F044E31DA6FD73C7EE6CE085C310

Function 00007FF6139DD5E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6139DD5A0), ref: 00007FF6139DD64F

Part of subcall function 00007FF6139B7900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF61399A92A,?,?,?,?,?,?,?,00007FF61399A6F7), ref: 00007FF6139B7911

Part of subcall function 00007FF6139B7900: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6139B7AB3
Part of subcall function 00007FF6139B7900: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF6139B7AD0

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6139DD5A0), ref: 00007FF6139DD6BE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6139DD5A0), ref: 00007FF6139DD6D8
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6139DD5A0), ref: 00007FF6139DD70E

Strings

xn--, xrefs: 00007FF6139DD6F5

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: 423bf8c0c49e3ec128dd97a9686630982e6650d8334231880676cdb0425b1833
Instruction ID: 23f7a0165adcad7cbba1cca2c63f5cf4ead9b7309381880483a2549c72282667
Opcode Fuzzy Hash: 423bf8c0c49e3ec128dd97a9686630982e6650d8334231880676cdb0425b1833
Instruction Fuzzy Hash: FA41C595B1DA8205FB549B2695173B966819F45FE0F488935DE4FE7BC3FE2CE4068300

Function 00007FF6139AB6D0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6139AB778
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AB7F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AB8A2

Strings

allocate connect buffer!, xrefs: 00007FF6139AB81F
CONNECT phase completed!, xrefs: 00007FF6139AB8E3

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 7b421a5aa3c9cdeafd06fb9577e758e1f5d371e51e66a2b483ab274c72befbc5
Instruction ID: a3ed2aed6407bfc60f303efe4c0e1f4fb4292b94edebae54b47baec0b302e28e
Opcode Fuzzy Hash: 7b421a5aa3c9cdeafd06fb9577e758e1f5d371e51e66a2b483ab274c72befbc5
Instruction Fuzzy Hash: 8851A122F08E8296F7148B29D5593B93390FB44F99F040935CB5EAB7A2EF78E5658300

Function 00007FF6139D7253 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7589

Strings

Start Date: %s, xrefs: 00007FF6139D7577
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6139D7381
Start Date, xrefs: 00007FF6139D755D
GMT, xrefs: 00007FF6139D730E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 3cc400d705c7ae2362500cf1e020bece85d41da4efc320729d18f1b821df95dc
Instruction ID: 9f1bd7a1101421691e042f08fcd2a711545ec3186d11c327ed91a0ec64c68773
Opcode Fuzzy Hash: 3cc400d705c7ae2362500cf1e020bece85d41da4efc320729d18f1b821df95dc
Instruction Fuzzy Hash: BB519262E0CBD245EB118F15A5061BDBBA5FB01FA0F844835DA8FA6B56EF3CE545C300

Function 00007FF6139BE450 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139B77A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6139B77C1

memcpy.VCRUNTIME140 ref: 00007FF6139BE5C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139BE5CF

Strings

Found %I64d bytes to download, xrefs: 00007FF6139BE522
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF6139BE58D
Failed to parse FETCH response., xrefs: 00007FF6139BE4AE

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 2666265653ab1ec3e10e930bd31a71e0d180f8da04622154dd8d31111f66fc27
Instruction ID: 93a18c9873c713a93f288aa00a0d80d68c797ba6a6ca818e708a2e49134f1e83
Opcode Fuzzy Hash: 2666265653ab1ec3e10e930bd31a71e0d180f8da04622154dd8d31111f66fc27
Instruction Fuzzy Hash: EB51A422F0CFC682EA14DE65E4416B97355FB45FA4F448831DA8EABA5BEF7CE4458300

Function 00007FF6139D7190 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7589

Strings

Start Date: %s, xrefs: 00007FF6139D7577
GMT, xrefs: 00007FF6139D71EC
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6139D723F
Start Date, xrefs: 00007FF6139D755D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: fd687db5ce81c312168de4ee473c0d8d84d0a0caf4907a782c0026f3af3b1231
Instruction ID: 7e4772fbdf7c1f0d5ab8f42df87b5b8373848350d022ed1a4bb5ca60265e86d6
Opcode Fuzzy Hash: fd687db5ce81c312168de4ee473c0d8d84d0a0caf4907a782c0026f3af3b1231
Instruction Fuzzy Hash: B6314F62A0DFC285EB108F2194421BA7765FB05FA4F984931C64FAB257EF3CE549C301

Function 00007FF6139B8B90 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A4F70), ref: 00007FF6139B8BC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A4F70), ref: 00007FF6139B8BDA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A4F70), ref: 00007FF6139B8BEF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A4F70), ref: 00007FF6139B8C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6139A4F70), ref: 00007FF6139B8C25
memcpy.VCRUNTIME140(?,?,?,00007FF6139A4F70), ref: 00007FF6139B8C59

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction ID: a7d5132fe125e0925e1981e3d83a86d855119f738e98670aaa2c9b55eb92ae4d
Opcode Fuzzy Hash: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction Fuzzy Hash: 9A21A6B1A0DB828AD7548F1194116297BA4FB4CFA0F488535DA5EAF79AEF3CD4408700

Function 00007FF6139D73E4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D741F
memcpy.VCRUNTIME140 ref: 00007FF6139D7445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7589

Strings

Start Date: %s, xrefs: 00007FF6139D7577
Start Date, xrefs: 00007FF6139D755D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 931404bb7ef4e7a24fca340e42252142a84ad0bfd55e92b62d93b7e113a9c3aa
Instruction ID: af81cb8fafdbd145f7fb9cbbd51598df050b110b144f32dad10f2bedb06f985e
Opcode Fuzzy Hash: 931404bb7ef4e7a24fca340e42252142a84ad0bfd55e92b62d93b7e113a9c3aa
Instruction Fuzzy Hash: 8121A961A09BC202EE158B2285062B92A52AF15FF4F484D35CD1FAB7E7FE3CA5488301

Function 00007FF6139D7CB8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C

Strings

Signature, xrefs: 00007FF6139D80CF
Signature: %s, xrefs: 00007FF6139D80E7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: b3f9ac1a51e1cb56c8a081f84247a427091f42702f2d27fe41e35f81361af7e0
Instruction ID: 264b0d8555a1cd79a0dd8541443048abff5df4586ab70cb467b0799a15422602
Opcode Fuzzy Hash: b3f9ac1a51e1cb56c8a081f84247a427091f42702f2d27fe41e35f81361af7e0
Instruction Fuzzy Hash: 34213366B0CF8246EA509B15E4462FA67A4FB45FA4F440832DE4FAB757FE3CD0458700

Function 00007FF6139D7CF6 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139D8800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Signature, xrefs: 00007FF6139D80CF
Signature: %s, xrefs: 00007FF6139D80E7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: bc5e897e2579d7dd63d7d746884e3d6efa0bb8b49bbbd3ec929c441a6fa49155
Instruction ID: 6fc93fe6235bfefac91d687bcc8e4deb7097fee85d9f5ce958ccab2dfa6d8451
Opcode Fuzzy Hash: bc5e897e2579d7dd63d7d746884e3d6efa0bb8b49bbbd3ec929c441a6fa49155
Instruction Fuzzy Hash: 43212166B0CF8286EA508B15E4462EA6764FB85FA4F440832DE4EAB75BEE3CD145C700

Function 00007FF6139D7CD0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139DA310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D80F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D8139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D814C

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Signature, xrefs: 00007FF6139D80CF
Signature: %s, xrefs: 00007FF6139D80E7

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 655b0211d0849ab725f3121ffe595c78da798e7ae1bc27a02535ae4aa2ae173d
Instruction ID: 8f0a8a086765582c1b6c50f5605d0052c6b2582dcc07cf6c579c411f8e76d8e7
Opcode Fuzzy Hash: 655b0211d0849ab725f3121ffe595c78da798e7ae1bc27a02535ae4aa2ae173d
Instruction Fuzzy Hash: DD212166B0CF8286EA508B15E4462EA6764FB85FA4F440832DE4FAB75BEE3CD145C700

Function 00007FF613992C40 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF613992579), ref: 00007FF613992EDF

Strings

Host not found, xrefs: 00007FF613992EA8
Unrecoverable error in call to nameserver, xrefs: 00007FF613992ECC
No data record of requested type, xrefs: 00007FF613992EC3
Host not found, try again, xrefs: 00007FF613992ED5

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: f68edcbc337550e6e0110a99c69435a7bbb63833a9b97754134fee37ae0c7940
Instruction ID: 197b2a78d7b6f0c3db8222ca1fadfd79e0fc273e68d85703431ec3a0e7b74908
Opcode Fuzzy Hash: f68edcbc337550e6e0110a99c69435a7bbb63833a9b97754134fee37ae0c7940
Instruction Fuzzy Hash: EF110A52A0CF4A8DEA58CF99E5D52B81290EF0DFA0F4855B5C68F96687FE6CE4D08340

Function 00007FF61399AC00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF61399B0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF61399B0B7
CloseHandle.KERNEL32 ref: 00007FF61399B0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF61399B0E6
closesocket.WS2_32 ref: 00007FF61399B104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF61399B11D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction ID: 319875e0a58e57e982c3b8f4fc0aefdb4b09db95223ca6d753dd2e2439a039e9
Opcode Fuzzy Hash: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction Fuzzy Hash: F3111676A08F41CAE6209F12E54126A7760FB89FA0F444535DF8E97B46EF3EE4A18700

Function 00007FF6139B5790 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF6139B5AE2

Strings

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF6139B5A75
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF6139B582B
** Resuming transfer from byte position %I64d, xrefs: 00007FF6139B5818

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: cf5752f772f53d5a01ce0a4df43098bbf945ca1bb178d9efa3e48f8af9e2371a
Instruction ID: c6d1686cfabcd8dce10f50e9c238c2112e2389bd871d242e7530541a4971968d
Opcode Fuzzy Hash: cf5752f772f53d5a01ce0a4df43098bbf945ca1bb178d9efa3e48f8af9e2371a
Instruction Fuzzy Hash: 3591B621A06B86C5DA60CB05E545BAA7354FB84FE0F815432DE4E9BB5AFF3CD401D740

Function 00007FF6139C27B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6139DA500: memcpy.VCRUNTIME140 ref: 00007FF6139DA5A8
Part of subcall function 00007FF6139DA500: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DA5B9

WSAGetLastError.WS2_32 ref: 00007FF6139C291A

Strings

FTP response timeout, xrefs: 00007FF6139C2967
We got a 421 - timeout!, xrefs: 00007FF6139C293E
FTP response aborted due to select/poll error: %d, xrefs: 00007FF6139C2928

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: 796fff929338667895051d4d0396df10a4d59ed21fe22401bcd2d6955a7ab080
Instruction ID: e7bab4b99ddb4c14b80c077b273367f3da97d7b68dbdf13f49ebc07d139695f9
Opcode Fuzzy Hash: 796fff929338667895051d4d0396df10a4d59ed21fe22401bcd2d6955a7ab080
Instruction Fuzzy Hash: F9419621A08E8685FB609F2598427B96390FB49FA4F444931DE9FE7397FE3CD8458700

Function 00007FF6139D99F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9EBF

Strings

TRUE, xrefs: 00007FF6139D9EC9
FALSE, xrefs: 00007FF6139D9A10

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: 2989acc13cbc0029e913620442beb60a4be3815a991f995df501513d7eb905cf
Instruction ID: 46a22ffc379cdd123d1ccf4f567d9559ba88e4f637ccd27769ce01e784d5c9bf
Opcode Fuzzy Hash: 2989acc13cbc0029e913620442beb60a4be3815a991f995df501513d7eb905cf
Instruction Fuzzy Hash: E841B1A2B09B5684FF159A5A90073BC6792AB05FB4F484D32CE5FE67C6FE3CA0408210

Function 00007FF6139CBA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139CBA81
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6139CBAC0
WSAGetLastError.WS2_32 ref: 00007FF6139CBB18

Strings

TFTP response timeout, xrefs: 00007FF6139CBADA

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: c3af9252efa73ff710136be127cd797860d60a0ca492111bf162edc3a60d7612
Instruction ID: fe587966206c6e8902bfc38707383431f34bd9b4a125a7eba6b461958fb176cd
Opcode Fuzzy Hash: c3af9252efa73ff710136be127cd797860d60a0ca492111bf162edc3a60d7612
Instruction Fuzzy Hash: 84418032A08E8285EB609F26D4527A93790EB85FB4F444631DE6F977DAEF3CD4418740

Function 00007FF6139D948E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

%s%lx, xrefs: 00007FF6139D94F8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: fd4fe93a63d81f1eee54e4347bacdfe35ba4eeaea70399024db6a6f81961019a
Instruction ID: 0df5884b0f207598943a710674205ef05e68ccb9e8d4443ad39a1e84ce5f6167
Opcode Fuzzy Hash: fd4fe93a63d81f1eee54e4347bacdfe35ba4eeaea70399024db6a6f81961019a
Instruction Fuzzy Hash: 1331F312E0DEA645FB129B2994473786F92AB11FA4F144D31C68FF6A97FE2DD941C300

Function 00007FF6139D976F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Strings

TRUE, xrefs: 00007FF6139D990D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: 84cdeb7f4889b0e98a9bc369abe20393a8c158631b938612cc781c0bb33ba72d
Instruction ID: b5cbfadaa8d17b7312a7ab4aa37f0ff31a2937dad1a00328509416aa87a5cf71
Opcode Fuzzy Hash: 84cdeb7f4889b0e98a9bc369abe20393a8c158631b938612cc781c0bb33ba72d
Instruction Fuzzy Hash: 2431C761A0CE9685FB11CF2595463786FA2EB05FB4F480A31CA9FE2AD6EF2CD541C300

Function 00007FF6139A5AF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C15
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C30

Strings

..., xrefs: 00007FF6139A5B98
..., xrefs: 00007FF6139A5B82

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: f5d4120396a53f35d6a0aa358773e0a09f2099a20ff6d950d28a1d81d0b1d9cf
Instruction ID: 1426223c9352937508cf2ed40dd8cad3834b7ed8a79f484a58f82c28b21f1ecd
Opcode Fuzzy Hash: f5d4120396a53f35d6a0aa358773e0a09f2099a20ff6d950d28a1d81d0b1d9cf
Instruction Fuzzy Hash: 9E31D321B08E8681EB60CB11E4053F977A1FB84FA4F444631CA9E937A6EF3DE059C780

Function 00007FF6139C2590 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF6139C25E2
accept.WS2_32 ref: 00007FF6139C2601

Part of subcall function 00007FF6139B4C90: ioctlsocket.WS2_32 ref: 00007FF6139B4CA9

Strings

Connection accepted from server, xrefs: 00007FF6139C262F
Error accept()ing server connect, xrefs: 00007FF6139C261E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 434231671a3d3562615c89ba28fcd0375854ad9688cb4bb07be998ef2b03a86c
Instruction ID: 8f7077a976bf7fe23d08282dd51eead74f421ff225cc9f9cd81f42b0f0394ba5
Opcode Fuzzy Hash: 434231671a3d3562615c89ba28fcd0375854ad9688cb4bb07be998ef2b03a86c
Instruction Fuzzy Hash: 9731A221708A8186EB54DB22E5067AA7390FB88FF4F440631DAAE977C6EF7DE105C740

Function 00007FF613994313 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139943A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139943BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139943DB

Strings

:, xrefs: 00007FF613994396

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 9185cdd294420f20cdc6d51fd5518084f5bb34101a95b3ad8653fbf82a5b9ae8
Instruction ID: e46a749966b037b764c8ab92c928366c681e31bc807a96f4df785d7f54cf3088
Opcode Fuzzy Hash: 9185cdd294420f20cdc6d51fd5518084f5bb34101a95b3ad8653fbf82a5b9ae8
Instruction Fuzzy Hash: 27217F22609F868AEB62CF14E5423A977A0FB44FA4F884531DF9EA6785EF3CD4548700

Function 00007FF613994498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139943A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139943BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139943DB

Strings

:, xrefs: 00007FF613994396

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 7e334ca8de8e4567ccf13a3d1ed7df33fb9ad007e5fdceb3d50289511dc5c3dd
Instruction ID: 12a1fc5cd7b4fddc5574f3e0868dde03a5303a758069a48d2595cae98c3c8f73
Opcode Fuzzy Hash: 7e334ca8de8e4567ccf13a3d1ed7df33fb9ad007e5fdceb3d50289511dc5c3dd
Instruction Fuzzy Hash: 65116F22709F8589EB66CF14A6023A977A0AB44BB4F884531DF9EA2795EF3CD4548700

Function 00007FF6139CA490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF6139CA4CD
WSAGetLastError.WS2_32 ref: 00007FF6139CA4D7

Strings

Sending data failed (%d), xrefs: 00007FF6139CA4DD
SENT, xrefs: 00007FF6139CA4F2

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: b305d28b117c5390196270bb9271faa1f7ae2e309369d4ece08cc852aadb9171
Instruction ID: 94b990948a0c277fb9f61f2d28e11e5fdebb7660a4e6f00e63957b2744f29621
Opcode Fuzzy Hash: b305d28b117c5390196270bb9271faa1f7ae2e309369d4ece08cc852aadb9171
Instruction Fuzzy Hash: C3019E22B08F92C1EB108B2AE8424997B60FB89FE4B495131CB5E93722EE29D501C780

Function 00007FF6139D7161 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D7164
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D7589

Part of subcall function 00007FF6139A0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292

Strings

Start Date: %s, xrefs: 00007FF6139D7577
Start Date, xrefs: 00007FF6139D755D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 0e1e215d465bdb65dc11ec78cd6772c2a7b85769cfe06162245f5a7cea0827dc
Instruction ID: fdcccd3d1343dbd0df17203bab29d90bc6275168b7de338a7654e4c281c21154
Opcode Fuzzy Hash: 0e1e215d465bdb65dc11ec78cd6772c2a7b85769cfe06162245f5a7cea0827dc
Instruction Fuzzy Hash: AC017152F0DFC242EB158B1194465F92B56BF05FA4F884C71D90FAA657FF3CA5488301

Function 00007FF6139B15A0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139B19B5), ref: 00007FF6139B15D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139B19B5), ref: 00007FF6139B15E1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139B19B5), ref: 00007FF6139B165A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139B19B5), ref: 00007FF6139B166B
memcpy.VCRUNTIME140(?,?,00000000,00007FF6139B19B5), ref: 00007FF6139B1694

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: e5aaf608392412e8d4b9a1dc4236b9329a67fb2d8f166538309d8ae37baf092e
Instruction ID: 8e181fe9225ba73c1cbccd37a87d33b5eecadb5b3da6ccc6cd03d1a311b37ab6
Opcode Fuzzy Hash: e5aaf608392412e8d4b9a1dc4236b9329a67fb2d8f166538309d8ae37baf092e
Instruction Fuzzy Hash: 39316162A08F45C2EB509F11E5016A96794EB05FF4F484A31DE6FAB7CAEF3CD4508300

Function 00007FF6139D4290 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D42B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D42D7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D42F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D4300
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D0D25), ref: 00007FF6139D4312

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction ID: 9f30a05b31acc366489706e6c372d8ac5d0f63cfc08606b9fc9e244bdce39253
Opcode Fuzzy Hash: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction Fuzzy Hash: B2111536618F4182DB449F25E98217C7BA8FF84FA8B040831DE8E9B729DF38D895C340

Function 00007FF6139AA7B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AA8D0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AA916
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AA978

Strings

chunked, xrefs: 00007FF6139AA82E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: 1f55bf3cc2ceb97599b1b13bb89cd2425dee7cbd92ad9f3b9547d39331e686ba
Instruction ID: ffbae8bbf008d34904249aa1757aca47a42f8da9a93186a061cbf1013837af8e
Opcode Fuzzy Hash: 1f55bf3cc2ceb97599b1b13bb89cd2425dee7cbd92ad9f3b9547d39331e686ba
Instruction Fuzzy Hash: 7751C931E08F9286FB558B1695013797791AF04FE4F494935DE5EA77A6FF2CE8428300

Function 00007FF6139D9BAF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9EBF

Strings

TRUE, xrefs: 00007FF6139D9EC9
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF6139D9CD1
GMT, xrefs: 00007FF6139D9C5E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 2314223a42b02a56667362992ea725fa1a111eb4508a0bdd26f329100ff1f141
Instruction ID: e5d5ded4d82a96657672411ab3a2879350c5bc1eb80e32940df745fa28cafde7
Opcode Fuzzy Hash: 2314223a42b02a56667362992ea725fa1a111eb4508a0bdd26f329100ff1f141
Instruction Fuzzy Hash: 8851E462E0CE9644EB119F65A5472B97BA6FB02BA0F444832DA4FA7756EF3CE445C300

Function 00007FF61398D4D0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61398D198), ref: 00007FF61398D5AE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61398D198), ref: 00007FF61398D5DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61398D198), ref: 00007FF61398D645

Part of subcall function 00007FF6139DF1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF6139843EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF613981B49), ref: 00007FF6139DF20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF61398D652

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: f485f46759ee3c819f91b3d763993f9dcf21cbb8076185c2af80993c6419b380
Instruction ID: 945f971187cc0dfe2817dfb50880d1d1d93b675d16d8fd4923c841fff106eb2e
Opcode Fuzzy Hash: f485f46759ee3c819f91b3d763993f9dcf21cbb8076185c2af80993c6419b380
Instruction Fuzzy Hash: DC41C272716E4985EE149F25D0462BD6361BB84FB4F548A72CB2E977CAEF3CE0519300

Function 00007FF6139DA830 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF6139BC9DB), ref: 00007FF6139DA88E

Strings

%s, xrefs: 00007FF6139DA864

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 0d9a4fbca350a2b51e1a3a6bd17f6e341b6717d5cc9ad04e110af83e92be828a
Instruction ID: 7c1c6a4fae7140ed73d63e443330b9c9ef9e2b50dc42fea0ec828abe61f36f7a
Opcode Fuzzy Hash: 0d9a4fbca350a2b51e1a3a6bd17f6e341b6717d5cc9ad04e110af83e92be828a
Instruction Fuzzy Hash: B4417F32A18F4582EB508B16B4411AAB7A4FB84FB0F144635DF9F57BA2EF3CE4958340

Function 00007FF6139DAC70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF6139BE220,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF6139DACC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DAD4C

Strings

%s, xrefs: 00007FF6139DAC95

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 1a2af4c6437707a263c2e04b6871f1d6755b0c65e1c6e58b2568f2a7d7757bd0
Instruction ID: e227c9a519940a0f92c510f51e61742bc130303c265e2f5e55faf569667d3a45
Opcode Fuzzy Hash: 1a2af4c6437707a263c2e04b6871f1d6755b0c65e1c6e58b2568f2a7d7757bd0
Instruction Fuzzy Hash: 17418532A08F4582EB519B26F4411AAB7A4FB45FB0F044534DF8E57BA6EF3CE4958700

Function 00007FF6139D9AF5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9EBF

Strings

TRUE, xrefs: 00007FF6139D9EC9
GMT, xrefs: 00007FF6139D9B49
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF6139D9B9B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: cf2825dc601f22ed468ee35b6bb29dedeb88632c42a2c12affe150d9ed24460d
Instruction ID: 5365574cda0775d99bf027e2c8694b8d7d0bc1da7cc197ca04744bc9f5ea80fb
Opcode Fuzzy Hash: cf2825dc601f22ed468ee35b6bb29dedeb88632c42a2c12affe150d9ed24460d
Instruction Fuzzy Hash: D831D362A09F8684EB10DB65E5422A97763FB45FE4F484832CA4FA7786EF3CE545C300

Function 00007FF6139C61CD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C6204

Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C15
Part of subcall function 00007FF6139A5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6139A5C30

Strings

%s%s, xrefs: 00007FF6139C61D4
Wildcard - START of "%s", xrefs: 00007FF6139C620D
Wildcard - "%s" skipped by user, xrefs: 00007FF6139C626D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 8299427a5ad266f79722ea9ef5ffcf9a9fc35c8886571f6f63a6ff16aa18c0a4
Instruction ID: 730300065a3281d7add7d2887da70800ad0b31b738da322ac2c20e9964c615a2
Opcode Fuzzy Hash: 8299427a5ad266f79722ea9ef5ffcf9a9fc35c8886571f6f63a6ff16aa18c0a4
Instruction Fuzzy Hash: 69411972A08E82C5E7109F1AD4451A933A0EB84FB5F594936DE4FAB396EE3CE445C380

Function 00007FF613990580 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6139811FA), ref: 00007FF6139905B8
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF6139811FA), ref: 00007FF613990659
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF613990677

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: de1c6875f200540c7d25ef907db20005fdec5c9f83ccc6c164fa8115f0418b6c
Instruction ID: 5f63bbda0199327106ff49f1e05231c91ccb2b9568ef9e06a7a35e67ef68a6b4
Opcode Fuzzy Hash: de1c6875f200540c7d25ef907db20005fdec5c9f83ccc6c164fa8115f0418b6c
Instruction Fuzzy Hash: 1621A662A0AF5649E915AF52A5023792254AB44FF5F180F30DE7EA77C3FF7CA4928300

Function 00007FF6139A0240 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0292
memcpy.VCRUNTIME140 ref: 00007FF6139A02CD

Part of subcall function 00007FF613995620: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF613995635

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A0302

Part of subcall function 00007FF613995730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF61399FD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF613991B61), ref: 00007FF613995757
Part of subcall function 00007FF613995730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF61399FD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF613991B61), ref: 00007FF613995763

Strings

%s:, xrefs: 00007FF6139A02AC

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 1b73f9cfeb138da4e2e179966cb669f2fdf5ab84fc2fa84ad0d24e29dda246a4
Instruction ID: 639ed3389d1a61966b9b5bce0173c09ddfd89e8da9acf00ef1d2e2ed5c72c562
Opcode Fuzzy Hash: 1b73f9cfeb138da4e2e179966cb669f2fdf5ab84fc2fa84ad0d24e29dda246a4
Instruction Fuzzy Hash: C221D626A08F9581DB00CF12E9411AA77A4FB54FF4F480A31EE5E977A6EF3CD5458340

Function 00007FF6139D953A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9541
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D99AE

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: 733391f2657efa35da2d8d8438dedb358714d88d68be73f8003184230d9818b7
Instruction ID: 6a0024cb10849ce481a3972b95bc6b1e8e5730869219ee326240d9ffc2e236df
Opcode Fuzzy Hash: 733391f2657efa35da2d8d8438dedb358714d88d68be73f8003184230d9818b7
Instruction Fuzzy Hash: F221F111E0DEA645FB12DB2984473786FA29B11FA0F480D30C6CFE5A87EF2C9981C310

Function 00007FF6139A92DD Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6139A8FA8), ref: 00007FF6139A90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6139A8FA8), ref: 00007FF6139A910F

Strings

I64, xrefs: 00007FF6139A9105
I32, xrefs: 00007FF6139A90E5

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 43a352a892712fe73208679e218960c350d0e5422f0842123306e9b92ba5ab5c
Instruction ID: 9a6ec7f63476d7a568bd849622befcf09484ef072386a40cd1c4931ff27e7269
Opcode Fuzzy Hash: 43a352a892712fe73208679e218960c350d0e5422f0842123306e9b92ba5ab5c
Instruction Fuzzy Hash: AE21A436E0DE5786EB214B21D4512BD7BA4BB05F98F4A8630CB5BE22E6FE1CD504C750

Function 00007FF6139C24B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C24CD
strstr.VCRUNTIME140 ref: 00007FF6139C250C
strstr.VCRUNTIME140 ref: 00007FF6139C2524

Strings

;type=, xrefs: 00007FF6139C24FF, 00007FF6139C251D

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 0222ecf549d9eab6eeb32d814db4a0ad4109cacb1d6406b327078b4eadc27f5b
Instruction ID: d021147563c91c795fb6ae964e63329d6dd0b0e3cd6f231d57fed5c9d7c6c03a
Opcode Fuzzy Hash: 0222ecf549d9eab6eeb32d814db4a0ad4109cacb1d6406b327078b4eadc27f5b
Instruction Fuzzy Hash: 8B219531908BC181EB558B15E0413A937A0FB54FA4F484575DAAF9B7C7EF3CE5918300

Function 00007FF6139DD320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6139DD35D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DD36D
WideCharToMultiByte.KERNEL32 ref: 00007FF6139DD39C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DD3A9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction ID: d50ea639fc91a822065ae3638e9a53e6d3d26196fa083cedef5f12712d724a6c
Opcode Fuzzy Hash: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction Fuzzy Hash: 73115E31B09B5186E7148F62F90216DBBA4FF88FD0B494438EB8A97B15EF38E5118740

Function 00007FF6139B1960 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139B19E3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF6139B1970

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction ID: d77e5c0dd7897cbca05780bce8d96348ff742655738208ca3e216d9f4a217fad
Opcode Fuzzy Hash: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction Fuzzy Hash: F101A562F08F4142FA155B55B8417B96654AF84FF0F088630DEAE5A7D6EF3C98858300

Function 00007FF6139DD550 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139DD576
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139DD587
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DD5B6

Part of subcall function 00007FF6139DD5E0: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6139DD5A0), ref: 00007FF6139DD64F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139DD5AD

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 7cab5db05de9ca3a6ba704ce4dbf99f699dd45310a38cd1de36bc81fa6730da7
Instruction ID: 75d226319c0d8118fa907d4757901d196411726415c7720a07e01f9b8d1bc019
Opcode Fuzzy Hash: 7cab5db05de9ca3a6ba704ce4dbf99f699dd45310a38cd1de36bc81fa6730da7
Instruction Fuzzy Hash: 3D019E61B0DF8143FF998B5A65521385690AF48FE4F480834FE4F97B8AFE2CD8958200

Function 00007FF6139A91D2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6139A8FA8), ref: 00007FF6139A90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6139A8FA8), ref: 00007FF6139A910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A9152

Strings

I64, xrefs: 00007FF6139A9105
I32, xrefs: 00007FF6139A90E5

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: a47212c89471e80574d32abf2d57b142d35ca8e7c22bef0864889be9cf398db5
Instruction ID: 29f24cd519500bb38fdb77dfca74b236ad141dbbbc1ddb1a364fc1072657c446
Opcode Fuzzy Hash: a47212c89471e80574d32abf2d57b142d35ca8e7c22bef0864889be9cf398db5
Instruction Fuzzy Hash: 8CF08225B1DE4381EB104B26D85577A3A98BF4AFE4F095A31C91FD62E6EE1CD204C310

Function 00007FF6139A91CA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6139A8FA8), ref: 00007FF6139A90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF6139A8FA8), ref: 00007FF6139A910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A9152

Strings

I64, xrefs: 00007FF6139A9105
I32, xrefs: 00007FF6139A90E5

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 99a124b7da873222bd242a2a80f7ee9b642aaf26a40535330719751bb5e961a6
Instruction ID: b0e335bbfc29e8da0d39b404b4bcee4ca68a9bcdb40c4232001c345e17c0fa73
Opcode Fuzzy Hash: 99a124b7da873222bd242a2a80f7ee9b642aaf26a40535330719751bb5e961a6
Instruction Fuzzy Hash: F2F08225B1DE4381EB104B26D8557793A98BF4AFE4F095A31C91FD62E6EE1DD204C310

Function 00007FF6139D11C0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF6139A6576), ref: 00007FF6139D11D4

Strings

%lx, xrefs: 00007FF6139D14BA

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: c18ae29bb276a8ad680b31d530baec24a6480b71590a79a41d77ef7598f730cd
Instruction ID: ac9170b032581e6f522e3f7361587a1a345a5a107f4db82d3d8eae859d0c7e24
Opcode Fuzzy Hash: c18ae29bb276a8ad680b31d530baec24a6480b71590a79a41d77ef7598f730cd
Instruction Fuzzy Hash: 5E814FA3A1C5D145EBA88A25945327D7BD0FB85BA4F184636E69FE27C2FE3CD441C700

Function 00007FF6139CE75F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139CE855
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139CE8B7

Strings

%ld, xrefs: 00007FF6139CE78C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: ac70dd28215ecf0eaff7103c99b32800d312326dd7842514aad38126b35053d6
Instruction ID: 5cf6a5e4df9eff481888a84c6e2a3ed62c1f2366144ce4840a2e541c8c4b7575
Opcode Fuzzy Hash: ac70dd28215ecf0eaff7103c99b32800d312326dd7842514aad38126b35053d6
Instruction Fuzzy Hash: 08318D22E09E8281FB65CB5491623BA36A0AF44F65F480835DA4FA7696FF3CE8448750

Function 00007FF6139AA680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139AA6F9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139AA792

Strings

identity, xrefs: 00007FF6139AA6B4, 00007FF6139AA723, 00007FF6139AA78B

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: f93b67b2edb0c97d754ad6eb4325252d7f86d04025bba17c1a817ce8625e0f09
Instruction ID: 8c559082f78f431d226c09472c3085838f132dd84805e9730ab3a2899e4e0eb9
Opcode Fuzzy Hash: f93b67b2edb0c97d754ad6eb4325252d7f86d04025bba17c1a817ce8625e0f09
Instruction Fuzzy Hash: BD318D25E09F42C2FB518B169941279B7A0EF54FB4F095A31CE2EA77E6FE2CE4518300

Function 00007FF6139A8CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A8D10
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A8D6B

Strings

, xrefs: 00007FF6139A8D23

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction ID: 80a7cb0d3c89b63d6f790a12dbda4fb6992321cbccb47e15522741910d94bcba
Opcode Fuzzy Hash: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction Fuzzy Hash: F111BE73A09F8182DB548F15F0002697BA0FB18FE4F484A35DA5E6B799EF38D891C340

Function 00007FF6139A54C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139A5505
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139A552C

Strings

%I64d-, xrefs: 00007FF6139A5517

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: 1b09a0f9ec2cdcf79c216dadba7648dfc26f4f2795125d582cdf8d7fb230f003
Instruction ID: 68b067c0f130b04ac363bfbe855257067fe3772de8cfff3c22562424cb2694d2
Opcode Fuzzy Hash: 1b09a0f9ec2cdcf79c216dadba7648dfc26f4f2795125d582cdf8d7fb230f003
Instruction Fuzzy Hash: 3211E972F0AE82C1EB548B6994063F427E1FB54F65F1C5535C94E8E263EF2C94968310

Function 00007FF6139D9AC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6139D9ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139D9EBF

Strings

TRUE, xrefs: 00007FF6139D9EC9

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: ad9779da957951eca70e867832938f9a96f8dab6fd6b606cbe80922ad7a3ef30
Instruction ID: 430c028688ef4f63717f20fb90fa9652c13eb03fa26f2f5f7e0e60f36d72baeb
Opcode Fuzzy Hash: ad9779da957951eca70e867832938f9a96f8dab6fd6b606cbe80922ad7a3ef30
Instruction Fuzzy Hash: D5019266B09E5584EB429F56E5022782B62BB04FF8F444C32CE0FA6786EE3CD085C310

Function 00007FF613998520 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139987EA
memcpy.VCRUNTIME140 ref: 00007FF61399891C
memcpy.VCRUNTIME140 ref: 00007FF613998938

Part of subcall function 00007FF6139ADDD0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139966F3,?,?,00000000,00007FF6139A0FC2,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139ADE0C

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: c4f4cead081543eee998664c6e26dde1d499f2edb648bd068f105d442ca860eb
Instruction ID: ffcf0e78ab2bb231ceb165ca541487e7e4dc03a48e7f0075e6c33db806dfb01e
Opcode Fuzzy Hash: c4f4cead081543eee998664c6e26dde1d499f2edb648bd068f105d442ca860eb
Instruction Fuzzy Hash: C6C15132B18B028AE7149F65D4017AD3765BB44BB8F444A39CE2EAB7D9EF38D445C740

Function 00007FF6139DD270 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6139D03A8), ref: 00007FF6139DD2A1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6139D03A8), ref: 00007FF6139DD2B4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6139D03A8), ref: 00007FF6139DD2DB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF6139D03A8), ref: 00007FF6139DD2E8

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction ID: 6fdfd3e5bc9e44bccf50680c17ec4b297250019536ad9cdb4a9d184a5b7b2f02
Opcode Fuzzy Hash: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction Fuzzy Hash: B5117325B08B4282E7208F1AF44107AA6A0FF88FE8B480935DB5E97B59EF3CD4408740

Function 00007FF61399BC00 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF613995730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF61399FD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF613991B61), ref: 00007FF613995757
Part of subcall function 00007FF613995730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF61399FD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF613991B61), ref: 00007FF613995763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399BC36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399BC46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF61399BC54
memset.VCRUNTIME140 ref: 00007FF61399BC8F

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction ID: 3ae9fc99f362fcd6b5318a395d15c6a64ac465f10d386010ecab2c363a8fc853
Opcode Fuzzy Hash: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction Fuzzy Hash: 5D213D32E18B9193E704CB22DA412AD6760F799B50F549225EB8D53A12EF74F1F1C300

Function 00007FF6139C2C00 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C2C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C2C5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C2C7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6139C2C8E

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction ID: b2fd18f6674f84b766349f0389b90182f0d4e0af8d146df4e20726c43400840b
Opcode Fuzzy Hash: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction Fuzzy Hash: 5F114C36618F40C6DB808F25E5812A877A4F784F94F484075DF8EAB329CF38E899C340

Function 00007FF6139D4840 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D093E), ref: 00007FF6139D4866
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D093E), ref: 00007FF6139D4887
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D093E), ref: 00007FF6139D48A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139D093E), ref: 00007FF6139D48B0

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2124235a9113e76acb7eecb01da0754f535a2c886931aa00cef68c70ac2a9cfc
Instruction ID: 1a6dd1ad7c2a9baf51b96fc5103d7f34d41c39cadb125866dffbb03c7a02efb0
Opcode Fuzzy Hash: 2124235a9113e76acb7eecb01da0754f535a2c886931aa00cef68c70ac2a9cfc
Instruction Fuzzy Hash: 5511FA36618F4182DB44DF25E99116C7BA8FF94FA87140426DE4E97769DF38D894C380

Function 00007FF6139D21E0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A8405,?,?,00000000,00007FF6139A10C1,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139D21F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A8405,?,?,00000000,00007FF6139A10C1,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139D2216
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A8405,?,?,00000000,00007FF6139A10C1,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139D2224
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF6139A8405,?,?,00000000,00007FF6139A10C1,?,?,00000000,00007FF6139A15F5), ref: 00007FF6139D2232

Memory Dump Source

Source File: 00000000.00000002.2250326138.00007FF613981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF613980000, based on PE: true

Associated: 00000000.00000002.2250309877.00007FF613980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250369486.00007FF6139E1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250390465.00007FF6139F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250405631.00007FF6139F9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff613980000_bC7vK74a5a.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction ID: 111b19963bc83ff627cca31fd5a93aa27f7cc40198395bb62f28f080e90365ef
Opcode Fuzzy Hash: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction Fuzzy Hash: 87F03732618F0082DB448F22F8814287BB8FF98FA87144431DE9E8B729DF38C8A4C340

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bC7vK74a5a.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bC7vK74a5a.exe_3d1df02cfb4a4a20b131a6e5094572abda3813_f313f8e1_86d6d614-7dbd-4c82-b5d8-5051dfa7ebd8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E54.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F4F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F8E.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
bC7vK74a5a.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre