Edit tour

Windows Analysis Report
J1un7vGf29.exe

Overview

General Information

Sample name:	J1un7vGf29.exe renamed because original name is a hash value
Original sample name:	40f68d8b1be0f31f4aaf28dccf2f94cb.exe
Analysis ID:	1538242
MD5:	40f68d8b1be0f31f4aaf28dccf2f94cb
SHA1:	f5fbda24294289b81a77c12573ee33cea52ac408
SHA256:	98373f6033f41eff577963ce2a8cde8f09394e63de31c866ef5d265b714a9ed9
Tags:	64exetrojan
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

J1un7vGf29.exe (PID: 1080 cmdline: "C:\Users\user\Desktop\J1un7vGf29.exe" MD5: 40F68D8B1BE0F31F4AAF28DCCF2F94CB)

conhost.exe (PID: 2000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1576 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1784 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1088 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6660 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4464 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6580 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5760 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 2884 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1480 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 2944 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5972 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3528 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4996 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7096 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5552 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7108 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1264 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

WerFault.exe (PID: 5428 cmdline: C:\Windows\system32\WerFault.exe -pss -s 476 -p 1080 -ip 1080 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cmd.exe (PID: 528 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 432 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1216 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6468 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6604 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 4768 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5760 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6276 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2860 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6780 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3496 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3652 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1396 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5720 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1784 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1264 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 5960 cmdline: C:\Windows\system32\WerFault.exe -u -p 1080 -s 996 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: J1un7vGf29.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for sample

Source: J1un7vGf29.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D909F3D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF63D909F3D
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92EF30 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF63D92EF30
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF63D92CE40
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D925AD0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF63D925AD0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D909300 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF63D909300
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D90C1C0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF63D90C1C0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D90C220 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF63D90C220
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D909230 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF63D909230
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D90C210 CryptHashData,	0_2_00007FF63D90C210
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D9263F0 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF63D9263F0

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF63D8EF0E0
Source: J1un7vGf29.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF63D918B00

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: J1un7vGf29.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Plus\x64\Release\EpicGames.pdb source: J1un7vGf29.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D8F5ED0 malloc,recv,send,WSAGetLastError,

0_2_00007FF63D8F5ED0

Source: global traffic	DNS traffic detected: DNS query: keyauth.win
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: J1un7vGf29.exe	String found in binary or memory: http://185.101.104.122/plushvciforabronkz.exe
Source: J1un7vGf29.exe	String found in binary or memory: http://185.101.104.122/plushvciforabronkz.exeC:
Source: J1un7vGf29.exe	String found in binary or memory: http://185.101.104.122/plushvcionbronkz.exe
Source: J1un7vGf29.exe	String found in binary or memory: http://185.101.104.122/plushvcionbronkz.exeC:
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: J1un7vGf29.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: J1un7vGf29.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: J1un7vGf29.exe, 00000000.00000002.2277194844.00000269A19BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: J1un7vGf29.exe, 00000000.00000002.2277194844.00000269A19BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/emNU
Source: J1un7vGf29.exe, 00000000.00000002.2277194844.00000269A19BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D92CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF63D92CE40

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D909F3D	0_2_00007FF63D909F3D
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F6980	0_2_00007FF63D8F6980
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F8980	0_2_00007FF63D8F8980
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F7CC0	0_2_00007FF63D8F7CC0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8FF590	0_2_00007FF63D8FF590
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8E1530	0_2_00007FF63D8E1530
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92EEC0	0_2_00007FF63D92EEC0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92CE40	0_2_00007FF63D92CE40
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8DDDE0	0_2_00007FF63D8DDDE0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8D1000	0_2_00007FF63D8D1000
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D909FFC	0_2_00007FF63D909FFC
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D90A005	0_2_00007FF63D90A005
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D925AD0	0_2_00007FF63D925AD0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D9149F0	0_2_00007FF63D9149F0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8E8990	0_2_00007FF63D8E8990
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D907CC0	0_2_00007FF63D907CC0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8DABFD	0_2_00007FF63D8DABFD
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8DEB70	0_2_00007FF63D8DEB70
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D90C5D0	0_2_00007FF63D90C5D0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F0600	0_2_00007FF63D8F0600
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8D955D	0_2_00007FF63D8D955D
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D9215B0	0_2_00007FF63D9215B0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D920580	0_2_00007FF63D920580
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F9840	0_2_00007FF63D8F9840
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D902890	0_2_00007FF63D902890
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8D973B	0_2_00007FF63D8D973B
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F3330	0_2_00007FF63D8F3330
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8DD250	0_2_00007FF63D8DD250
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D91D220	0_2_00007FF63D91D220
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D919520	0_2_00007FF63D919520
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D9053E0	0_2_00007FF63D9053E0

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8F8E80 appears 35 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8FA2A0 appears 37 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8FA410 appears 34 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8F5970 appears 378 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D930236 appears 47 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8F5AF0 appears 323 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8F8DB0 appears 46 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8E3030 appears 49 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8FA330 appears 33 times
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: String function: 00007FF63D8F0240 appears 70 times

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 1080 -ip 1080

Source: classification engine

Classification label: mal56.evad.winEXE@71/22@2/2

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D8E1E4E FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF63D8E1E4E

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1080
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7631b105-76b9-49a4-ac54-849ab36e09e5

Jump to behavior

Source: J1un7vGf29.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: J1un7vGf29.exe

ReversingLabs: Detection: 39%

Source: J1un7vGf29.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\J1un7vGf29.exe "C:\Users\user\Desktop\J1un7vGf29.exe"
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 1080 -ip 1080
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1080 -s 996
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: J1un7vGf29.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: J1un7vGf29.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: J1un7vGf29.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: J1un7vGf29.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: J1un7vGf29.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: J1un7vGf29.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: J1un7vGf29.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: J1un7vGf29.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: J1un7vGf29.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Plus\x64\Release\EpicGames.pdb source: J1un7vGf29.exe

Source: J1un7vGf29.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: J1un7vGf29.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: J1un7vGf29.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: J1un7vGf29.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: J1un7vGf29.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D8F8980 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF63D8F8980

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\J1un7vGf29.exe

API coverage: 4.3 %

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: J1un7vGf29.exe, 00000000.00000002.2277194844.00000269A19BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWbl
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D92FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF63D92FD4C

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D9300E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF63D9300E8

Source: C:\Users\user\Desktop\J1un7vGf29.exe

0_2_00007FF63D8F8980

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92FEF4 SetUnhandledExceptionFilter,	0_2_00007FF63D92FEF4
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF63D92FD4C
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D92F9F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF63D92F9F4

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\J1un7vGf29.exe

Code function: 0_2_00007FF63D92FF64 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF63D92FF64

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D904A60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF63D904A60
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D9149F0 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF63D9149F0
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D8F7630 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF63D8F7630
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D91B750 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF63D91B750
Source: C:\Users\user\Desktop\J1un7vGf29.exe	Code function: 0_2_00007FF63D91B4F1 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF63D91B4F1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
J1un7vGf29.exe	39%	ReversingLabs	Win64.Trojan.Generic
J1un7vGf29.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		unknown
241.42.69.40.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.101.104.122/plushvcionbronkz.exe	J1un7vGf29.exe	false		unknown
http://upx.sf.net	Amcache.hve.38.dr	false	URL Reputation: safe	unknown
http://185.101.104.122/plushvciforabronkz.exeC:	J1un7vGf29.exe	false		unknown
http://185.101.104.122/plushvciforabronkz.exe	J1un7vGf29.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html	J1un7vGf29.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	J1un7vGf29.exe	false		unknown
https://keyauth.win/api/1.2/	J1un7vGf29.exe, 00000000.00000002.2277194844.00000269A19BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/plushvcionbronkz.exeC:	J1un7vGf29.exe	false		unknown
https://keyauth.win/api/1.1/emNU	J1un7vGf29.exe, 00000000.00000002.2277194844.00000269A19BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538242
Start date and time:	2024-10-20 21:20:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	J1un7vGf29.exe renamed because original name is a hash value
Original Sample Name:	40f68d8b1be0f31f4aaf28dccf2f94cb.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@71/22@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 232
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 52.168.117.173, 13.85.23.206, 20.242.39.171, 20.189.173.21
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: J1un7vGf29.exe

Simulations

Behavior and APIs

Time	Type	Description
15:21:25	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.0.5	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.12317.30120.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8093.16745.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.7929.18094.exe	Get hash	malicious	Unknown	Browse
	FREE TEST.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Frozen_Slotted.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.0.5
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	104.26.0.5
	ojSv9FmOwn.lnk	Get hash	malicious	Unknown	Browse	104.26.0.5
	a1OueQJq4d.exe	Get hash	malicious	DCRat	Browse	104.26.0.5
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.26.0.5
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.26.0.5

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_J1un7vGf29.exe_5cd87136c5f8c6d2a2edad2aab90e620989ace30_5a213bd4_6075f31e-8a75-4958-baa0-25eb9dc96c5d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9985976635316371
Encrypted:	false
SSDEEP:	96:ZiFVKm6JsmhL1c7L4faQXIDcQlc6bcEocw3M+HbHg/8BRTf3o8Fa9KUNsPQHdfmO:Y/d6Jz0bfy5jvVmczuiFVZ24lO8L0
MD5:	1E8E7D8D6D6538850E095ED57EA165A6
SHA1:	9EA5007283243809310C8AD874F297A3C3DCD82B
SHA-256:	0F0DDB8B0954E86C6A461085753F49D22509E9A63EAB4442EB55F39BE2637149
SHA-512:	6A704EF475E0E060EDD4B95C36836176112D0ADD7AED91FAA02229A131B348FC7788A1C994F086C093E0B8D56A3B063C86110F0C59EC920E86704D2422B15F80
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.2.5.6.7.4.5.4.5.5.9.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.2.5.6.7.5.5.1.4.3.5.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.7.5.f.3.1.e.-.8.a.7.5.-.4.9.5.8.-.b.a.a.0.-.2.5.e.b.9.d.c.9.6.c.5.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.d.7.2.3.8.9.7.-.6.7.4.d.-.4.0.3.4.-.9.5.2.4.-.7.b.7.9.e.3.c.b.9.0.7.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.J.1.u.n.7.v.G.f.2.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.3.8.-.0.0.0.1.-.0.0.1.4.-.5.6.5.d.-.8.e.3.6.2.5.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.6.1.e.e.8.b.b.2.3.b.c.7.9.4.c.6.f.7.a.4.2.4.2.f.6.2.2.6.0.3.f.0.0.0.0.f.f.f.f.!.0.0.0.0.f.5.f.b.d.a.2.4.2.9.4.2.8.9.b.8.1.a.7.7.c.1.2.5.7.3.e.e.3.3.c.e.a.5.2.a.c.4.0.8.!.J.1.u.n.7.v.G.f.2.9...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD85B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 19:21:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	102636
Entropy (8bit):	1.653538048175926
Encrypted:	false
SSDEEP:	384:F6JCtgaH20g/fBRuKMsTdpCkOOdiK7ckYjTB5mUuxgF:FPt20KfBRuKMsTdskOOdiNkYJ3
MD5:	881CEA93A0A608DB18D8DB0157112E82
SHA1:	0399DCB9182F46AB2B63E6966F80C77D1FBC45B3
SHA-256:	15BD528A05548B90164CAFE9D41E136B48B36ECDF2A23A087C7780B0D90BA3E4
SHA-512:	C6E77F98D373D8B114FB79A8259849723FF16699243F6DFCC6537732D53C4D4BD7D9F19D14489F5F0CF9101E9E185B907CEF54240EB1A685924400FA7913350D
Malicious:	false
Preview:	MDMP..a..... .......+X.g............$...............,............J..........T.......8...........T...........p'..\|i.......................!..............................................................................eJ......T"......Lw......................T.......8...#X.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB1B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10136
Entropy (8bit):	3.71624672543535
Encrypted:	false
SSDEEP:	192:R6l7wVeJMyqt6YEIBiMEODgmfJeprH89bCvVLfCQ/m:R6lXJMHt6YEeDEODgmfJTq5fS
MD5:	7AB169485CB65513706652EC64C711E0
SHA1:	C2C97F5854F080103A0E0F629296D2D8970A8332
SHA-256:	37158833005BC87B876012EDE47369F79924C9E5D3333D6EE303E8E6523CB346
SHA-512:	5E37D81770B67A2AB0CEA77A2BEAFCD57B1C9E6D52E8887F818CA1D5954D60066FC290B74F3AF2D43276EFA4F2EC4BD071789DD51D71BEBFA6E76EC219273D4D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB4B.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.463614685231288
Encrypted:	false
SSDEEP:	48:cvIwWl8zskJg771I9B/KWpW8VYFYm8M4J1u3A0FwQyq85BcApbCPXtSbFSbSeBd:uIjfiI7c/r7VVJ1uwwKcQiXtSRoSMd
MD5:	13BD4C9BFF4503371342F382AB1CF18B
SHA1:	29DC6BA814E3FFEA443C66D3A01BE4E94679BEF9
SHA-256:	7348F61128AC9AD0DB778C42A7F5626EBBDCA74BB425B798A948D13DD1C6A3ED
SHA-512:	9399456CC65BD724A68F87C88343289476C93E95ED3634F79E9420CE61226CEE872957306E841F51A3710E99B9104E2DFCD18ABCB66C1C4C1A636975D743F3DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552143" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421643162156298
Encrypted:	false
SSDEEP:	6144:ESvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnN/0uhiTw:PvloTMW+EZMM6DFyt03w
MD5:	0B6AA841D7B4F51C2AE43CAFFBBD0F4B
SHA1:	0C6B6AC2FA3C80B3337420D3106427BCEDEEDBCB
SHA-256:	354F2C8197EE1FE6C2C19A022596CAC0C97A61C23965D8964927D3A8B46D8958
SHA-512:	3D3D4DDF6662596E98EC04CF09D67C3E2AE9554BED98675AB556837D1DE0A341D9C2A2D43F0737CE5A72AC2D8279F6726F4DE6093BE7AA0565AF73333D2131CB
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV^.:%#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.423311038978997
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	J1un7vGf29.exe
File size:	506'368 bytes
MD5:	40f68d8b1be0f31f4aaf28dccf2f94cb
SHA1:	f5fbda24294289b81a77c12573ee33cea52ac408
SHA256:	98373f6033f41eff577963ce2a8cde8f09394e63de31c866ef5d265b714a9ed9
SHA512:	1205819096ac09cd4b72071bf263281801810be3384ddea79e1290c572d09aeb44c9975441fe86c2a7c0a99d69381436909c3cd2056ecdaad9bf7860bacee614
SSDEEP:	6144:Fi8fZ/nLeOlMAiyTI+BS6oIC2Dbe/MZWdLpID+RMcA2dHDad2m2+yFMCPaf1:FTfFOf8IyS4LDb6dlIDuzAIOboMCif1
TLSH:	C8B46D56A7A807E9D1A7D03CC547C603E7B6B4991311DBDB43A0CA791F63BE12E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005f9d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670FDA3D [Wed Oct 16 15:22:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F58FCB87EE8h
dec eax
add esp, 28h
jmp 00007F58FCB877D7h
int3
int3
jmp 00007F58FCB88198h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000178Bh]
dec eax
mov ecx, ebx
call dword ptr [000016F2h]
call dword ptr [00001774h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001770h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001764h]
test eax, eax
je 00007F58FCB87969h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018E12h]
call 00007F58FCB87B2Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EF9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E89h], eax
dec eax
mov eax, dword ptr [00018EE2h]
dec eax
mov dword ptr [00018D53h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E57h], eax
mov dword ptr [00018D2Dh], C0000409h
mov dword ptr [00018D27h], 00000001h
mov dword ptr [00000031h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffd0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe90	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fda8	0x5fe00	e35c1164add83fd7293b483158519475	False	0.5326963820078227	data	6.336155931731169	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	7f349d336d6f386b2fdcc2d10122a56b	False	0.3797862293956044	data	5.57889875441676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	3cfa1d3706d13e34002335316e18545c	False	0.212890625	data	2.4386708342051575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	50e902fb009b515c9924ff6238b5e51d	False	0.48175048828125	data	5.776998787420237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	0fffa779ce3f96440fc92f1aa0c636a8	False	0.5123697916666666	data	4.824092949506385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:21:11.296596050 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:11.296649933 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:11.296747923 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:11.332803011 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:11.332844019 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.112807989 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.112900972 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:12.117033005 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:12.117046118 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.117392063 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.124320030 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:12.171403885 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.312694073 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.312757015 CEST	443	49710	104.26.0.5	192.168.2.5
Oct 20, 2024 21:21:12.312839985 CEST	49710	443	192.168.2.5	104.26.0.5
Oct 20, 2024 21:21:26.396496058 CEST	49710	443	192.168.2.5	104.26.0.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:21:11.266422033 CEST	63535	53	192.168.2.5	1.1.1.1
Oct 20, 2024 21:21:11.280337095 CEST	53	63535	1.1.1.1	192.168.2.5
Oct 20, 2024 21:21:40.517637014 CEST	53	61325	162.159.36.2	192.168.2.5
Oct 20, 2024 21:21:41.290982008 CEST	53595	53	192.168.2.5	1.1.1.1
Oct 20, 2024 21:21:41.298002958 CEST	53	53595	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 21:21:11.266422033 CEST	192.168.2.5	1.1.1.1	0xd514	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:41.290982008 CEST	192.168.2.5	1.1.1.1	0x8865	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 21:21:11.280337095 CEST	1.1.1.1	192.168.2.5	0xd514	No error (0)	keyauth.win		104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:11.280337095 CEST	1.1.1.1	192.168.2.5	0xd514	No error (0)	keyauth.win		104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:11.280337095 CEST	1.1.1.1	192.168.2.5	0xd514	No error (0)	keyauth.win		172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:41.298002958 CEST	1.1.1.1	192.168.2.5	0x8865	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	104.26.0.5	443	1080	C:\Users\user\Desktop\J1un7vGf29.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 19:21:12 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-20 19:21:12 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 31 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.1&name=loader principal&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\J1un7vGf29.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\J1un7vGf29.exe"
Imagebase:	0x7ff63d8d0000
File size:	506'368 bytes
MD5 hash:	40F68D8B1BE0F31F4AAF28DCCF2F94CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff726570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff726570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6d64d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 4996, Parent PID: 3528

General

Target ID:	15
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 5552, Parent PID: 7096

General

Target ID:	17
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1264, Parent PID: 7108

General

Target ID:	19
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 432, Parent PID: 528

General

Target ID:	21
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff726570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6468, Parent PID: 1216

General

Target ID:	23
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff726570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 4768, Parent PID: 1080

General

Target ID:	25
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 5760, Parent PID: 4768

General

Target ID:	26
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 2860, Parent PID: 6276

General

Target ID:	28
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7427d0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 1396, Parent PID: 3652

General

Target ID:	32
Start time:	15:21:13
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff726570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 1784, Parent PID: 5720

General

Target ID:	34
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff726570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6b2150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WerFault.exePID: 5428, Parent PID: 7108

General

Target ID:	37
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 476 -p 1080 -ip 1080
Imagebase:	0x7ff73b510000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1080 -s 996
Imagebase:	0x7ff73b510000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	90

Executed Functions

Function 00007FF63D8FF590 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FF668
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FF675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FF748
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FF7CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FF873
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FF90A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FF9D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FFA0D
strchr.VCRUNTIME140 ref: 00007FF63D8FFB87
strchr.VCRUNTIME140 ref: 00007FF63D8FFB9A
strchr.VCRUNTIME140 ref: 00007FF63D8FFBAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FFCB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FFD23
memcpy.VCRUNTIME140 ref: 00007FF63D8FFD4A
strchr.VCRUNTIME140 ref: 00007FF63D8FFD5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FFD72
strstr.VCRUNTIME140 ref: 00007FF63D8FFFA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9000E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D900259

Part of subcall function 00007FF63D8F8DB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F8E23

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90030C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D900391
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9005EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D900600
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90060F

Part of subcall function 00007FF63D901960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019BA

strchr.VCRUNTIME140 ref: 00007FF63D900BC7
strchr.VCRUNTIME140 ref: 00007FF63D900BDA
strchr.VCRUNTIME140 ref: 00007FF63D900BEC

Part of subcall function 00007FF63D901960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019DA
Part of subcall function 00007FF63D901960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019E3

strchr.VCRUNTIME140 ref: 00007FF63D900E3F
strchr.VCRUNTIME140 ref: 00007FF63D900E52
strchr.VCRUNTIME140 ref: 00007FF63D900E64

Part of subcall function 00007FF63D903F90: strchr.VCRUNTIME140 ref: 00007FF63D904076
Part of subcall function 00007FF63D903F90: strchr.VCRUNTIME140 ref: 00007FF63D904089
Part of subcall function 00007FF63D903F90: strchr.VCRUNTIME140 ref: 00007FF63D90409B

Strings

%s?%s, xrefs: 00007FF63D8FF765
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF63D900DC1
0, xrefs: 00007FF63D900FB6, 00007FF63D9010B5
Range, xrefs: 00007FF63D9000C2
Proxy-Connection: Keep-Alive, xrefs: 00007FF63D90048F, 00007FF63D9004A4
Expect, xrefs: 00007FF63D900B64, 00007FF63D900DD9
;type=%c, xrefs: 00007FF63D900011
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF63D9005CB
1.1, xrefs: 00007FF63D9002FE
ftp, xrefs: 00007FF63D8FFF79
POST, xrefs: 00007FF63D8FF715
Transfer-Encoding:, xrefs: 00007FF63D8FFB3E
%x, xrefs: 00007FF63D900F65
Failed sending HTTP POST request, xrefs: 00007FF63D90106B
Could only read %I64d bytes from the input, xrefs: 00007FF63D900215
Transfer-Encoding: chunked, xrefs: 00007FF63D8FFC7F
%s%s, xrefs: 00007FF63D9007A0
User-Agent, xrefs: 00007FF63D8FF72D
Proxy-Connection, xrefs: 00007FF63D900463
http, xrefs: 00007FF63D8FFF0B
HEAD, xrefs: 00007FF63D8FF6D1
Failed sending PUT request, xrefs: 00007FF63D900A39
Content-Length: 0, xrefs: 00007FF63D900A60
PUT, xrefs: 00007FF63D8FF708
%s%s=%s, xrefs: 00007FF63D900719
GET, xrefs: 00007FF63D8FF722
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF63D9008E4
%s , xrefs: 00007FF63D900323
If-Modified-Since, xrefs: 00007FF63D90085D
Content-Range: bytes %s/%I64d, xrefs: 00007FF63D9002A6
Invalid TIMEVALUE, xrefs: 00007FF63D900813
Failed sending HTTP request, xrefs: 00007FF63D900D36
100-continue, xrefs: 00007FF63D900C06, 00007FF63D900E86
Content-Length, xrefs: 00007FF63D9009A4, 00007FF63D900AF9, 00007FF63D900D7E
Accept-Encoding, xrefs: 00007FF63D8FF9B1
Failed sending POST request, xrefs: 00007FF63D900A99, 00007FF63D900CDD
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF63D90116E
multipart/form-data, xrefs: 00007FF63D8FFABA
Content-Type, xrefs: 00007FF63D8FFA77, 00007FF63D900DAD
Host:%s, xrefs: 00007FF63D8FFDB6
Last-Modified, xrefs: 00007FF63D90084B
?%s, xrefs: 00007FF63D9003FB
Transfer-Encoding, xrefs: 00007FF63D8FFB1D
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF63D900298
Cookie: , xrefs: 00007FF63D9006FE, 00007FF63D900774
Host: %s%s%s, xrefs: 00007FF63D8FFE2D
File already completely uploaded, xrefs: 00007FF63D9001F9
Host: %s%s%s:%d, xrefs: 00007FF63D8FFE72
Host:, xrefs: 00007FF63D8FFD81
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF63D8FFC8C
Cookie, xrefs: 00007FF63D8FF992
OPTIONS, xrefs: 00007FF63D8FF6FB
;type=, xrefs: 00007FF63D8FFF9E
If-Unmodified-Since, xrefs: 00007FF63D900854
Content-Range, xrefs: 00007FF63D90023E
Accept-Encoding: %s, xrefs: 00007FF63D8FF9E2
ftp://%s:%s@%s, xrefs: 00007FF63D9003BB
chunked, xrefs: 00007FF63D8FFBC6
Host, xrefs: 00007FF63D8FFCB9
Referer, xrefs: 00007FF63D8FF923
Referer: %s, xrefs: 00007FF63D8FF93E
1.0, xrefs: 00007FF63D9002F0
Expect:, xrefs: 00007FF63D900B85, 00007FF63D900DFA
Accept: */*, xrefs: 00007FF63D900075
%s, xrefs: 00007FF63D900B43
Accept, xrefs: 00007FF63D900063
Could not seek stream, xrefs: 00007FF63D900158
Range: bytes=%s, xrefs: 00007FF63D9000EE
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF63D900274
Content-Length: %I64d, xrefs: 00007FF63D9009BB, 00007FF63D900B10, 00007FF63D900D95

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 7786becf68336d0054d3751eb5a69a9aec0b7b775e65eefc63fcc71cb1334378
Instruction ID: 228dca9ffb0023187ec483f8986550e9e5d97198161aa5480b1c26377f21eaa5
Opcode Fuzzy Hash: 7786becf68336d0054d3751eb5a69a9aec0b7b775e65eefc63fcc71cb1334378
Instruction Fuzzy Hash: D603AC21B08A8A95FB648BA5A8402B927E5AF45BC8F444035CE5DD77DAFF3CF459E300

Function 00007FF63D909F3D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D90A098
strchr.VCRUNTIME140 ref: 00007FF63D90A0C4
strchr.VCRUNTIME140 ref: 00007FF63D90A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90A122
strchr.VCRUNTIME140 ref: 00007FF63D90A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90A24A

Strings

schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF63D90A2B0
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF63D90A622
schannel: unable to allocate memory, xrefs: 00007FF63D90A5BC, 00007FF63D90A847
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF63D90A6B5
http/1.1, xrefs: 00007FF63D90A753
LocalMachine, xrefs: 00007FF63D90A153
LocalMachineEnterprise, xrefs: 00007FF63D90A20B
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF63D90A54F
LocalMachineGroupPolicy, xrefs: 00007FF63D90A1EC
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF63D909FCB
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF63D90A4D9
CurrentUserGroupPolicy, xrefs: 00007FF63D90A1CD
CurrentService, xrefs: 00007FF63D90A175
Users, xrefs: 00007FF63D90A1B6
schannel: ALPN, offering %s, xrefs: 00007FF63D90A775
CurrentUser, xrefs: 00007FF63D90A112
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF63D90A137
http/1.1, xrefs: 00007FF63D90A767
schannel: Failed to read cert file %s, xrefs: 00007FF63D90A5F9
Services, xrefs: 00007FF63D90A197
Microsoft Unified Security Protocol Provider, xrefs: 00007FF63D90A63F
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF63D90A504
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF63D90A733

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: f594f424c43ecc92778b926f78d702b8f711881766d09741b9e3cd8d16f4b1de
Instruction ID: 62470760add3514463eba4e51b728451438edd5ad499716e374cbc37d0e50eb1
Opcode Fuzzy Hash: f594f424c43ecc92778b926f78d702b8f711881766d09741b9e3cd8d16f4b1de
Instruction Fuzzy Hash: A142AB21B08B4A86EB248BA5F8506B927A4FF05BD4F444135CA5E877DAFF3CE548E740

Function 00007FF63D8E1530 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF63D8E155A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF63D8E1596
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF63D8E15C2
SetConsoleTitleA.KERNEL32 ref: 00007FF63D8E1640
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E1679
GetConsoleWindow.KERNELBASE ref: 00007FF63D8E1685
GetWindowLongPtrA.USER32 ref: 00007FF63D8E1696
SetWindowLongPtrA.USER32 ref: 00007FF63D8E16AC
SetLayeredWindowAttributes.USER32 ref: 00007FF63D8E16C0
GetStdHandle.KERNEL32 ref: 00007FF63D8E16D0
SetConsoleTextAttribute.KERNELBASE ref: 00007FF63D8E16DC
GetStdHandle.KERNEL32 ref: 00007FF63D8E16E7
SetConsoleTextAttribute.KERNELBASE ref: 00007FF63D8E16F3
GetStdHandle.KERNEL32 ref: 00007FF63D8E170A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1716

Part of subcall function 00007FF63D8E0680: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF63D8D11FA), ref: 00007FF63D8E075F

Part of subcall function 00007FF63D8E1A70: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF63D8E1728), ref: 00007FF63D8E1A94
Part of subcall function 00007FF63D8E1A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF63D8E1728), ref: 00007FF63D8E1AB5

GetStdHandle.KERNEL32 ref: 00007FF63D8E1739
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1745
GetStdHandle.KERNEL32 ref: 00007FF63D8E175C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1768
GetStdHandle.KERNEL32 ref: 00007FF63D8E177F
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E178B
GetStdHandle.KERNEL32 ref: 00007FF63D8E17A2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E17AE
GetStdHandle.KERNEL32 ref: 00007FF63D8E17C5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E17D1
GetStdHandle.KERNEL32 ref: 00007FF63D8E17E8
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E17F4
GetStdHandle.KERNEL32 ref: 00007FF63D8E1817
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1823
GetStdHandle.KERNEL32 ref: 00007FF63D8E183A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1846
GetStdHandle.KERNEL32 ref: 00007FF63D8E185D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1869
GetStdHandle.KERNEL32 ref: 00007FF63D8E188C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E1898
GetStdHandle.KERNEL32 ref: 00007FF63D8E18AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E18BB
GetStdHandle.KERNEL32 ref: 00007FF63D8E18D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF63D8E18DE
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF63D8E18FB
URLDownloadToFileA.URLMON ref: 00007FF63D8E194F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E195B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E1968
Sleep.KERNEL32 ref: 00007FF63D8E1973
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E197B
URLDownloadToFileA.URLMON ref: 00007FF63D8E19CD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E19D9
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E19E6
Sleep.KERNEL32 ref: 00007FF63D8E19F1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E19F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E1A32

Strings

start C:\Windows\System32\ServceHubeinssDialog.exe, xrefs: 00007FF63D8E19DF
start C:\Windows\System32\SerHuStinsHostDialog.exe, xrefs: 00007FF63D8E1961
Iniciar Valorant Plus (HVCI DESLIGADO): , xrefs: 00007FF63D8E17FA
##########################################################, xrefs: 00007FF63D8E176E
##########################################################, xrefs: 00007FF63D8E1728
http://185.101.104.122/plushvciforabronkz.exe, xrefs: 00007FF63D8E1909
[ Selecione uma opcao: ], xrefs: 00007FF63D8E174B
Selecione a opcao: , xrefs: 00007FF63D8E18E4
cd C:\, xrefs: 00007FF63D8E1954, 00007FF63D8E19D2
C:\Windows\System32\SerHuStinsHostDialog.exe, xrefs: 00007FF63D8E191A
C:\Windows\System32\ServceHubeinssDialog.exe, xrefs: 00007FF63D8E1998
http://185.101.104.122/plushvcionbronkz.exe, xrefs: 00007FF63D8E1987
Iniciar Valorant Plus (HVCI HABILITADO): , xrefs: 00007FF63D8E186F
.exe, xrefs: 00007FF63D8E1563

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant Plus (HVCI DESLIGADO): $ Iniciar Valorant Plus (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SerHuStinsHostDialog.exe$C:\Windows\System32\ServceHubeinssDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/plushvciforabronkz.exe$http://185.101.104.122/plushvcionbronkz.exe$start C:\Windows\System32\SerHuStinsHostDialog.exe$start C:\Windows\System32\ServceHubeinssDialog.exe
API String ID: 2233566951-898826868
Opcode ID: cca2fb6546bf5152dfcd3de78e74697b6a2be117a40d1dc4766663ca32929257
Instruction ID: 15da8c0f5e53c2d5cd6a42096ed9990a2cee07ca28cfd721f4a0ee6b6fce5d2a
Opcode Fuzzy Hash: cca2fb6546bf5152dfcd3de78e74697b6a2be117a40d1dc4766663ca32929257
Instruction Fuzzy Hash: DBE15B21E08A4B85EB00ABE1EC541BC6361AF85B99F404235D91ED67FAFF7CA54DE700

Function 00007FF63D8F8980 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF63D8F89A8
WSACleanup.WS2_32 ref: 00007FF63D8F89C3
GetModuleHandleA.KERNEL32 ref: 00007FF63D8F8A14
GetProcAddress.KERNEL32 ref: 00007FF63D8F8A40
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F8A5A
LoadLibraryA.KERNEL32 ref: 00007FF63D8F8A7D
GetProcAddress.KERNEL32 ref: 00007FF63D8F8A9A
LoadLibraryExA.KERNELBASE ref: 00007FF63D8F8AB0
GetSystemDirectoryA.KERNEL32 ref: 00007FF63D8F8AC6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F8ADE
GetSystemDirectoryA.KERNEL32 ref: 00007FF63D8F8AF2
LoadLibraryA.KERNEL32 ref: 00007FF63D8F8B60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F8B6C
GetProcAddress.KERNEL32 ref: 00007FF63D8F8B98
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8C21
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8C34
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8C43
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8C52
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8C62
VerifyVersionInfoA.KERNEL32 ref: 00007FF63D8F8C73
QueryPerformanceFrequency.KERNEL32 ref: 00007FF63D8F8C8F

Strings

kernel32, xrefs: 00007FF63D8F89FB
LoadLibraryExA, xrefs: 00007FF63D8F8A2E
AddDllDirectory, xrefs: 00007FF63D8F8A90
if_nametoindex, xrefs: 00007FF63D8F8B8E
iphlpapi.dll, xrefs: 00007FF63D8F8A46

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: dd8c520f1f9f42ea8cb78eec73e1dd8ca5308544d44c97ebf9fd234ba4bd7abd
Instruction ID: 6e88ec815bacfd1ccb0cae9b94ec2c937777b40af500d459e91335fd7d88bb13
Opcode Fuzzy Hash: dd8c520f1f9f42ea8cb78eec73e1dd8ca5308544d44c97ebf9fd234ba4bd7abd
Instruction Fuzzy Hash: 22919361A0D78A85EB60DB91E8043B973E1FF89B84F444635C94D877AAFF3CE0559710

Function 00007FF63D8F7CC0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8F7D5C
socket.WS2_32 ref: 00007FF63D8F7DA5
htons.WS2_32 ref: 00007FF63D8F7E31
setsockopt.WS2_32 ref: 00007FF63D8F7E93
WSAGetLastError.WS2_32 ref: 00007FF63D8F7E9D
getsockopt.WS2_32 ref: 00007FF63D8F7F3F
setsockopt.WS2_32 ref: 00007FF63D8F7F6E
setsockopt.WS2_32 ref: 00007FF63D8F7FAD
WSAIoctl.WS2_32 ref: 00007FF63D8F803A
WSAGetLastError.WS2_32 ref: 00007FF63D8F8044

Part of subcall function 00007FF63D904C90: ioctlsocket.WS2_32 ref: 00007FF63D904CA9

Part of subcall function 00007FF63D8FD7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF63D8E582F), ref: 00007FF63D8FD7C7

connect.WS2_32 ref: 00007FF63D8F816B
WSAGetLastError.WS2_32 ref: 00007FF63D8F8188

Part of subcall function 00007FF63D8E2500: GetLastError.KERNEL32 ref: 00007FF63D8E2522
Part of subcall function 00007FF63D8E2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E252A

Part of subcall function 00007FF63D8F5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8F5C15
Part of subcall function 00007FF63D8F5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8F5C30

Part of subcall function 00007FF63D8F65D0: closesocket.WS2_32 ref: 00007FF63D8F6613

Strings

Trying %s:%ld..., xrefs: 00007FF63D8F7E3F
@, xrefs: 00007FF63D8F7ED7
Immediate connect fail for %s: %s, xrefs: 00007FF63D8F81B8
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF63D8F804D
Could not set TCP_NODELAY: %s, xrefs: 00007FF63D8F7EBA
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF63D8F7FBA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF63D8F822E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 524e2a3f228159df98a537b1cc84da59102175569ade2581dca429d6bfd9567f
Instruction ID: 34ebe02692522b4d10cd38c6af8fc9f548e2fac6aa9e0374b9e9c74bf85b0b87
Opcode Fuzzy Hash: 524e2a3f228159df98a537b1cc84da59102175569ade2581dca429d6bfd9567f
Instruction Fuzzy Hash: BDF1C271A0868A86F7509BA5E8442BD63E8FB84B88F404535EA4DC77D9EF3CF545EB00

Function 00007FF63D904A60 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF63D904AA1
htonl.WS2_32 ref: 00007FF63D904ACE
setsockopt.WS2_32 ref: 00007FF63D904B05
bind.WS2_32 ref: 00007FF63D904B20
getsockname.WS2_32 ref: 00007FF63D904B3C
listen.WS2_32 ref: 00007FF63D904B51
socket.WS2_32 ref: 00007FF63D904B68
connect.WS2_32 ref: 00007FF63D904B87
accept.WS2_32 ref: 00007FF63D904B9E
send.WS2_32 ref: 00007FF63D904BEC
recv.WS2_32 ref: 00007FF63D904C0A
memcmp.VCRUNTIME140 ref: 00007FF63D904C25
closesocket.WS2_32 ref: 00007FF63D904C31

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 422b14c895b552d3fb477ae8a66caf64ac0e62345687c253540b9b0d801fd834
Instruction ID: 7048e7b26dccd9984b4872cdfb5aa8b8c88cc9f6fab7d824d8d1246adfc0ab78
Opcode Fuzzy Hash: 422b14c895b552d3fb477ae8a66caf64ac0e62345687c253540b9b0d801fd834
Instruction Fuzzy Hash: AE516331608A4A81D7549F65F8441A97361FB84BB4F504731EA7F877EAEF3CE8499B00

Function 00007FF63D8F6980 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %I64dms connect time, move on!, xrefs: 00007FF63D8F6B45
connect to %s port %ld failed: %s, xrefs: 00007FF63D8F6BFD
Connection time-out, xrefs: 00007FF63D8F6A69
Failed to connect to %s port %ld: %s, xrefs: 00007FF63D8F6EAE
Connection failed, xrefs: 00007FF63D8F6D66

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: c984adc69863b23597ee44e5849417d0b12463cb17c0a570fc6a8fad10e15d38
Instruction ID: bb9d16acc810e33c42ef0c98e75a723410aad01f1eb0ba00bc805465ee9615da
Opcode Fuzzy Hash: c984adc69863b23597ee44e5849417d0b12463cb17c0a570fc6a8fad10e15d38
Instruction Fuzzy Hash: 14E1FF22B0868A82EB548FA5E5413BD27E9FB89794F044236DA5D877D6EF3CF451D300

Function 00007FF63D8F5ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F5F96
recv.WS2_32 ref: 00007FF63D8F5FC0
send.WS2_32 ref: 00007FF63D8F5FE3
WSAGetLastError.WS2_32 ref: 00007FF63D8F5FF5

Strings

Send failure: %s, xrefs: 00007FF63D8F6025

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: b92a6bb485e119d2f1aaef0e347f2c5486e0f84e16fca4288dd7042815cbceb7
Instruction ID: cf2cb62bb26af674a7e45a384d1741e66feb325a0962c109762e52f815bbd7a8
Opcode Fuzzy Hash: b92a6bb485e119d2f1aaef0e347f2c5486e0f84e16fca4288dd7042815cbceb7
Instruction Fuzzy Hash: FA41AD22706B8985EB648FA5F80077967A4EB49BE8F144275CE6D87BD9EF3CE440D700

Function 00007FF63D8D2AA0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D28A7
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2917
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2977
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D29C7
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2A17

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2C48

Part of subcall function 00007FF63D8D48C0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D4980

Part of subcall function 00007FF63D92F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF63D8D43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D92F20A

Part of subcall function 00007FF63D8D4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D8D4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2C98
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2CD7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2D25
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2D64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2E18
memcpy.VCRUNTIME140 ref: 00007FF63D8D2E3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2F13
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2F5A
ShellExecuteA.SHELL32 ref: 00007FF63D8D3052
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D305A
MessageBoxA.USER32 ref: 00007FF63D8D3090
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D30A1
Sleep.KERNEL32 ref: 00007FF63D8D3109
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D3111
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8D3118

Part of subcall function 00007FF63D8D3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D326F
Part of subcall function 00007FF63D8D3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D32B0

Part of subcall function 00007FF63D8D3C30: memcpy.VCRUNTIME140 ref: 00007FF63D8D3C83

Part of subcall function 00007FF63D8D32D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D33B0

Part of subcall function 00007FF63D8D33D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D34B0

Strings

message, xrefs: 00007FF63D8D2FA3, 00007FF63D8D3061
sessionid, xrefs: 00007FF63D8D2E9E
invalidver, xrefs: 00007FF63D8D2FD9
Failure, xrefs: 00007FF63D8D3087
download, xrefs: 00007FF63D8D3015
success, xrefs: 00007FF63D8D2E76
open, xrefs: 00007FF63D8D3049

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: b06a594ced616a058355541c90b444d98ffa0c964cb55d9bc3ecd19065b6951b
Instruction ID: 4da64c614513c8d3fbcc5dfe82ada50220247ef45ccd088dc0fed05435ab4ade
Opcode Fuzzy Hash: b06a594ced616a058355541c90b444d98ffa0c964cb55d9bc3ecd19065b6951b
Instruction Fuzzy Hash: A702D762E08B8A85EB10DFA4E4443AD2761FF45798F405236DA6D877DAEF3CE584D340

Function 00007FF63D90B5C0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D90BC01
memcpy.VCRUNTIME140 ref: 00007FF63D90BC1D

Strings

schannel: Curl_read_plain returned error %d, xrefs: 00007FF63D90B961
schannel: remote party requests renegotiation, xrefs: 00007FF63D90B9E2
schannel: renegotiation failed, xrefs: 00007FF63D90BB8E
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF63D90BBA2
schannel: server closed the connection, xrefs: 00007FF63D90BA94
schannel: failed to read data from server: %s, xrefs: 00007FF63D90BB52
schannel: server indicated shutdown in a prior call, xrefs: 00007FF63D90B688
schannel: enough decrypted data is already available, xrefs: 00007FF63D90B645
schannel: unable to re-allocate memory, xrefs: 00007FF63D90B6FD, 00007FF63D90BB66
schannel: can't renogotiate, an error is pending, xrefs: 00007FF63D90BB82
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF63D90BA18
schannel: failed to decrypt data, need more data, xrefs: 00007FF63D90BB2A
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF63D90BA5F
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF63D90B665
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF63D90BBAE
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF63D90B78D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 40bec67c4f280abf8169a9c87595eced14b45029a4417c1ac000181a656fb29d
Instruction ID: 388f90fb938ea734d7257502a8059e95ced557d828e7599404cdc2ca2041d5c5
Opcode Fuzzy Hash: 40bec67c4f280abf8169a9c87595eced14b45029a4417c1ac000181a656fb29d
Instruction Fuzzy Hash: 7002D232A18B4986EB61DB49E88476A27A4FB44BDCF100536DE4DC77EAEF78E441D700

Function 00007FF63D90AA50 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90AB40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90AB91
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90ABD4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90ACB7
memcpy.VCRUNTIME140 ref: 00007FF63D90AD59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90ADC2
memcpy.VCRUNTIME140 ref: 00007FF63D90AE9A
memset.VCRUNTIME140 ref: 00007FF63D90B067
CertFreeCertificateContext.CRYPT32 ref: 00007FF63D90B0CA

Strings

SSL: public key does not match pinned public key!, xrefs: 00007FF63D90B0AC, 00007FF63D90B0D4
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF63D90B10A
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF63D90AF5E, 00007FF63D90B172
schannel: unable to re-allocate memory, xrefs: 00007FF63D90ABE2
schannel: unable to allocate memory, xrefs: 00007FF63D90B1BF
schannel: SNI or certificate check failed: %s, xrefs: 00007FF63D90AF2B
SSL: failed retrieving public key from server certificate, xrefs: 00007FF63D90B0EA
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF63D90AEC6
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF63D90AF74

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: ea392193f971925b59c67081e4a7e962e69aee8d6e8aa31c8d0ec1660afe7188
Instruction ID: 92b9648f49346016ebaa1e3dcafe245f83362e8939a37c3cde3fcfc44a57812c
Opcode Fuzzy Hash: ea392193f971925b59c67081e4a7e962e69aee8d6e8aa31c8d0ec1660afe7188
Instruction Fuzzy Hash: 30127F32A08B8985EB61CF99E8503AE77A5FB44BC8F104136CA5D877DAEF38E445D740

Function 00007FF63D909C70 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF63D909D41
GetProcAddress.KERNEL32 ref: 00007FF63D909D51

Strings

schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF63D909DE2
schannel: unable to allocate memory, xrefs: 00007FF63D90A847
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF63D90A90C, 00007FF63D90A953
http/1.1, xrefs: 00007FF63D90A753
schannel: SNI or certificate check failed: %s, xrefs: 00007FF63D90A92D
wine_get_version, xrefs: 00007FF63D909D4A
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF63D909D22
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF63D90A9E9
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF63D90A6EF
ntdll, xrefs: 00007FF63D909D3A
schannel: ALPN, offering %s, xrefs: 00007FF63D90A775
http/1.1, xrefs: 00007FF63D90A767
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF63D90A733

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 9df5deee7a8eb44b7c624e1997cfe2db299598a53202f801ac1e212e726632ce
Instruction ID: d6ce8c7fce3f6bfbe111d44c2f27f1ed0928344cd8505062f65e54a203d48c2c
Opcode Fuzzy Hash: 9df5deee7a8eb44b7c624e1997cfe2db299598a53202f801ac1e212e726632ce
Instruction Fuzzy Hash: AA02B372A08B8986E7108BA5E8403FD37A8FB44788F544136DA5D877DAEF3CE545E740

Function 00007FF63D8EB2B0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB2E2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB37D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF63D8EB396

Part of subcall function 00007FF63D904A60: socket.WS2_32 ref: 00007FF63D904AA1

DeleteCriticalSection.KERNEL32 ref: 00007FF63D8EB3D0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB3E4
closesocket.WS2_32 ref: 00007FF63D8EB402
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB438
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8EB43E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EB46D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB487
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EB490
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8EB4C5
EnterCriticalSection.KERNEL32 ref: 00007FF63D8EB4E6
LeaveCriticalSection.KERNEL32 ref: 00007FF63D8EB4FA
CloseHandle.KERNEL32 ref: 00007FF63D8EB507
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB532
closesocket.WS2_32 ref: 00007FF63D8EB54B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB55F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 5be7457888181850c85d56aadbc1f894fea58f0b3c7651b9d9ee872265a8f40c
Instruction ID: 38b6e6c8876b20a044fa550143b9bf72cbed75e980e22e15bfb88ae8aa95a224
Opcode Fuzzy Hash: 5be7457888181850c85d56aadbc1f894fea58f0b3c7651b9d9ee872265a8f40c
Instruction Fuzzy Hash: 28817A22E19B8582E625DF65E8402B97360FBA9B54F055335CB9E437A2EF38F4D4D700

Function 00007FF63D8F2920 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

No connections available., xrefs: 00007FF63D8F30C1
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF63D8F3003
host, xrefs: 00007FF63D8F2FF0
No connections available in cache, xrefs: 00007FF63D8F331B
anonymous, xrefs: 00007FF63D8F2AD8
ftp@example.com, xrefs: 00007FF63D8F2ADF
No more connections allowed to host %s: %zu, xrefs: 00007FF63D8F30B2
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF63D8F3172
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF63D8F31A0
proxy, xrefs: 00007FF63D8F2FE2

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 252dd515cb8bdb198c95c2b8d2812c48f0c9e2258bf50e30846c177568f5f6a3
Instruction ID: aa8be954093358af96dc8916431bff10a299c9ca74b150d47512d514d4158c37
Opcode Fuzzy Hash: 252dd515cb8bdb198c95c2b8d2812c48f0c9e2258bf50e30846c177568f5f6a3
Instruction Fuzzy Hash: F142AD22B09BCA96EB598BA5A5503B967E8FB45B84F084136CE5DC7785EF3CF460D300

Function 00007FF63D8F18B0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8E1B61,?,?,?,?,00007FF63D8D3591), ref: 00007FF63D8F18C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1911

Strings

v, xrefs: 00007FF63D8F1BBF
`, xrefs: 00007FF63D8F1BAA
<, xrefs: 00007FF63D8F1B4E
<, xrefs: 00007FF63D8F1A27
<, xrefs: 00007FF63D8F1B58

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction ID: 63e5e84e8c2d82f25e7f3ce88d95896c3881dd001aa04255f42611d6e9fd76f7
Opcode Fuzzy Hash: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction Fuzzy Hash: 0E913C32918BC586E310CF24D4043E837A4FB95B5CF185239CE995B39ADFBAA195D720

Function 00007FF63D8F8660 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF63D9224BA,?,?,?,?,00007FF63D8F89EB), ref: 00007FF63D8F8674
GetProcAddress.KERNEL32(?,?,00007FF63D9224BA,?,?,?,?,00007FF63D8F89EB), ref: 00007FF63D8F8699
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF63D9224BA,?,?,?,?,00007FF63D8F89EB), ref: 00007FF63D8F86AC

Strings

kernel32, xrefs: 00007FF63D8F866D
LoadLibraryExA, xrefs: 00007FF63D8F868A
AddDllDirectory, xrefs: 00007FF63D8F86F3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 4e48bd242bc8de50c7c49492aed2aaea806512792f90eb033efec11107f27546
Instruction ID: 0ad4c7d8eb87492845b0125d1d501e3a921d6b1d6646a1c3d636bd522a6d056f
Opcode Fuzzy Hash: 4e48bd242bc8de50c7c49492aed2aaea806512792f90eb033efec11107f27546
Instruction Fuzzy Hash: 6441D796B0964682EB158F92B80017967E1AF49BE1F084530CE4D837D5FF3CE496E700

Function 00007FF63D8F7300 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF63D8F736C
WSAGetLastError.WS2_32 ref: 00007FF63D8F7376

Part of subcall function 00007FF63D8E2500: GetLastError.KERNEL32 ref: 00007FF63D8E2522
Part of subcall function 00007FF63D8E2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E252A

getsockname.WS2_32 ref: 00007FF63D8F73F6
WSAGetLastError.WS2_32 ref: 00007FF63D8F7400

Strings

ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF63D8F751C
getpeername() failed with errno %d: %s, xrefs: 00007FF63D8F7396
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF63D8F7486
getsockname() failed with errno %d: %s, xrefs: 00007FF63D8F7420

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 49c1520c5f3771e96cdf1576298b0c1f5e19965a53e7fb4b6fc29f3d889e0196
Instruction ID: 683ff626e55f45309bc1b464bee806ed765b1f99caee2d7ce16c1446f74adec2
Opcode Fuzzy Hash: 49c1520c5f3771e96cdf1576298b0c1f5e19965a53e7fb4b6fc29f3d889e0196
Instruction Fuzzy Hash: 68917066A19BC582E710CF65E8502ED33A0FB99B88F445236DE4C8775AEF39E185CB10

Function 00007FF63D9086D0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF63D9086F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90875E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908798
memcpy.VCRUNTIME140(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D9087B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D9087BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D9087FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908803
freeaddrinfo.WS2_32(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908831
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908845
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90884F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90885C
WSASetLastError.WS2_32(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90887D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction ID: 5477da8ab7f5b821f131837c001a4b2908cb4b12ba76529a5ab3beb9bd4f4958
Opcode Fuzzy Hash: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction Fuzzy Hash: 99513D36B09B4A82EA65EF91B50013977A0FF48BD4F084075CE9E9379AEF3CE445A700

Function 00007FF63D905FE0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF63D90603D
Sleep.KERNEL32 ref: 00007FF63D90604E
WSASetLastError.WS2_32 ref: 00007FF63D9061B8
Sleep.KERNEL32 ref: 00007FF63D9061C9
__WSAFDIsSet.WS2_32 ref: 00007FF63D90627C
__WSAFDIsSet.WS2_32 ref: 00007FF63D906293
__WSAFDIsSet.WS2_32 ref: 00007FF63D9062AE
__WSAFDIsSet.WS2_32 ref: 00007FF63D9062C2
__WSAFDIsSet.WS2_32 ref: 00007FF63D9062DD
__WSAFDIsSet.WS2_32 ref: 00007FF63D9062F1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction ID: 47a9837d160abc67cd9fd2f4645f8fb1520753239d7ae36804e631b589188a98
Opcode Fuzzy Hash: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction Fuzzy Hash: 8B91D831A0C68A8BEB648F99B9402B96291FF457D4F504134EA5DC6BCEFF3CD945A600

Function 00007FF63D8F4EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4F3F

Strings

Couldn't resolve host '%s', xrefs: 00007FF63D8F5071
Unix socket path too long: '%s', xrefs: 00007FF63D8F4F96
Couldn't resolve proxy '%s', xrefs: 00007FF63D8F511C

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 20c1f01f82be5406a22b6bd8f2c06d5bf3bce3b875cd4d8ace4c03d303d19b1a
Instruction ID: ae8835b3e8cbc43c4141737845de3453ef6a0b6687cc827917f2531fdfce2f01
Opcode Fuzzy Hash: 20c1f01f82be5406a22b6bd8f2c06d5bf3bce3b875cd4d8ace4c03d303d19b1a
Instruction Fuzzy Hash: 9B51C122B0DA8A82F6198BA9F4503B967E8FB85790F140071DB5D83795FF3DF5A1A700

Function 00007FF63D8D2840 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D28A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2917
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2977
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D29C7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2A17
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2A88

Strings

.8, xrefs: 00007FF63D8D2A65
h%49, xrefs: 00007FF63D8D2A5E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 7ebd12cc3e181ad32f3692901b742a6bc9b2230d4e4e9f973d7613ff70f3cc47
Instruction ID: f768c4bd4179ff512aaa673b0fe9c11ebe855eaed28098989bdbb4949ad1edd4
Opcode Fuzzy Hash: 7ebd12cc3e181ad32f3692901b742a6bc9b2230d4e4e9f973d7613ff70f3cc47
Instruction Fuzzy Hash: 1B612B22E18BDA89F301CFB8EC491BC7771BB99748F045369CEC965A6AEF785108D344

Function 00007FF63D8EB1A0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D9086D0: getaddrinfo.WS2_32 ref: 00007FF63D9086F2
Part of subcall function 00007FF63D9086D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90875E
Part of subcall function 00007FF63D9086D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908798
Part of subcall function 00007FF63D9086D0: memcpy.VCRUNTIME140(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D9087B1
Part of subcall function 00007FF63D9086D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D9087BF
Part of subcall function 00007FF63D9086D0: freeaddrinfo.WS2_32(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908831
Part of subcall function 00007FF63D9086D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D908845
Part of subcall function 00007FF63D9086D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90884F
Part of subcall function 00007FF63D9086D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB1F5), ref: 00007FF63D90885C

WSAGetLastError.WS2_32 ref: 00007FF63D8EB1FB
WSAGetLastError.WS2_32 ref: 00007FF63D8EB205
EnterCriticalSection.KERNEL32 ref: 00007FF63D8EB220
LeaveCriticalSection.KERNEL32 ref: 00007FF63D8EB22F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EB240
send.WS2_32 ref: 00007FF63D8EB263
WSAGetLastError.WS2_32 ref: 00007FF63D8EB26D
LeaveCriticalSection.KERNEL32 ref: 00007FF63D8EB280

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 8d4847aa9c3541c6272cc4f64181b6fcda6a05a4c2714a92309b560570c47997
Instruction ID: e550b7293071fab1c9371078e04e4246414db5a8506169ca8a8488a6d7611765
Opcode Fuzzy Hash: 8d4847aa9c3541c6272cc4f64181b6fcda6a05a4c2714a92309b560570c47997
Instruction Fuzzy Hash: 37318432A0864A82EB518FE5E85026D33A4FF84B98F445131D95ED77E9EF3CE449DB40

Function 00007FF63D905C40 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF63D905CA6
WSASetLastError.WS2_32 ref: 00007FF63D905E66
Sleep.KERNEL32 ref: 00007FF63D905E76
__WSAFDIsSet.WS2_32 ref: 00007FF63D905F8A
__WSAFDIsSet.WS2_32 ref: 00007FF63D905FA2
Sleep.KERNEL32 ref: 00007FF63D905FCD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction ID: 3f2e9ee06d2c6c4c2d7fbbfeacd141f1a8539260378b4c365a42fccb11175c03
Opcode Fuzzy Hash: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction Fuzzy Hash: E7A128B1B1869A86EBA98B54A8043796295FF44BD4F144335EA5EC7BCEFF3CD8009300

Function 00007FF63D90BC90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90BD2E
memcpy.VCRUNTIME140 ref: 00007FF63D90BDC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90BEFC

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF63D90BEA4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF63D90BEC4

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: cf259203f4bea438583c3c412f7776f9c7af7d41b21ab36aa11069d7271c4b40
Instruction ID: f9110873c7054aec651256e69fa08c2a3139dc0517a2779cb514de40ae1be171
Opcode Fuzzy Hash: cf259203f4bea438583c3c412f7776f9c7af7d41b21ab36aa11069d7271c4b40
Instruction Fuzzy Hash: A5719F72B05B098AEB10CBA5E4506AD37A5FB48BACF004635DF2D977D9EE38E406D740

Function 00007FF63D92F85C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF63D92F8F3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D92F941
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D92F946
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D92F94E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D92F956
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D92F978
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D92F9D2

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction ID: 5267b5a8c82a2f0191a9ee448d3f13f782c4cb7898105f75c1f2359f4514f651
Opcode Fuzzy Hash: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction Fuzzy Hash: 6D313A25E0C24E82FB54AFE699513B91391AF45788F444435EA8EC77DFFE2DA848A301

Function 00007FF63D8E6D00 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E6D4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E6D65
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E6E92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E6EBE

Strings

%s, xrefs: 00007FF63D8E6FC7
Connection #%ld to host %s left intact, xrefs: 00007FF63D8E6F7B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: b43007c119ddb362dd522825b94bdaea00a64d4afe850bffe6a95a76408431e2
Instruction ID: 57bafdd74f49d95103ad674744d1a90c740aac8447af8d3b0c954c31d77bd5b9
Opcode Fuzzy Hash: b43007c119ddb362dd522825b94bdaea00a64d4afe850bffe6a95a76408431e2
Instruction Fuzzy Hash: 62919032B0868A82EB689F61A5413FD73E4FB45B84F041931DE5E87395EF39F460AB40

Function 00007FF63D8F1190 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F11BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F11D1

Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F0FED
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F100A
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F101E
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F103A
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F1057
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F107A
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F108E
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10A2
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10C8
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10DC
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10F0
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F113F
Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F114C

Part of subcall function 00007FF63D8F0F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F1175

memset.VCRUNTIME140 ref: 00007FF63D8F1205

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF63D8F13E1
User-Agent: %s, xrefs: 00007FF63D8F129F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: 1fe9221564d640c4bd26ef65c7d112e8fbc6b6f9e54e64452478d767993c87a9
Instruction ID: ae0dabf955862225ae381da5d4ea7a80c8d118cf91c17e94e8e42792992460a4
Opcode Fuzzy Hash: 1fe9221564d640c4bd26ef65c7d112e8fbc6b6f9e54e64452478d767993c87a9
Instruction Fuzzy Hash: F5718E6290CACA81E751CFA5A4103FD27A9EB91F84F084131DB9D8B78AEF3CF455A350

Function 00007FF63D901710 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9017A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9017B1
memcpy.VCRUNTIME140 ref: 00007FF63D9017CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90192C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D901935

Strings

1.1, xrefs: 00007FF63D90171F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction ID: 2b8497b0e9235475f978a81a4b8cd0eded46c2027e2c402a752adeebdae653e6
Opcode Fuzzy Hash: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction Fuzzy Hash: A5516076609B8986D668CF62F8403AA73A4FB45BC4F444031DF9D9779AEF3CE195A300

Function 00007FF63D8E7DF8 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E7F48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E7F8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E7FBA

Part of subcall function 00007FF63D8E6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E6D4E
Part of subcall function 00007FF63D8E6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E6D65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E7FEF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF63D8E7336

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 31029ba7bc85c6221cd791e62b65783b040d515dfa54cdf18f0e68298fd35378
Instruction ID: 061a7377b2242799e3c2962a9197069f8dee12256b92b1f57b8a0f7f35dc24cc
Opcode Fuzzy Hash: 31029ba7bc85c6221cd791e62b65783b040d515dfa54cdf18f0e68298fd35378
Instruction Fuzzy Hash: 73D19F21A0864A85FB648FA5D4403BC23B1FF85B88F446532DE0E9779AFF39F545A780

Function 00007FF63D8D3550 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D28A7
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2917
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2977
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D29C7
Part of subcall function 00007FF63D8D2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2A17

MessageBoxA.USER32 ref: 00007FF63D8D3727

Part of subcall function 00007FF63D8D4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D8D4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D378A

Strings

keyauth.win, xrefs: 00007FF63D8D36B3
null, xrefs: 00007FF63D8D35B2

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 54976bb8f5a6803ce57f224d1138e415bdf8c607ac50154f37e84ba570c39b8a
Instruction ID: 66cbfb8b4ad49ac5ff2b1324988bde741e8c3c1b2684a8913c72f0987f26c578
Opcode Fuzzy Hash: 54976bb8f5a6803ce57f224d1138e415bdf8c607ac50154f37e84ba570c39b8a
Instruction Fuzzy Hash: 4951CE62F08B5986FB04DBB5E4143AC2361AF44B88F404235CE4D57BDAEF3CE192A780

Function 00007FF63D922480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8F8660: GetModuleHandleA.KERNEL32(?,?,?,00007FF63D9224BA,?,?,?,?,00007FF63D8F89EB), ref: 00007FF63D8F8674

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF63D8F89EB), ref: 00007FF63D9224D0

Strings

InitSecurityInterfaceA, xrefs: 00007FF63D9224C6
secur32.dll, xrefs: 00007FF63D9224A3
security.dll, xrefs: 00007FF63D9224AA

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: eb7c67d60f81500d2959fb3e2a887152230945b8df9bf8d07a2b4a513378b2c4
Instruction ID: d59099b20eed394f744eca68b47f0822821b5bf6f6d4e7d04da4e3d4f3d53b44
Opcode Fuzzy Hash: eb7c67d60f81500d2959fb3e2a887152230945b8df9bf8d07a2b4a513378b2c4
Instruction Fuzzy Hash: B8F0F261F0AA4E80FF28DB95A89176013A0AF56748F844434C44CCA7DAFE3CA699A300

Function 00007FF63D8E792B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF63D8E7336

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: ca364cd61b22da7a45924ca2c5d0be0ab3f163353069b28667edec80b41675fb
Instruction ID: cf8bccd9ec5631d112656564e400a797613dc56c014ff2318a25497b19259121
Opcode Fuzzy Hash: ca364cd61b22da7a45924ca2c5d0be0ab3f163353069b28667edec80b41675fb
Instruction Fuzzy Hash: 87B1A421A0864A85FB648EA5945437C23A5EF81B88F546536CE0EC73D9FF3DF844EB80

Function 00007FF63D9012D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9013D0

Part of subcall function 00007FF63D901960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019BA

Part of subcall function 00007FF63D901710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9017A8
Part of subcall function 00007FF63D901710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9017B1

Strings

TCP6, xrefs: 00007FF63D901357
PROXY %s %s %s %li %li, xrefs: 00007FF63D9013A4
TCP4, xrefs: 00007FF63D90136A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 047c063cc632b01c7180deedab65f5aa210f4e96e6fe781e7f6accdb5a76185c
Instruction ID: 5066e7a2dc4adfe2c87e24c599ec9a7879f431a3526348810f29d8e1e50d91f3
Opcode Fuzzy Hash: 047c063cc632b01c7180deedab65f5aa210f4e96e6fe781e7f6accdb5a76185c
Instruction Fuzzy Hash: 99417231A0C68A86E750DBA5B4413AA77A5AB857C4F184032DA4DD77DFFF3CE4489700

Function 00007FF63D8E5BC0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF63D8E1BF6,?,?,?,?,00000000,?,00007FF63D8D370E), ref: 00007FF63D8E5BDD
closesocket.WS2_32 ref: 00007FF63D8E5CE9
closesocket.WS2_32 ref: 00007FF63D8E5CF6

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 7286715f2d8226696fe039300086cd9a4100a7d7b36e2d67156ce959462abef5
Instruction ID: 961d06eafc13b5831c29c7b70bc5b13d8b5bf0cda4ee14b2fbd523bf5d59e454
Opcode Fuzzy Hash: 7286715f2d8226696fe039300086cd9a4100a7d7b36e2d67156ce959462abef5
Instruction Fuzzy Hash: B8416F32A08A8A91E740EFB5E4542F923A5FF88768F444231DE5DC63DAFF38E545A710

Function 00007FF63D909A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF63D909BC3
SSL/TLS connection timeout, xrefs: 00007FF63D909BDC

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: e548ac435fdf518fdc63269c384178e1aec1bc92e1be2642d1f665bd69d81a7b
Instruction ID: 1ae836215def6ac45f80b287ad8674c6f9dd953286464f6ad85adfd53a814222
Opcode Fuzzy Hash: e548ac435fdf518fdc63269c384178e1aec1bc92e1be2642d1f665bd69d81a7b
Instruction Fuzzy Hash: FF51C461B0869A95EB549B61A5403796799FF447F8F588231CA2DC73DAFF3CE041E300

Function 00007FF63D8E5DC0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF63D8E61B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E61D7

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction ID: a68ad3d1066c47265dd32b7b46fc47b3d9a0d781d35152a8777dd7568f4a1b8b
Opcode Fuzzy Hash: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction Fuzzy Hash: 4CC1F632A0968646EB258F65D4103BA63A0FF457A8F446635DE6E83BC5FF3CF9419B00

Function 00007FF63D8F1E90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1EF5

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF63D8F2034
User-Agent: %s, xrefs: 00007FF63D8F1F06

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 2db8d1b1d87920ac502833c0690e4baa10251e2d594a51cea7f79aa9207dcd08
Instruction ID: 345e1a56b9ce489e8135df0c49342f671484397e5ce29137915a8543f952add1
Opcode Fuzzy Hash: 2db8d1b1d87920ac502833c0690e4baa10251e2d594a51cea7f79aa9207dcd08
Instruction Fuzzy Hash: 35518B62A08AC581E7518F65E4043AD67A4EB84B98F084132DF8C8B3DAEF7CE595E310

Function 00007FF63D8F5CF0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF63D8F5CFC
WSAGetLastError.WS2_32 ref: 00007FF63D8F5D0B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction ID: f31a695b6e027e4141a34d8de8c70364e2e74fabbd4c0bb143c4b9473e7f4869
Opcode Fuzzy Hash: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction Fuzzy Hash: ECE09A62F0460942FF2957F1A85433812949B44772F444734CA3EC63D0EE2C44D65300

Function 00007FF63D8F65D0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF63D8F6613

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction ID: 500232b2c2db0e0adf679893791cd7b73caa7041f35c0a844e6544f697659109
Opcode Fuzzy Hash: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction Fuzzy Hash: 82019212B0654581EF54DBAAE19936D2390EF88B84F085131DB0DCB796EF3CE4959B00

Function 00007FF63D8FE0F0 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF63D8FE119

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction ID: fd267cbbc9435776d6e0407172e98173c8274d06f74dcfd3efe90e423135a145
Opcode Fuzzy Hash: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction Fuzzy Hash: 24E09B35F0650982DE495B76D85217923906F55734F844371C63D433D1EE3CE19AAB00

Function 00007FF63D908D50 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D908D6B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction ID: b6412fe19ab1c0855b292bc52c6fc5f079397988d8a0eecb13eb463f62ad6e0b
Opcode Fuzzy Hash: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction Fuzzy Hash: 7AD02B63B18A04839F10CFB1AC40029E351B788774B484338EE7D827F4EF3CD1554600

Function 00007FF63D904C90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF63D904CA9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction ID: 430d868571f6bd583c0d848db4535e6e8136461f5e000e0f8df6aadcf88882b7
Opcode Fuzzy Hash: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction Fuzzy Hash: D7C08026F14581C3D3445F7158850876772ABC4304F955435D24B8223CEE3CC2E99B40

Non-executed Functions

Function 00007FF63D902890 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D903A53

Part of subcall function 00007FF63D8F5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8F5C15
Part of subcall function 00007FF63D8F5AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8F5C30

memchr.VCRUNTIME140 ref: 00007FF63D903B46
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D903C5E
strchr.VCRUNTIME140 ref: 00007FF63D903C72
strchr.VCRUNTIME140 ref: 00007FF63D903C9A
strchr.VCRUNTIME140 ref: 00007FF63D903CB0

Strings

, xrefs: 00007FF63D902C32
HTTP/, xrefs: 00007FF63D902B99
Received 101, xrefs: 00007FF63D903D2B
HTTP error before end of send, keep sending, xrefs: 00007FF63D903A79
Invalid Content-Length: value, xrefs: 00007FF63D903D08
Keep sending data to get tossed away!, xrefs: 00007FF63D903AEC
Maximum file size exceeded, xrefs: 00007FF63D903CEF
HTTP, xrefs: 00007FF63D903C4E
Received HTTP/0.9 when not allowed, xrefs: 00007FF63D903BBB
, xrefs: 00007FF63D902A7C
RTSP/%1d.%1d%c%3d, xrefs: 00007FF63D902C1D
Proxy-authenticate:, xrefs: 00007FF63D903551
Transfer-Encoding:, xrefs: 00007FF63D9031DA
Mark bundle as not supporting multiuse, xrefs: 00007FF63D902ACF
close, xrefs: 00007FF63D903023, 00007FF63D9031A3
Persistent-Auth, xrefs: 00007FF63D9035C2
Content-Type:, xrefs: 00007FF63D902E46
Content-Encoding:, xrefs: 00007FF63D903291
Overflow Content-Length: value!, xrefs: 00007FF63D902E2B
Lying server, not serving HTTP/2, xrefs: 00007FF63D902AAC
WWW-Authenticate:, xrefs: 00007FF63D903526
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF63D90389C, 00007FF63D9038E8
Content-Range:, xrefs: 00007FF63D90335E
Retry-After:, xrefs: 00007FF63D9032D3
HTTP error before end of send, stop sending, xrefs: 00007FF63D903A9D
Connection:, xrefs: 00007FF63D90305B, 00007FF63D903110
Location:, xrefs: 00007FF63D90365E
HTTP/%1[23] %d, xrefs: 00007FF63D902A54
HTTP 1.0, assume close after body, xrefs: 00007FF63D902CF7
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF63D90361C
Last-Modified:, xrefs: 00007FF63D9034C7
false, xrefs: 00007FF63D903600
HTTP/1.1 proxy connection set close!, xrefs: 00007FF63D90323D
Unsupported HTTP version in response, xrefs: 00007FF63D903C31
Set-Cookie:, xrefs: 00007FF63D903423
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF63D903846
The requested URL returned error: %s, xrefs: 00007FF63D903CC7
HTTP/%1d.%1d%c%3d, xrefs: 00007FF63D902A29
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF63D90325B
RTSP/, xrefs: 00007FF63D902984
Content-Length:, xrefs: 00007FF63D902D9F
HTTP %3d, xrefs: 00007FF63D902AF8
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF63D90321C
Proxy-Connection:, xrefs: 00007FF63D902EC3, 00007FF63D902F9C
The requested URL returned error: %d, xrefs: 00007FF63D903E23
Got 417 while waiting for a 100, xrefs: 00007FF63D903A33
keep-alive, xrefs: 00007FF63D902F56, 00007FF63D9030E6

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: e05cc8603978f3b236e682b7e1e1b7a76b16787a534cfe94a371e3f4dfcd65fb
Instruction ID: 2367b5ba99594fd42ffffb220900c0f2e421ba358bc205a2c11b5c5cb1fa3f90
Opcode Fuzzy Hash: e05cc8603978f3b236e682b7e1e1b7a76b16787a534cfe94a371e3f4dfcd65fb
Instruction Fuzzy Hash: 31C28871E0868A85EB609BA5A8443F92791FB49BD8F484135CE4D8B3DEFE3DE444E310

Function 00007FF63D8E8990 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 738stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF63D8EA1E7), ref: 00007FF63D8E8A00
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E8A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E8A54
strchr.VCRUNTIME140 ref: 00007FF63D8E8A67
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E8BE7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E8C08
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E8C2B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E8C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E8CD1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E8CDA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E8CF2
strchr.VCRUNTIME140 ref: 00007FF63D8E8EDF
strchr.VCRUNTIME140 ref: 00007FF63D8E8EF9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E8FEC
strchr.VCRUNTIME140 ref: 00007FF63D8E9018
strrchr.VCRUNTIME140 ref: 00007FF63D8E902A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E904B
memcpy.VCRUNTIME140 ref: 00007FF63D8E9064
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E90D8
strchr.VCRUNTIME140 ref: 00007FF63D8E90FB
strchr.VCRUNTIME140 ref: 00007FF63D8E9110

Strings

expires, xrefs: 00007FF63D8E8E75
FALSE, xrefs: 00007FF63D8E914E, 00007FF63D8E934B
#HttpOnly_, xrefs: 00007FF63D8E90CE
__Host-, xrefs: 00007FF63D8E8C01
Replaced, xrefs: 00007FF63D8E9601
%4095[^;=] =%4095[^;], xrefs: 00007FF63D8E8AA6
httponly, xrefs: 00007FF63D8E8C96
path, xrefs: 00007FF63D8E8CBD
domain, xrefs: 00007FF63D8E8D11
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF63D8E9617
version, xrefs: 00007FF63D8E8E1B
TRUE, xrefs: 00007FF63D8E9147
secure, xrefs: 00007FF63D8E8C5E
max-age, xrefs: 00007FF63D8E8E48
Added, xrefs: 00007FF63D8E960D
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF63D8E8F6F
localhost, xrefs: 00007FF63D8E8D3F
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF63D8E8DFE
__Secure-, xrefs: 00007FF63D8E8BE0

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: 7c0d23a60b93744acfd05b3892a9ff91a3a92e57e3aab93d37f62f7272c507e2
Instruction ID: ee6499373e952068c96a79d6886c259691058993a5e4e069d845ed9a9d14e245
Opcode Fuzzy Hash: 7c0d23a60b93744acfd05b3892a9ff91a3a92e57e3aab93d37f62f7272c507e2
Instruction Fuzzy Hash: AE72B261A0878A86FB719BA5E8003BD67A0EF85794F441531CA8E827D6FF7CF445E740

Function 00007FF63D8D955D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 978COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF63D8D9F5D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF63D8D9F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA0BB

Strings

object, xrefs: 00007FF63D8DA309
object key, xrefs: 00007FF63D8D9DEF, 00007FF63D8DA629
number overflow parsing ', xrefs: 00007FF63D8D9F80
array, xrefs: 00007FF63D8DA17A
object separator, xrefs: 00007FF63D8D9C63, 00007FF63D8DA49A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 0430c617731d3d5dcd1d85a078fc6eaf191fcc3ec08b5492cfa1e23e424cd946
Instruction ID: b857e6cae523dc8da855a534bf59a05b7d6f3c4d1ac989472b7c6ec5a93d2248
Opcode Fuzzy Hash: 0430c617731d3d5dcd1d85a078fc6eaf191fcc3ec08b5492cfa1e23e424cd946
Instruction Fuzzy Hash: DEA2C572A18B8A86EB10DBA8D4443ED2361FF457A4F505232DA5D97BE9EF7CE085D300

Function 00007FF63D8DABFD Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 930COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB594
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DB5C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DB5D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB60A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB667
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB720
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DB74E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DB75C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB796
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB7F3

Part of subcall function 00007FF63D8DEFB0: memcmp.VCRUNTIME140 ref: 00007FF63D8DF03D
Part of subcall function 00007FF63D8DEFB0: memcmp.VCRUNTIME140 ref: 00007FF63D8DF0C1

Strings

object, xrefs: 00007FF63D8DBB98
object key, xrefs: 00007FF63D8DB68C, 00007FF63D8DBEB8
number overflow parsing ', xrefs: 00007FF63D8DB80F
array, xrefs: 00007FF63D8DBA09
object separator, xrefs: 00007FF63D8DB500, 00007FF63D8DBD29

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: 2d3b5b1313362666544617db59b1898d4018098a7ba51d5844b6820e794b86e1
Instruction ID: aa165839a13654cd757a881e08f8eff6fe830571d7583d2352c008adbb9c12b4
Opcode Fuzzy Hash: 2d3b5b1313362666544617db59b1898d4018098a7ba51d5844b6820e794b86e1
Instruction Fuzzy Hash: 7A928662A18B8986EB11DBA8D8443AD2371FF457A4F501232DA5D97BE9EF7CF085D300

Function 00007FF63D925AD0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF63D925C3F
GetLastError.KERNEL32 ref: 00007FF63D925C52
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF63D925D04
GetLastError.KERNEL32 ref: 00007FF63D925D0E
CertGetCertificateChain.CRYPT32 ref: 00007FF63D925D9B
GetLastError.KERNEL32 ref: 00007FF63D925DA5
CertGetNameStringA.CRYPT32 ref: 00007FF63D925F13
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF63D92638B
CertCloseStore.CRYPT32 ref: 00007FF63D9263A0
CertFreeCertificateChain.CRYPT32 ref: 00007FF63D9263B0
CertFreeCertificateContext.CRYPT32 ref: 00007FF63D9263C0

Strings

2.5.29.17, xrefs: 00007FF63D925F73, 00007FF63D925FA4, 00007FF63D92610F, 00007FF63D92614B
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF63D925C11
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF63D925FDE, 00007FF63D926185
schannel: Empty DNS name., xrefs: 00007FF63D92601A, 00007FF63D9261C8
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF63D92605D
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF63D9262C9
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF63D925E0D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF63D925E3C
schannel: Null certificate info., xrefs: 00007FF63D925F63, 00007FF63D9260F4
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF63D925E52
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF63D925D28
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF63D925E25
schannel: CertFindExtension() returned no extension., xrefs: 00007FF63D925F8B, 00007FF63D926127
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF63D92633D
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF63D925E7A
schannel: Not enough memory to list all host names., xrefs: 00007FF63D92623C
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF63D9262B9
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF63D926253
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF63D925E69
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF63D925DBF
schannel: server certificate name verification failed, xrefs: 00007FF63D9262FE
schannel: failed to create certificate store: %s, xrefs: 00007FF63D925C6C
schannel: Null certificate context., xrefs: 00007FF63D925F28, 00007FF63D9260D7
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF63D926316

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: aa642634a254af1ffcd2ad2ea0f61ab5314722c02f0035306fbb413ac3b6e6fd
Instruction ID: 7e40c436656a4c625837ae181a448248eedb700ce23d61e22524655389af016c
Opcode Fuzzy Hash: aa642634a254af1ffcd2ad2ea0f61ab5314722c02f0035306fbb413ac3b6e6fd
Instruction Fuzzy Hash: F342AE32A09B4E81EB509B95E8402B937A0FB44B98F544231DE5D97BDEEF3CE945E700

Function 00007FF63D9149F0 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D914AD1
getsockname.WS2_32 ref: 00007FF63D914CCA
WSAGetLastError.WS2_32 ref: 00007FF63D914CD4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91520B

Strings

socket failure: %s, xrefs: 00007FF63D914DCF, 00007FF63D914FD6
,%d,%d, xrefs: 00007FF63D9150E9
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF63D914E64
bind(port=%hu) failed: %s, xrefs: 00007FF63D914F35
Failure sending EPRT command: %s, xrefs: 00007FF63D9151BF
PORT, xrefs: 00007FF63D915112
%s |%d|%s|%hu|, xrefs: 00007FF63D915199
%s %s, xrefs: 00007FF63D915119
getsockname() failed: %s, xrefs: 00007FF63D914CEE, 00007FF63D914EFE
Failure sending PORT command: %s, xrefs: 00007FF63D91513C
failed to resolve the address provided to PORT: %s, xrefs: 00007FF63D9151F9
EPRT, xrefs: 00007FF63D915182
bind() failed, we ran out of ports!, xrefs: 00007FF63D914EC6

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: 10b29650d1a06bd4ec3ec31fc93c34fc74a05537e4d60ad3d080947db4e395c3
Instruction ID: e60ca9e79c6c87426f4e73894aa550daa8b4722e50d4afa8ab3416fc76e81c94
Opcode Fuzzy Hash: 10b29650d1a06bd4ec3ec31fc93c34fc74a05537e4d60ad3d080947db4e395c3
Instruction Fuzzy Hash: AD22A462B0878A81EB509BA1E8402BE67A5FB45B84F445032DA4EC77DEFF7CE545E700

Function 00007FF63D8EF0E0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EF146
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EF16D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EF1C8

Strings

-----END PUBLIC KEY-----, xrefs: 00007FF63D8EF3CE
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF63D8EF39A
sha256//, xrefs: 00007FF63D8EF13C, 00007FF63D8EF28E
public key hash: sha256//%s, xrefs: 00007FF63D8EF1DE
;sha256//, xrefs: 00007FF63D8EF240

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 123a2d98d960ab42c595b3404186a2c4f6b30392ae679493633638e105c1701b
Instruction ID: c3361fc0ad7e680709ef87fe79436f57190281e5cd22dc9f1f0d0ba3e5d877db
Opcode Fuzzy Hash: 123a2d98d960ab42c595b3404186a2c4f6b30392ae679493633638e105c1701b
Instruction Fuzzy Hash: C8A1B261B19B8A81FB109FA2A8106B96790AF45BD4F485131DD1E877DAFF3CF445EB00

Function 00007FF63D9215B0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921666
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921721
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92172F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921741

Strings

WDigest, xrefs: 00007FF63D9215F1, 00007FF63D921A25
digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF63D92195B
realm, xrefs: 00007FF63D9218C7

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: e5e0312c21616c71d4915a97da91ed3be4c5b1f5ca8395eea93eafeb3c10cf90
Instruction ID: f4fcea4e8769e4974be77cf0fb66b6fa6776ee87de78926d85f9cf0c3b413d67
Opcode Fuzzy Hash: e5e0312c21616c71d4915a97da91ed3be4c5b1f5ca8395eea93eafeb3c10cf90
Instruction Fuzzy Hash: 0A125036A08B4D86EB14CFA1E8542AD37B4FB44B88F150035DE8D93B9AEF38D559E740

Function 00007FF63D8F7630 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF63D8F7702
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F771D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F775C

Strings

Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF63D8F7928
Couldn't bind to interface '%s', xrefs: 00007FF63D8F78A0
Bind to local port %hu failed, trying next, xrefs: 00007FF63D8F7A10
Local port: %hu, xrefs: 00007FF63D8F7B05
Couldn't bind to '%s', xrefs: 00007FF63D8F77F2
bind failed with errno %d: %s, xrefs: 00007FF63D8F7AE8
Local Interface %s is ip %s using address family %i, xrefs: 00007FF63D8F7817
getsockname() failed with errno %d: %s, xrefs: 00007FF63D8F7AAC

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: b31d3d25bbb3d167ce02e5c6d937c1e200a4a95940cf2d5463f311fe965b8830
Instruction ID: 80e391b6a029bc5d4379d6d387f21a0946d75cd51fdbde6e00197279beb1473b
Opcode Fuzzy Hash: b31d3d25bbb3d167ce02e5c6d937c1e200a4a95940cf2d5463f311fe965b8830
Instruction Fuzzy Hash: 35E1D622E1878A86F710CBA5F8402B927A4FB89788F415136DE4E8379AFF7CE544D700

Function 00007FF63D909FFC Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D90A098
strchr.VCRUNTIME140 ref: 00007FF63D90A0C4
strchr.VCRUNTIME140 ref: 00007FF63D90A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90A122
strchr.VCRUNTIME140 ref: 00007FF63D90A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90A24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D90A375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D90A3A1

Strings

, xrefs: 00007FF63D909FFC
CurrentUser, xrefs: 00007FF63D90A112
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF63D90A4D9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 606fce838f325d9a22f8bd7fbe2373a4342e9e48cf8c19a5f72ee2543fa2c872
Instruction ID: ab3975802e2921ec0d6d2a881541a1921a72ffc1a5ac05c1a5ec998b5136d4cb
Opcode Fuzzy Hash: 606fce838f325d9a22f8bd7fbe2373a4342e9e48cf8c19a5f72ee2543fa2c872
Instruction Fuzzy Hash: FB819421B0964A86FB598FA5B8503B927A4BF45BD4F484135CA1EC63DAFF3DE448E340

Function 00007FF63D8D973B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF63D8D9F64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA0BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA0FA

Strings

object, xrefs: 00007FF63D8DA309
number overflow parsing ', xrefs: 00007FF63D8D9F80
array, xrefs: 00007FF63D8DA17A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 30b1def4f11264a7b609f98e6155777ab1970a3dcd2cc058dc3b7432fd5ad8e9
Instruction ID: 8d267a67079459f4da834facda5d6d265f914b1f11c37f94f1af026a85572a3c
Opcode Fuzzy Hash: 30b1def4f11264a7b609f98e6155777ab1970a3dcd2cc058dc3b7432fd5ad8e9
Instruction Fuzzy Hash: 7D32C462A18B8A85EB10DFA9D8443ED2361FF557A8F104232DA5D97BD9EF7CE085D300

Function 00007FF63D90A005 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D90A098
strchr.VCRUNTIME140 ref: 00007FF63D90A0C4
strchr.VCRUNTIME140 ref: 00007FF63D90A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90A122
strchr.VCRUNTIME140 ref: 00007FF63D90A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90A24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D90A375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D90A3A1

Strings

CurrentUser, xrefs: 00007FF63D90A112
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF63D90A4D9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 18ad62f4a5a0cd3de7887efa181fed8ee0f51499181116489963c520c539ff20
Instruction ID: 5dd5733d807b41d4f161e8a02ddf1f109250ad143412a2362c65cface4c2beda
Opcode Fuzzy Hash: 18ad62f4a5a0cd3de7887efa181fed8ee0f51499181116489963c520c539ff20
Instruction Fuzzy Hash: 27819421B0964A86FB598FA5B8503B927A4BF45BD4F484135CA1EC63DAFF3DE448E340

Function 00007FF63D920580 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF63D920613
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D92063D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D920702
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D92070E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D920772
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D92077E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D920881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92088F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D92089A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9208EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92090E

Strings

, xrefs: 00007FF63D920651, 00007FF63D920852
password, xrefs: 00007FF63D9207B9
machine, xrefs: 00007FF63D9207D1, 00007FF63D920812
default, xrefs: 00007FF63D92082D
login, xrefs: 00007FF63D92079E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: aeef4b9014c4cf9d2d78b0d48f7a3ef214d4a9bc805991151f5d532477974b59
Instruction ID: 0de955ba18b1f68b49d0969f193bd5fe9339d4c2ed23a15fbc624c9edb497f12
Opcode Fuzzy Hash: aeef4b9014c4cf9d2d78b0d48f7a3ef214d4a9bc805991151f5d532477974b59
Instruction Fuzzy Hash: 3DA1A621A0D68F85FB619FA1A85037A67A0BF85788F094131DE4E877DAFF3DE454A700

Function 00007FF63D907CC0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D907F3E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D907F46
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D907F5C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D907F65
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D907F6D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D907F77

Strings

%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF63D907D7E
%02d:%02d:%02d%n, xrefs: 00007FF63D907EE9
GMT, xrefs: 00007FF63D907E37
%02d:%02d%n, xrefs: 00007FF63D907F1D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: 29359ff11a13169c6bbd87f5d4eca36891b4094a7d179d7bfb86092fac4ccb88
Instruction ID: 294e7ff6e739378a6d4604425c038ca0de459dc224f95fd9b8e3b8c04667a917
Opcode Fuzzy Hash: 29359ff11a13169c6bbd87f5d4eca36891b4094a7d179d7bfb86092fac4ccb88
Instruction Fuzzy Hash: 05F1CA72F1561A8AEB24DFA4A8101BC37F1BB447A8F504235DE1ED77E9EF38A8059740

Function 00007FF63D8E1E4E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95
SEC_E_BAD_PKGID, xrefs: 00007FF63D8E1E4E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: 040bb05f0cf7cd9878106aad1305948eb5ac86463c693ab4e214be405d518435
Instruction ID: c0fd4ff4975e50e8ed6aed48addaa6c647b606e0b55d4d54cf9e7344ef26297e
Opcode Fuzzy Hash: 040bb05f0cf7cd9878106aad1305948eb5ac86463c693ab4e214be405d518435
Instruction Fuzzy Hash: BF318A62A0C7C586E7219BA0E4543BEB7A4FB85740F840535DA8D8279AEF3CE544DB10

Function 00007FF63D8F0600 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Can not multiplex, even if we wanted to!, xrefs: 00007FF63D8F07BA
Could multiplex, but not asked to!, xrefs: 00007FF63D8F079C
Server doesn't support multiplex yet, wait, xrefs: 00007FF63D8F074B
Found bundle for host %s: %p [%s], xrefs: 00007FF63D8F0719
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF63D8F0841
Multiplexed connection found!, xrefs: 00007FF63D8F0E71
Server doesn't support multiplex (yet), xrefs: 00007FF63D8F076F
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF63D8F0ECA
can multiplex, xrefs: 00007FF63D8F0702
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF63D8F0866
serially, xrefs: 00007FF63D8F070E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 523e9815fb072d574a047b297e3395720e8989956db2acb0919649d8e29e9376
Instruction ID: 599bb6625795e5a7fcfcc732c9937cc0305b03048e4d4d25cc5bd4415ac6bf6c
Opcode Fuzzy Hash: 523e9815fb072d574a047b297e3395720e8989956db2acb0919649d8e29e9376
Instruction Fuzzy Hash: CD42C666A0C7CA49EBA58AA5A1503B937D9EB41B88F484036DB5DC7385FF3CB470E710

Function 00007FF63D92EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF63D92EF76
CryptCreateHash.ADVAPI32 ref: 00007FF63D92EF9A
CryptHashData.ADVAPI32 ref: 00007FF63D92EFB6
CryptGetHashParam.ADVAPI32 ref: 00007FF63D92EFD5
CryptGetHashParam.ADVAPI32 ref: 00007FF63D92EFF8
CryptDestroyHash.ADVAPI32 ref: 00007FF63D92F008
CryptReleaseContext.ADVAPI32 ref: 00007FF63D92F01A

Strings

@, xrefs: 00007FF63D92EF4D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 429e55f396393fe66fea98e7d9a8171e41cdb5e0e9661a133493c8119aebbe06
Instruction ID: 50c894a79acd8d8f6e587cabc011405356442706168ee2718caea9b24684d0e6
Opcode Fuzzy Hash: 429e55f396393fe66fea98e7d9a8171e41cdb5e0e9661a133493c8119aebbe06
Instruction Fuzzy Hash: 7221523261868986EB60CF91F85466AB760FBC9BC4F445135EB8E87B6DEF3CD4059B00

Function 00007FF63D92FD4C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF63D92FD68
memset.VCRUNTIME140 ref: 00007FF63D92FD8C
RtlCaptureContext.KERNEL32 ref: 00007FF63D92FD95
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF63D92FDAF
RtlVirtualUnwind.KERNEL32 ref: 00007FF63D92FDF0
memset.VCRUNTIME140 ref: 00007FF63D92FE23
IsDebuggerPresent.KERNEL32 ref: 00007FF63D92FE44
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF63D92FE61
UnhandledExceptionFilter.KERNEL32 ref: 00007FF63D92FE6C

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction ID: ef46572ea417456bbc51de71f13733cac820ec07f135d0a656f763799a7134d6
Opcode Fuzzy Hash: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction Fuzzy Hash: 91311E76609B858AEB609FA1E8403ED7365FB84748F44403ADB4E97B9AEF38D548C710

Function 00007FF63D92CE40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF63D92CE87
CryptImportKey.ADVAPI32 ref: 00007FF63D92CF59
CryptReleaseContext.ADVAPI32 ref: 00007FF63D92CF71
CryptEncrypt.ADVAPI32 ref: 00007FF63D92CFA2
CryptDestroyKey.ADVAPI32 ref: 00007FF63D92CFAC
CryptReleaseContext.ADVAPI32 ref: 00007FF63D92CFB8

Strings

@, xrefs: 00007FF63D92CE6D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction ID: 7954d243ea24fd26ccea41b6a82deca75fa4d4174eceb8b6dac69f8a6953c9e2
Opcode Fuzzy Hash: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction Fuzzy Hash: 23418E22B046A08EF7108BB5D8513EE3BB0EB4A788F044065DE9D57B9ADF3CD15AE750

Function 00007FF63D90C5D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF63D90C5C8,?,?,?,?,?,?,00007FF63D92380E), ref: 00007FF63D90C646
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF63D90C5C8,?,?,?,?,?,?,00007FF63D92380E), ref: 00007FF63D90C7AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90C90C

Strings

%c%c%c=, xrefs: 00007FF63D90C741
%c%c==, xrefs: 00007FF63D90C773
%c%c%c%c, xrefs: 00007FF63D90C703

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: 2a231402520dac6dfeb966d698eff136f7674ee3b3274eace693a1ffcb1e3978
Instruction ID: f50dbabef33fc25b396be743e16cc53cc743e8be14c0606a5b18210dda0cdbde
Opcode Fuzzy Hash: 2a231402520dac6dfeb966d698eff136f7674ee3b3274eace693a1ffcb1e3978
Instruction Fuzzy Hash: 6E91C572A086D985EB218B65B4003BE7BA0EB857D4F584231EAAD877DBEF3CD4419700

Function 00007FF63D9300E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF63D8D1870), ref: 00007FF63D9300FE
GetLastError.KERNEL32 ref: 00007FF63D930149
IsDebuggerPresent.KERNEL32 ref: 00007FF63D930161
OutputDebugStringW.KERNEL32 ref: 00007FF63D930172

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF63D93016B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: c81a61da6dff62d5fc6ebe2dd06c259fdb3328391505df66370617ea3a97fde8
Instruction ID: 0c8670c35d68fb6c9dc58fe40907c9ac745899202f0d0877431d807e2c1fe279
Opcode Fuzzy Hash: c81a61da6dff62d5fc6ebe2dd06c259fdb3328391505df66370617ea3a97fde8
Instruction Fuzzy Hash: 09115B32A14B8696E7449BA2D94137923A0FB04700F004139CA4DC2BA9EF3CE4749700

Function 00007FF63D8F9840 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF63D8F9D5B, 00007FF63D8F9DC6
(nil), xrefs: 00007FF63D8FA024
(nil), xrefs: 00007FF63D8FA0A6
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF63D8F9883, 00007FF63D8F9D54, 00007FF63D8F9DBB
.%ld, xrefs: 00007FF63D8F9BA9
%ld, xrefs: 00007FF63D8F9B50

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 70ca7b921aa72cb2f656cc355cb4e61dfcabc93d7a00fa25108394607d1b8cf8
Instruction ID: 4a479b51020732222d83567fb5fb1bee6ba98015cf52632031b8b0a229e24b5a
Opcode Fuzzy Hash: 70ca7b921aa72cb2f656cc355cb4e61dfcabc93d7a00fa25108394607d1b8cf8
Instruction Fuzzy Hash: 27424572A08A8A85E7259B58A4403BD67D9FF80BA4F510230DE5EC77C4FF3CF942A600

Function 00007FF63D8D1000 Relevance: 6.7, Strings: 5, Instructions: 438COMMON

Download Yara Rule

Strings

9WIvTVJa9m, xrefs: 00007FF63D8D1539
https://keyauth.win/api/1.2/, xrefs: 00007FF63D8D1037
8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913, xrefs: 00007FF63D8D1311
8.1, xrefs: 00007FF63D8D1203
loader principal, xrefs: 00007FF63D8D1557

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: 8.1$8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913$9WIvTVJa9m$https://keyauth.win/api/1.2/$loader principal
API String ID: 0-256606248
Opcode ID: 4d1748cb8f56f2878ad67963bcdf4b1ba8fbe7e05a9f2875c36f6a2263de4c73
Instruction ID: eda6b6147c032f01e605394f42c540b6ac3df9ca654f00bf71220e8feb776c8c
Opcode Fuzzy Hash: 4d1748cb8f56f2878ad67963bcdf4b1ba8fbe7e05a9f2875c36f6a2263de4c73
Instruction Fuzzy Hash: 35125D62D2DB864AF703D77998010A4E3649FA37C4F40D337ED58B1AA7FF29B2959204

Function 00007FF63D92FF64 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF63D92FF90
GetCurrentThreadId.KERNEL32 ref: 00007FF63D92FF9E
GetCurrentProcessId.KERNEL32 ref: 00007FF63D92FFAA
QueryPerformanceCounter.KERNEL32 ref: 00007FF63D92FFBA

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 81fecbbe110443faa4b077698657e2e73d1f9485f01ab5ea6c5b974c73907ae6
Instruction ID: 0868ce61fd2b658a2dc55690138fa588b4379eb5aad57d11066d6cd31cf53264
Opcode Fuzzy Hash: 81fecbbe110443faa4b077698657e2e73d1f9485f01ab5ea6c5b974c73907ae6
Instruction Fuzzy Hash: E2112A26B14F098AEB00DFA1EC552B833B4FB19758F440E31DA6D867A9EF78D1989340

Function 00007FF63D918B00 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF63D918B3B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D918B6F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction ID: 1b35a18b7d8f32218e3ce8b4a9ddcce9885368b2b2995a6a4502a417e98f77a3
Opcode Fuzzy Hash: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction Fuzzy Hash: 82113C26A247D0CAD304CF75E5001AD37B0FB5CB88F04962AFB8987B59EB78D690C744

Function 00007FF63D8DDDE0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF63D8DDEE4

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction ID: 6030d73792e75d139722683497123ded43490415ff2621ae465e4107045ed8f9
Opcode Fuzzy Hash: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction Fuzzy Hash: 3A81AD63B09B9989EB00CBA9D4843BC3770EB15B88F544026DF8E97795EF39E481D340

Function 00007FF63D8DEB70 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF63D8DEC50

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction ID: 18897c64e18ac90ec93a65619eb7ba19bc64b9c4c681e1ff6b1669be9ed3d387
Opcode Fuzzy Hash: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction Fuzzy Hash: 76819D62B19B9D89EB01CBA9D0843AC3770EB15B88F584423CF8D97795EF39E085D350

Function 00007FF63D92EEC0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: 2b6b55d07f7fc4fc91404efd27c9fc284bcf451bf4aada64ba9a86546f6d538c
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 90F08C2532476BBEFE00853B4624FBD1E419BD0700FA37974CC80421CB9A9E5493D714

Function 00007FF63D92FEF4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction ID: e9a594be2e138d635094fb2a64487254f60df890b3be7aa800beec4fb971ea4d
Opcode Fuzzy Hash: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction Fuzzy Hash: 17A00122A0980A90E6048B81EA900B02325AB55344B410035C11DD12AAAF2CA504A240

Function 00007FF63D8F4A50 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8FD7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF63D8E582F), ref: 00007FF63D8FD7C7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4BDD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4BF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4C91
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4CA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4CB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4CCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4CE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4CF5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D09

Part of subcall function 00007FF63D8FEEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FEF1E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D45
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4DA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4DBD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4DD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4DE5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4DF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4E0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4E21

Part of subcall function 00007FF63D8F28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2828), ref: 00007FF63D8F28BB
Part of subcall function 00007FF63D8F28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2828), ref: 00007FF63D8F28E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4E4B

Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF061
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF071
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF07F
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF08D
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF09B
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0A9
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0B7
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4E77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4E8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4E9B

Strings

Closing connection %ld, xrefs: 00007FF63D8F4B49

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: eb9022106fa48ef0e48b7552785da4dbc1585c49f9124965ca0ddee36b5df991
Instruction ID: 61578ae166a3beb89cf578695d8d6438bec4c0eef903d1ec492624cc243a1d9c
Opcode Fuzzy Hash: eb9022106fa48ef0e48b7552785da4dbc1585c49f9124965ca0ddee36b5df991
Instruction Fuzzy Hash: 49C1FE35518B8682E750DF61E8502ED3374FF85F98F085231DE9D8B79AEF38A195A310

Function 00007FF63D916E90 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D916F8D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91708E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D917101
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91717B

Strings

CSeq cannot be set as a custom header., xrefs: 00007FF63D9171C0
Range, xrefs: 00007FF63D917157
Range: %s, xrefs: 00007FF63D917183
OPTIONS, xrefs: 00007FF63D916E90
Content-Type: text/parameters, xrefs: 00007FF63D917427
Accept-Encoding: %s, xrefs: 00007FF63D917039
Accept: application/sdp, xrefs: 00007FF63D916FFA
%s%s%s%s%s%s%s%s, xrefs: 00007FF63D9172E6
User-Agent, xrefs: 00007FF63D91706E, 00007FF63D91709D
Session ID cannot be set as a custom header., xrefs: 00007FF63D9171ED
Referer, xrefs: 00007FF63D917117
Transport: %s, xrefs: 00007FF63D916F9A
Referer: %s, xrefs: 00007FF63D917132
Content-Type: application/sdp, xrefs: 00007FF63D91745D
Content-Length, xrefs: 00007FF63D9173CC
Transport, xrefs: 00007FF63D916F3E
Accept-Encoding, xrefs: 00007FF63D917004
Failed sending RTSP request, xrefs: 00007FF63D9174F1
Session, xrefs: 00007FF63D9171D9
Accept, xrefs: 00007FF63D916FE8
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF63D916FC5
Content-Type, xrefs: 00007FF63D917413, 00007FF63D917449
Content-Length: %I64d, xrefs: 00007FF63D9173E7
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF63D917227
CSeq, xrefs: 00007FF63D9171AC
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF63D916F13
Session: %s, xrefs: 00007FF63D91725D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: ae1e4fcc06bd7d9f04feea2aa870c001feb33b1b7f8d8a18fdde67d1064cfb35
Instruction ID: 152b699c299dab067605a606fe865cc41b0689c3b4cf20ab82019a9c27139b18
Opcode Fuzzy Hash: ae1e4fcc06bd7d9f04feea2aa870c001feb33b1b7f8d8a18fdde67d1064cfb35
Instruction Fuzzy Hash: A3026B21A09B8B81FB659BA5E8403BA63A5EF44B84F440436DE4DC77DAFF3CE545A340

Function 00007FF63D910930 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91098E
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D9109C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D910A41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D910A5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D910A6A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D910AB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D910AC8

Strings

Mime-Version: 1.0, xrefs: 00007FF63D910C24
%I64d, xrefs: 00007FF63D910C7E
SMTPUTF8, xrefs: 00007FF63D910D1A
<%s@%s>, xrefs: 00007FF63D910A26, 00007FF63D910B6A
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF63D910D5C
Mime-Version, xrefs: 00007FF63D910C09
SIZE=, xrefs: 00007FF63D910D31
AUTH=, xrefs: 00007FF63D910D25
<%s>, xrefs: 00007FF63D910A49, 00007FF63D910B8D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 9f3ae06b9d67fe3e04b5c85581cf7496fb5af4bc220afe7f1755c54301e1dd65
Instruction ID: 3842d9693109a73a4fe4123b8e06787a32482ab786286381de392051acffe62f
Opcode Fuzzy Hash: 9f3ae06b9d67fe3e04b5c85581cf7496fb5af4bc220afe7f1755c54301e1dd65
Instruction Fuzzy Hash: 31D1B061E1975A80FB11DBA2A8146B923A8BF45B88F454131DD4E877CBFF3DE459E300

Function 00007FF63D92DE10 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92DEF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92DFF2
htonl.WS2_32 ref: 00007FF63D92E01F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E031
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E060
htonl.WS2_32 ref: 00007FF63D92E075
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E0A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E129
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E132
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E13B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E172
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E17B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E184
memcpy.VCRUNTIME140 ref: 00007FF63D92E19F
memcpy.VCRUNTIME140 ref: 00007FF63D92E1B3
memcpy.VCRUNTIME140 ref: 00007FF63D92E1C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E1F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E1F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E202
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92E20B

Strings

GSSAPI handshake failure (invalid security data), xrefs: 00007FF63D92DF87
GSSAPI handshake failure (empty security message), xrefs: 00007FF63D92DF77, 00007FF63D92E218
GSSAPI handshake failure (invalid security layer), xrefs: 00007FF63D92E006

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 122f7fd80c8594248d113e32287b9eb9e9d1154b8ca574f645f8e3e0c2da2698
Instruction ID: 8ba7427bd1ad709ae381818c38fdb8f4dc7ef1c283f90d002a0fafc80f1fa543
Opcode Fuzzy Hash: 122f7fd80c8594248d113e32287b9eb9e9d1154b8ca574f645f8e3e0c2da2698
Instruction Fuzzy Hash: 86C15131A18B4A8AE710DFA5E8902AD77B0FB49B88F004035DE5E87B9AEF3CD445D740

Function 00007FF63D8F25B0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F25CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F25E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F25F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F260B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F261F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2633
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2647
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F265B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F266F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2683
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F26AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F26BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F26D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F26E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F26FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F270F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2723
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2737
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F274B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F275F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2773
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F279B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F27AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F27C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F27D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F27EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F27FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2813

Part of subcall function 00007FF63D8F28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2828), ref: 00007FF63D8F28BB
Part of subcall function 00007FF63D8F28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2828), ref: 00007FF63D8F28E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F283D

Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF061
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF071
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF07F
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF08D
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF09B
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0A9
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0B7
Part of subcall function 00007FF63D8EF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F2869
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F287D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F288D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1355b7a7184f64feaaccd16da42868722d35f25f5e110b8e10d39babc2a5a14d
Instruction ID: b3e68f5fdc5e9eaac55395ae268a83b148d0af7a8b9542e79512eca4a6409b7d
Opcode Fuzzy Hash: 1355b7a7184f64feaaccd16da42868722d35f25f5e110b8e10d39babc2a5a14d
Instruction Fuzzy Hash: 7971EE35528B8581D750DF61E8942BC33B8FF89F99F080075CE9E8B75A9F389199E321

Function 00007FF63D8DAE0F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF63D8DAE17
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB8D3
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DB901
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DB90F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB94A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DB989

Strings

object, xrefs: 00007FF63D8DBB98
number overflow parsing ', xrefs: 00007FF63D8DB80F
array, xrefs: 00007FF63D8DBA09

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: 5c4f9039412dcb40fc83093152c61a3b643f1859d17c36408014daf374312b89
Instruction ID: 362397c9858792faa4c7592c22a35d02cf22845c2fafb0ca55a32170c8721b8b
Opcode Fuzzy Hash: 5c4f9039412dcb40fc83093152c61a3b643f1859d17c36408014daf374312b89
Instruction Fuzzy Hash: D922A362A18B8985EB118FA9D8443AD2371FF457A4F505232DA5D87BD9EF7CF084E300

Function 00007FF63D922BB0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF63D922C99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D922CE0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D922F36
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D922F4D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D922F68
htons.WS2_32 ref: 00007FF63D922FC7

Strings

%s, xrefs: 00007FF63D922E83
DOH Host name: %s, xrefs: 00007FF63D922D61
CNAME: %s, xrefs: 00007FF63D922EC3
bad error code, xrefs: 00007FF63D922CF8
Could not DOH-resolve: %s, xrefs: 00007FF63D922C06
TTL: %u seconds, xrefs: 00007FF63D922D75
DOH: %s type %s for %s, xrefs: 00007FF63D922D14
DOH A: %u.%u.%u.%u, xrefs: 00007FF63D922DAE
AAAA, xrefs: 00007FF63D922D06
DOH AAAA: , xrefs: 00007FF63D922DE2
%s%02x%02x, xrefs: 00007FF63D922E2E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 7cec8a530bab6e4e14e36d90609d07fde7477cf563e6d6e9dc01247cd4815aea
Instruction ID: c6fe85b4ef51079a80b5d86ef564ae62a97ad013c5a0467d64bafc6259c18c17
Opcode Fuzzy Hash: 7cec8a530bab6e4e14e36d90609d07fde7477cf563e6d6e9dc01247cd4815aea
Instruction Fuzzy Hash: DEE18F32B08A8E86EB60DFA1E4403B977A4FB48B88F444135DA4D8779AEF3CE554D700

Function 00007FF63D8D98E8 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA044
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DA072
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DA080
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA0BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DA0FA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DAAEE

Strings

object, xrefs: 00007FF63D8DA309
number overflow parsing ', xrefs: 00007FF63D8D9F80
array, xrefs: 00007FF63D8DA17A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 5aea829a4d6894ef447e787a7303a6b904d496e6585f7fe99c3ff1b09238d1ac
Instruction ID: e2732925641748596b26dbd4799b6f7eb72c1ffd3c6be0bcdaab9316aa73b810
Opcode Fuzzy Hash: 5aea829a4d6894ef447e787a7303a6b904d496e6585f7fe99c3ff1b09238d1ac
Instruction Fuzzy Hash: EC12B762A18B8985FB009BB9D8443ED2361FF557A4F505232DA5D93BE9EF7CE085E300

Function 00007FF63D91DB10 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DB96
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DBBC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DBCD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DC3B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DC6C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DC8C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DC9E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DD00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DD71
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DD88
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DE43
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DEB7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF63D91D2CF), ref: 00007FF63D91DEC0

Strings

sub, xrefs: 00007FF63D91DDF4
LDAP, xrefs: 00007FF63D91DB56
one, xrefs: 00007FF63D91DDA3
subtree, xrefs: 00007FF63D91DE07
base, xrefs: 00007FF63D91DDC9
onetree, xrefs: 00007FF63D91DDB6

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: c441c14a2b1bdea0e04bcdcd83fc73141006c477e6a67313454cb6bf718cf366
Instruction ID: a438967c70d4b3de094bd31ad72b4b7e2c325c74c396866e9b48f6ac7ae33c2c
Opcode Fuzzy Hash: c441c14a2b1bdea0e04bcdcd83fc73141006c477e6a67313454cb6bf718cf366
Instruction Fuzzy Hash: D5B1A226B09B4A82FB51DB95A84027927A8FF89B80F448535DE4D837CAFF3CE445E700

Function 00007FF63D91BCE0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF63D91BD41
memchr.VCRUNTIME140 ref: 00007FF63D91BD77
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D91BDFB
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D91BE8B

Strings

blksize is larger than max supported, xrefs: 00007FF63D91BF31
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF63D91BF67
blksize parsed from OACK, xrefs: 00007FF63D91BE33
server requested blksize larger than allocated, xrefs: 00007FF63D91BEE8
requested, xrefs: 00007FF63D91BE3A
%s (%d) %s (%d), xrefs: 00007FF63D91BE4D
got option=(%s) value=(%s), xrefs: 00007FF63D91BDBC
%s (%d), xrefs: 00007FF63D91BF15, 00007FF63D91BF38
blksize, xrefs: 00007FF63D91BDDF
%s (%ld), xrefs: 00007FF63D91BE9B
tsize, xrefs: 00007FF63D91BE6F
tsize parsed from OACK, xrefs: 00007FF63D91BE94
invalid blocksize value in OACK packet, xrefs: 00007FF63D91BF4E
blksize is smaller than min supported, xrefs: 00007FF63D91BF0E
%s (%ld), xrefs: 00007FF63D91BEF2
Malformed ACK packet, rejecting, xrefs: 00007FF63D91BF7A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: e72314628692c8f67b7c30d7b4dec522e30d90b8ff87010d58779c3d96bd0464
Instruction ID: 5a7f0ca13bbfe6ed9b9ec8334786a32f0d4ce60bf62ca92f33d64f1d74f162b0
Opcode Fuzzy Hash: e72314628692c8f67b7c30d7b4dec522e30d90b8ff87010d58779c3d96bd0464
Instruction Fuzzy Hash: A261D461B0864E85EB15EBA5E8002B96795BF45BE8F404631E91EC73EAFF3CE105E700

Function 00007FF63D8EBE00 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8E5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8EFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8E1B61), ref: 00007FF63D8E5757
Part of subcall function 00007FF63D8E5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8EFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8E1B61), ref: 00007FF63D8E5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EC094
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EC09C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EC0C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EC0CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EC150
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EC159

Strings

; name=", xrefs: 00007FF63D8EC0EF
Content-Disposition, xrefs: 00007FF63D8EBFC1
Content-Transfer-Encoding, xrefs: 00007FF63D8EC1C1
text/plain, xrefs: 00007FF63D8EBF6C
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF63D8EC119
; filename=", xrefs: 00007FF63D8EC0E1
multipart/mixed, xrefs: 00007FF63D8EBEF5
Content-Transfer-Encoding: %s, xrefs: 00007FF63D8EC2E1
attachment, xrefs: 00007FF63D8EC04B, 00007FF63D8EC052
; boundary=, xrefs: 00007FF63D8EC173
application/octet-stream, xrefs: 00007FF63D8EBF26
multipart/form-data, xrefs: 00007FF63D8EC257
Content-Type, xrefs: 00007FF63D8EBE88
8bit, xrefs: 00007FF63D8EC2DA
form-data, xrefs: 00007FF63D8EC306
Content-Type: %s%s%s, xrefs: 00007FF63D8EC17D
multipart/, xrefs: 00007FF63D8EC037

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: fa43ea9e0a126be4bef8fb6f7ed3e76991f67a2a80a70aa702e2070dbb11514f
Instruction ID: b8c7c36d08bd199aa3e0a84e9a39433cc23bed15937d20c8160d7b30f9a446a9
Opcode Fuzzy Hash: fa43ea9e0a126be4bef8fb6f7ed3e76991f67a2a80a70aa702e2070dbb11514f
Instruction Fuzzy Hash: E9E1AF22F0978A92FA6A8B9595002B967A4FF05B84F485035DE4DC7786FF3CF854EB00

Function 00007FF63D8E9A20 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8EA970: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF63D8EA3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8F10B9), ref: 00007FF63D8EA993
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA9E9
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA9F3
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA9FD
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA07
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA11
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA1B
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA25
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA2F
Part of subcall function 00007FF63D8EA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA38

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9B17
strchr.VCRUNTIME140 ref: 00007FF63D8E9B31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9B5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9B68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9B92
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9BA6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9BB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9BCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9BDA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9BE8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9C03
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9C1F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9C3B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9C57
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9C73
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9C8F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9CAB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9CC3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9D5B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF63D8E9D92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9DD3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: 178b2be9fe900d882fbf4bec64a10ac822553494956453af857de872257d8abc
Instruction ID: f1e0f3880e4253d4e42e5d9d7acd37a93f0e496bc19594e77c74a7390dd61bf5
Opcode Fuzzy Hash: 178b2be9fe900d882fbf4bec64a10ac822553494956453af857de872257d8abc
Instruction Fuzzy Hash: 1EB1B4A1B0AB5A41FF65AFA6A51027927A0AF45B94F081130CE9D833C5FF7CF496E710

Function 00007FF63D8FE5D0 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 310stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FE6C5
strchr.VCRUNTIME140 ref: 00007FF63D8FE765
memcpy.VCRUNTIME140 ref: 00007FF63D8FE795
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D8FE7C1
strchr.VCRUNTIME140 ref: 00007FF63D8FE80C
memcpy.VCRUNTIME140 ref: 00007FF63D8FE86B

Part of subcall function 00007FF63D8EAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EAB64

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FE984

Strings

RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF63D8FEA0B
Added %s:%d:%s to DNS cache, xrefs: 00007FF63D8FEA7D
%255[^:]:%d, xrefs: 00007FF63D8FE651
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF63D8FEAAE
], xrefs: 00007FF63D8FE845
:%u, xrefs: 00007FF63D8FE6D9, 00007FF63D8FE998
@, xrefs: 00007FF63D8FE856
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF63D8FE667
Resolve address '%s' found illegal!, xrefs: 00007FF63D8FE8EB
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF63D8FE8FA

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: d1553399ecc74311bf5003d4dab665501ce049fb482f209a04c290e844c2cb37
Instruction ID: 666dee8a06e074834e6ab96b95dbe08c398ce427065e4f2aaec3b69a0aa22d49
Opcode Fuzzy Hash: d1553399ecc74311bf5003d4dab665501ce049fb482f209a04c290e844c2cb37
Instruction Fuzzy Hash: 70D1A322A196CA45FB629BA1E4003F92794FF45798F444532DA5E97BCAEF3CF505D300

Function 00007FF63D9139B0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9139FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D913AEF
strchr.VCRUNTIME140 ref: 00007FF63D913A31

Part of subcall function 00007FF63D8EAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EAB64

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D913C57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D913E21
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D913E43

Part of subcall function 00007FF63D8FEEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FEF1E

Strings

Can't resolve proxy host %s:%hu, xrefs: 00007FF63D913D03
Can't resolve new host %s:%hu, xrefs: 00007FF63D913D6E
%u,%u,%u,%u,%u,%u, xrefs: 00007FF63D913B7B
Couldn't interpret the 227-response, xrefs: 00007FF63D913B9E
%c%c%c%u%c, xrefs: 00007FF63D913A6B
Weirdly formatted EPSV reply, xrefs: 00007FF63D913B0F
Connecting to %s (%s) port %d, xrefs: 00007FF63D913DFA
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF63D913C2B
Illegal port number in EPSV reply, xrefs: 00007FF63D913AAF
Bad PASV/EPSV response: %03d, xrefs: 00007FF63D913E6E
%u.%u.%u.%u, xrefs: 00007FF63D913C63

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: bd80529c0a055b40eb949fe60fbfac290892e4a6154919f81aed75a89cf498cd
Instruction ID: e3eea5e6b6226187d7548b686a9cd63fa947cca0c11a5fa2d16d41a02248ae46
Opcode Fuzzy Hash: bd80529c0a055b40eb949fe60fbfac290892e4a6154919f81aed75a89cf498cd
Instruction Fuzzy Hash: 14D18922F0878652EB689B65E5402B977B9FB49784F440036DA4D83BDAEF3CE554E700

Function 00007FF63D912E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D90C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF63D8F340F), ref: 00007FF63D90C0AE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912F36
strchr.VCRUNTIME140 ref: 00007FF63D912F54
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912F84
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D912F9F
strchr.VCRUNTIME140 ref: 00007FF63D912FC9
strrchr.VCRUNTIME140 ref: 00007FF63D912FE5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91300F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91302A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91304E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D913066
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D9130A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9130E0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91317C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9131A1

Strings

Uploading to a URL without a file name!, xrefs: 00007FF63D9130CC
Request has same path as previous transfer, xrefs: 00007FF63D913186

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 6763ac52683adc2b30a8790578e0db2f895b694b4c0befe19cf29afa3948292b
Instruction ID: 2dbb2717fbaa4cd50879dee7d5fbf110a477a97ee26da162162dadef4abd6c20
Opcode Fuzzy Hash: 6763ac52683adc2b30a8790578e0db2f895b694b4c0befe19cf29afa3948292b
Instruction Fuzzy Hash: E191D321F1878A82EB548B65E8443B927F8FF4AB80F444035DA5E837DAEF3CE455A701

Function 00007FF63D8E1D10 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF63D8E1D38
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E1D40

Strings

Unknown error, xrefs: 00007FF63D8E2230
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF63D8E219C
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF63D8E2249
CRYPT_E_REVOKED, xrefs: 00007FF63D8E2172
No error, xrefs: 00007FF63D8E2190
%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: db281f68b38cbdc177fe78e3b8ce9259576fae544cc566fc18b4b21884f897dc
Instruction ID: a7e7a8ade3d5923726c1ccfa86824ba4ba2dcd23b04ce8a1312ef0106645e422
Opcode Fuzzy Hash: db281f68b38cbdc177fe78e3b8ce9259576fae544cc566fc18b4b21884f897dc
Instruction Fuzzy Hash: 8551B362A0C68A86E7258BE0E8403BD77A4FF44740F844535DA4D8379AEF3CF619AB10

Function 00007FF63D901A00 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF63D901AB8
strchr.VCRUNTIME140 ref: 00007FF63D901ACF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D901B1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D901CE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D901D36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D901D3F

Strings

Transfer-Encoding:, xrefs: 00007FF63D901C58
%s, xrefs: 00007FF63D901CCC
Content-Length:, xrefs: 00007FF63D901C0B
Content-Type:, xrefs: 00007FF63D901BBF, 00007FF63D901BE5
Connection:, xrefs: 00007FF63D901C31
1.1, xrefs: 00007FF63D901A1B
Cookie:, xrefs: 00007FF63D901C8B
Authorization:, xrefs: 00007FF63D901C71
Host:, xrefs: 00007FF63D901B99

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 9420c540ce49b788537a1560c0a8b2960d2ad3b97e9a1f39b48959878ce98d9c
Instruction ID: a37e4c7867d8112d6710a86112d18e69c03a8265791dca5d7d7171632b6ccc50
Opcode Fuzzy Hash: 9420c540ce49b788537a1560c0a8b2960d2ad3b97e9a1f39b48959878ce98d9c
Instruction Fuzzy Hash: 95918C21A08A9A85FB619B92A8003B96790BF45BC8F494035DA4DD77CFFF3DE549E300

Function 00007FF63D92D000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF63D91FD2F), ref: 00007FF63D92D02D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF63D91FD2F), ref: 00007FF63D92D04F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF63D91FD2F), ref: 00007FF63D92D060
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF63D91FD2F), ref: 00007FF63D92D08E

Strings

../, xrefs: 00007FF63D92D0F9
/../, xrefs: 00007FF63D92D15B
/./, xrefs: 00007FF63D92D11C
/.., xrefs: 00007FF63D92D192

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: f19d3bbf4f657fe2a39777922c2588bd535b1b954c8ccd3c424f95d841e483cd
Instruction ID: cd4d05e7d66254e1276d8ec1396ad4cb1cea7debb5db0caedb27a6a79dea83a6
Opcode Fuzzy Hash: f19d3bbf4f657fe2a39777922c2588bd535b1b954c8ccd3c424f95d841e483cd
Instruction Fuzzy Hash: 2271FA21E0D68E45FB629B9195002796BA0AF62BA8F044131CB9D837DFFE3CE455E341

Function 00007FF63D927C01 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D927C32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9282AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9282E8

Strings

%s, xrefs: 00007FF63D9282D6
Signature: %s, xrefs: 00007FF63D9280E7
-----BEGIN CERTIFICATE-----, xrefs: 00007FF63D92818C
TRUE, xrefs: 00007FF63D927C24
FALSE, xrefs: 00007FF63D927C1D
Cert, xrefs: 00007FF63D9282BE
-----END CERTIFICATE-----, xrefs: 00007FF63D928237
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: c052995a42e6b728a69c439b8f9efaad45d5159dd0512a59b113cd4f6ac561c8
Instruction ID: db95dad6cff720b03ab21fcb4db7dc2026969645bd2935da78f7c7960a8440bd
Opcode Fuzzy Hash: c052995a42e6b728a69c439b8f9efaad45d5159dd0512a59b113cd4f6ac561c8
Instruction Fuzzy Hash: 1071B566E0D7C945EB11CBA994052B97BA0EF4678CF5844B2CA4D833DBEE3CE149E301

Function 00007FF63D921C70 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921D32
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921D6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921DBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921E72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921E7B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921E86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921F71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921F85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D921FFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D922004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92200F

Part of subcall function 00007FF63D922400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D9242EA,?,?,00000000,00007FF63D920D25), ref: 00007FF63D922410
Part of subcall function 00007FF63D922400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D9242EA,?,?,00000000,00007FF63D920D25), ref: 00007FF63D922421
Part of subcall function 00007FF63D922400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D9242EA,?,?,00000000,00007FF63D920D25), ref: 00007FF63D922433

Strings

WDigest, xrefs: 00007FF63D921D1C, 00007FF63D921E34
DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF63D92201C

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: c9cf272a14080f984a1e5b17b6d9c33fcb4d42b5607d30e6d9f2944a95de6c96
Instruction ID: af92404744d52ee07bd63b6975ceaaaf08b6a04d60369db54643ed901912a018
Opcode Fuzzy Hash: c9cf272a14080f984a1e5b17b6d9c33fcb4d42b5607d30e6d9f2944a95de6c96
Instruction Fuzzy Hash: F8B17532A08B4A86EB10DFA5E8502AD37B4FB49B98F400135DE4D97B9AEF3CD545E740

Function 00007FF63D9289C0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928AD3

Strings

dsa(q), xrefs: 00007FF63D928B9C
rsa(n), xrefs: 00007FF63D928AE0
dh(p), xrefs: 00007FF63D928C2F
rsaEncryption, xrefs: 00007FF63D928A05
dsa, xrefs: 00007FF63D928B35
%lu, xrefs: 00007FF63D928AA8
dsa(pub_key), xrefs: 00007FF63D928BE2
rsa(e), xrefs: 00007FF63D928B0B
dsa(p), xrefs: 00007FF63D928B6D
RSA Public Key (%lu bits), xrefs: 00007FF63D928A8E
dh(pub_key), xrefs: 00007FF63D928C76
dsa(g), xrefs: 00007FF63D928BCC
dh(g), xrefs: 00007FF63D928C60
dhpublicnumber, xrefs: 00007FF63D928BF6
RSA Public Key, xrefs: 00007FF63D928ABF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 8e597e9a321645fbd1e646547d860fffd9a743d79f84a05bd7a1f386ba8e9fa4
Instruction ID: 3889159e694c0ea4d167de8e8a9f4ca48a511c8ef4105785a5e00fe4dfa19fa7
Opcode Fuzzy Hash: 8e597e9a321645fbd1e646547d860fffd9a743d79f84a05bd7a1f386ba8e9fa4
Instruction Fuzzy Hash: 6C712A62A0874E85EA10DB91A9401F92391FB89B88F444576EE4D877CFFF3CE605D680

Function 00007FF63D91ED9C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F008
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F060
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F06D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F16F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F1BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F1D6

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: b1bdd30bba7c06ed5a90474b3ff21456d1dc9d6e3bc5ba75029f1b5d07c933d7
Instruction ID: 8d1e42d31b8279d8f3f39e88dd63b78b9080a501a0573155c37fd299dc01f81f
Opcode Fuzzy Hash: b1bdd30bba7c06ed5a90474b3ff21456d1dc9d6e3bc5ba75029f1b5d07c933d7
Instruction Fuzzy Hash: 05A1B113A0D68E45FB628FA194103B96BE4AF46B84F084071DE9E863DFFE3DE505A310

Function 00007FF63D90D080 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF63D90D0D8

Strings

CAPABILITY, xrefs: 00007FF63D90D4A0
EXPUNGE, xrefs: 00007FF63D90D3D7
, xrefs: 00007FF63D90D0E1
UID, xrefs: 00007FF63D90D407
Unexpected continuation response, xrefs: 00007FF63D90D51E
LSUB, xrefs: 00007FF63D90D3EF
PREA, xrefs: 00007FF63D90D114
LIST, xrefs: 00007FF63D90D2BC
NOOP, xrefs: 00007FF63D90D41F
FETCH, xrefs: 00007FF63D90D24C, 00007FF63D90D362
SELECT, xrefs: 00007FF63D90D38F
SEARCH, xrefs: 00007FF63D90D1EC, 00007FF63D90D3BF
STORE, xrefs: 00007FF63D90D30A
EXAMINE, xrefs: 00007FF63D90D3A7

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 6a2bea4392b2130e34a27003928b1a1b59b2f45c4f6fe4f375bb331a3221da70
Instruction ID: 3f24646f6c010760e48cc1608645f9cdff10540808536906e434e353b4b03f74
Opcode Fuzzy Hash: 6a2bea4392b2130e34a27003928b1a1b59b2f45c4f6fe4f375bb331a3221da70
Instruction Fuzzy Hash: 14D15C61A0C24B41FB659FA5E9442B86794AF01BD4F885032DA5DC6BCFFE6CF842B301

Function 00007FF63D9088B0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF63D908B66), ref: 00007FF63D9088CB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D9088EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90890C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D908915

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction ID: 308e5e15285d8f6380a5520e70a3695b27593e70661efa501bd81c9d68c80a8a
Opcode Fuzzy Hash: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction Fuzzy Hash: D1618926B15B4982EA25DF52B84416973A4FF48B94B058075CF8E83B9AEF3CE484E310

Function 00007FF63D9119D0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D911AF0

Strings

server did not report OK, got %d, xrefs: 00007FF63D911D5E
ABOR, xrefs: 00007FF63D911BEB
No data was received!, xrefs: 00007FF63D911E2C
Failure sending ABOR command: %s, xrefs: 00007FF63D911C11
control connection looks dead, xrefs: 00007FF63D911CE2
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF63D911DC6
Remembering we are in dir "%s", xrefs: 00007FF63D911B88
partial download completed, closing connection, xrefs: 00007FF63D911D23
Received only partial file: %I64d bytes, xrefs: 00007FF63D911DFE

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: 4f8d1fe6c507fc75a8a7447a995cc6d66b45d7b9cd231fe4e4829fdd3982d9d9
Instruction ID: c298d01821da13ef6c95a4e41357c10a055ed9eebd4e1307e86f5baa1b66fdda
Opcode Fuzzy Hash: 4f8d1fe6c507fc75a8a7447a995cc6d66b45d7b9cd231fe4e4829fdd3982d9d9
Instruction Fuzzy Hash: 90D1C361A0C68A65EB649BA0A4403F96799FB41794F404231CAADD77CBFF7CF459A300

Function 00007FF63D8DC031 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8D4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D8D4341

Part of subcall function 00007FF63D8D6310: memcpy.VCRUNTIME140 ref: 00007FF63D8D6486

Part of subcall function 00007FF63D8D1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC0E0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DC10E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DC11C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC156
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC1B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC333
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC37D

Strings

value, xrefs: 00007FF63D8DC04F, 00007FF63D8DC1D8

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 907c027a49782bd1002e07455baf20756771f542bad6bb0b414523d8210b4af8
Instruction ID: 06bb5b89576bd290723625c2f11cc433e6b4cf04ad06008a9a6d726940b89b43
Opcode Fuzzy Hash: 907c027a49782bd1002e07455baf20756771f542bad6bb0b414523d8210b4af8
Instruction Fuzzy Hash: 34A19622A18A8941EB009BF9E4443AD6361FF457B4F501332EA6D92BE9EF7CE085D700

Function 00007FF63D8EA010 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA07D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EA09D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EA0D1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EA0F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA115
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA126
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EA148
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA1FF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EA214

Strings

ignoring failed cookie_init for %s, xrefs: 00007FF63D8EA152
Set-Cookie:, xrefs: 00007FF63D8EA186
none, xrefs: 00007FF63D8EA092

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: 88899a74057057c88eedf4ad62886504cfa5c0b3359586eb28e03194c433b762
Instruction ID: 081bf12baf0b3dac32d553a93ae793030d372e9a28cdb5954bfffa87790edf39
Opcode Fuzzy Hash: 88899a74057057c88eedf4ad62886504cfa5c0b3359586eb28e03194c433b762
Instruction Fuzzy Hash: C361B222A0C78A81EB559BA5A8042F927D4FF46F84F485034DE8E87796FF3DF405AB40

Function 00007FF63D924930 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9249A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9249C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9249E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9249EF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D924A76
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D924AC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D924B26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D924CAC

Strings

Negotiate, xrefs: 00007FF63D924934, 00007FF63D924A3C, 00007FF63D924AE3
InitializeSecurityContext failed: %s, xrefs: 00007FF63D924CCA
CompleteAuthToken failed: %s, xrefs: 00007FF63D924D07
HTTP, xrefs: 00007FF63D924930
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF63D924B76

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: 9b585e6bd0feb1063935b59970e61f5a74aa7bdd2576848c92edd7d7f5558c6b
Instruction ID: e751dacd12923e22d7ffda35112c134d610782cc1c60d7543e67a3cd5ce9cf09
Opcode Fuzzy Hash: 9b585e6bd0feb1063935b59970e61f5a74aa7bdd2576848c92edd7d7f5558c6b
Instruction Fuzzy Hash: B3C16C72A05B59C6EB10DFA5E8502AD37B4FB54B88F000136DE4D87B9AEF38E845DB40

Function 00007FF63D926810 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9268C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926929
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92694C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9269AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926A1C

Strings

%lx, xrefs: 00007FF63D9269EC
Version, xrefs: 00007FF63D926A07
%2d Subject: %s, xrefs: 00007FF63D926914
TRUE, xrefs: 00007FF63D926A81
Issuer, xrefs: 00007FF63D926980
Subject, xrefs: 00007FF63D9268FA
Version: %lu (0x%lx), xrefs: 00007FF63D926A2E
Issuer: %s, xrefs: 00007FF63D92699A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: 2e18772b0babaabf96da70afab19b25dd9ef6fe2d3988751f7e99ff51ff6f865
Instruction ID: 1423ac1e8900e69903119195eee211489ac6296031c44e9f4b6c139ca8f9c37b
Opcode Fuzzy Hash: 2e18772b0babaabf96da70afab19b25dd9ef6fe2d3988751f7e99ff51ff6f865
Instruction Fuzzy Hash: D961BD62A0978A85EB158BA1E8443FA23A1BF45798F440A36CD5E877DBFF3CE154D300

Function 00007FF63D919D20 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF63D919D8B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D919EB5

Part of subcall function 00007FF63D8E5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8EFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8E1B61), ref: 00007FF63D8E5757
Part of subcall function 00007FF63D8E5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8EFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8E1B61), ref: 00007FF63D8E5763

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D919E6F

Part of subcall function 00007FF63D8E5690: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E56A0

Strings

XDISPLOC, xrefs: 00007FF63D919E8B
%127[^= ]%*[ =]%255s, xrefs: 00007FF63D919E30
TTYPE, xrefs: 00007FF63D919E45
NEW_ENV, xrefs: 00007FF63D919ED1
Syntax error in telnet option: %s, xrefs: 00007FF63D919FC6
USER,%s, xrefs: 00007FF63D919DB0
BINARY, xrefs: 00007FF63D919F5E
%hu%*[xX]%hu, xrefs: 00007FF63D919F39
Unknown telnet option %s, xrefs: 00007FF63D919FAD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: da2cc46d67d0a219d26850ebc5348b5f8784cef6f8666290cff01ef196f61833
Instruction ID: d8a517223cdbd202c30fcdf8199e7fb7504d5d80a974f51f87895c717b22e335
Opcode Fuzzy Hash: da2cc46d67d0a219d26850ebc5348b5f8784cef6f8666290cff01ef196f61833
Instruction Fuzzy Hash: 0F717172A0CACAA5FB218F54D4417E963A8FF84798F844032DA8D8739AFF38E555D740

Function 00007FF63D91C5A3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91C6A3

Strings

%s%c%s%c, xrefs: 00007FF63D91C6BA
TFTP file name too long, xrefs: 00007FF63D91C68F
%I64d, xrefs: 00007FF63D91C736
timeout, xrefs: 00007FF63D91C965
blksize, xrefs: 00007FF63D91C878
tsize, xrefs: 00007FF63D91C7B2
TFTP buffer too small for options, xrefs: 00007FF63D91C79F, 00007FF63D91C8E8

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: a8180e9f6d2c3404b4c8cde9795521e6aeca6fd533f5cebbf2dd30bb0d07b83b
Instruction ID: 23d9e4308c8ab4f295d1b7dfa6808ab78bda388bce26a16e5627257912144e23
Opcode Fuzzy Hash: a8180e9f6d2c3404b4c8cde9795521e6aeca6fd533f5cebbf2dd30bb0d07b83b
Instruction Fuzzy Hash: 10D19162A08ACA85EF11CFA4D4403B9B7A5FB45B88F848132DA4D877CAEF7CD549D310

Function 00007FF63D91CE20 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF63D91CF93
sendto.WS2_32 ref: 00007FF63D91D04C
WSAGetLastError.WS2_32 ref: 00007FF63D91D05A

Strings

tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF63D91D004
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF63D91CE8D
Received ACK for block %d, expecting %d, xrefs: 00007FF63D91CFE5
tftp_tx: internal error, event: %i, xrefs: 00007FF63D91CE78

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 2c42f4589fd93ccc31a9c772dbb528ab0ebb5ca0010053bde185be85adee39dc
Instruction ID: 290cbe06b1620a0a48b5e0a9a9746c8f29e268e5dbf5fe36af485e9320e44533
Opcode Fuzzy Hash: 2c42f4589fd93ccc31a9c772dbb528ab0ebb5ca0010053bde185be85adee39dc
Instruction Fuzzy Hash: 87B18F72608A86C6E7258F69D8407AD37A4FB88F88F444132DE4D8B79DEF38E445D750

Function 00007FF63D91A850 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF63D91AA4C
WSAGetLastError.WS2_32 ref: 00007FF63D91AA5E
send.WS2_32 ref: 00007FF63D91AB56
WSAGetLastError.WS2_32 ref: 00007FF63D91AB60

Strings

%c%c, xrefs: 00007FF63D91AA28
#, xrefs: 00007FF63D91AACE
%c%c%c%c, xrefs: 00007FF63D91A92D
Sending data failed (%d), xrefs: 00007FF63D91AA64, 00007FF63D91AB66
%c%c%c%c%s%c%c, xrefs: 00007FF63D91AB2F
%127[^,],%127s, xrefs: 00007FF63D91A9B8
%c%s%c%s, xrefs: 00007FF63D91A9F0

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: 50ee8aa9fddf47a21618979ca5a05e459097dd67ce3ab72c0ee9a09730b3203c
Instruction ID: 4601d003f51b844dc4ab0ff20cc66d58d89ac690a10017ede68610a47cc085e2
Opcode Fuzzy Hash: 50ee8aa9fddf47a21618979ca5a05e459097dd67ce3ab72c0ee9a09730b3203c
Instruction Fuzzy Hash: 8691AD22A08AC595F7218F94E8057EA63A5FB847A8F440231EE8D47BDAEF3CD546D740

Function 00007FF63D8F3DF0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3E2D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3EAF
strchr.VCRUNTIME140 ref: 00007FF63D8F3F2E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D8F3F5C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3F7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3F8F

Strings

%25, xrefs: 00007FF63D8F3EA5
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF63D8F3EB9
Invalid IPv6 address format, xrefs: 00007FF63D8F3F17
No valid port number in connect to host string (%s), xrefs: 00007FF63D8F3FBB

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: c0389e6460597208a1fcbcc33ceaf34b3b224a0e2a46fa55c8373790c4765b53
Instruction ID: aa435c9e3c65f9fec78001ff40fb498b0e31e597804379522943226d60d98c0a
Opcode Fuzzy Hash: c0389e6460597208a1fcbcc33ceaf34b3b224a0e2a46fa55c8373790c4765b53
Instruction Fuzzy Hash: 6351C562E0C68E46EB658BA5A8603B977E5EF05794F484031DA4D867C6FF3CF445A300

Function 00007FF63D8E9E00 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9E3E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E9E5E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8E9E90
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8E9EAD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9ECB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9EDC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8E9EFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63D8E4050), ref: 00007FF63D8E9FAF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF63D8E4050), ref: 00007FF63D8E9FC5

Strings

Set-Cookie:, xrefs: 00007FF63D8E9F36
none, xrefs: 00007FF63D8E9E53

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 3b281a9d8fec38794cab6deb469b12af5d61e8eb2c6cb3d8728870ef85f7b18c
Instruction ID: f16fd04dc01d8de04adc94924dce1fb56bd47ec9731087e9582c6e1cb910736b
Opcode Fuzzy Hash: 3b281a9d8fec38794cab6deb469b12af5d61e8eb2c6cb3d8728870ef85f7b18c
Instruction Fuzzy Hash: 3551C86190C78A41FB55AB91A9102B967D0FF45B84F085434DECE827D5FF7CF446A700

Function 00007FF63D8FB9D0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8FBD66

Strings

Read callback asked for PAUSE when not supported!, xrefs: 00007FF63D8FBBC9
Successfully compiled trailers., xrefs: 00007FF63D8FBAAA
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF63D8FBCFA
operation aborted by callback, xrefs: 00007FF63D8FBB3D
Moving trailers state machine from initialized to sending., xrefs: 00007FF63D8FBA11
%zx%s, xrefs: 00007FF63D8FBC87
read function returned funny value, xrefs: 00007FF63D8FBC0B
operation aborted by trailing headers callback, xrefs: 00007FF63D8FBB5D
Signaling end of chunked upload after trailers., xrefs: 00007FF63D8FBDB0
Unable to allocate trailing headers buffer !, xrefs: 00007FF63D8FBA43

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: d8d1418f8031cba0bf6fb4262a2c68856d9d2c7bea2d3532c97021ddabc94649
Instruction ID: 61b30cb589e34fa7a222dfb1385cfea6dbca28265b9eaf3b51b7d56eb75d5f70
Opcode Fuzzy Hash: d8d1418f8031cba0bf6fb4262a2c68856d9d2c7bea2d3532c97021ddabc94649
Instruction Fuzzy Hash: 17A17032A08A8A81E751DFA5E8403FA23D9EB85B94F585131DD4D8B3DAFE3CF441A311

Function 00007FF63D90D9E0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90DB10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90DB26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90DB89

Strings

Mime-Version: 1.0, xrefs: 00007FF63D90DC31
SELECT %s, xrefs: 00007FF63D90DB75
Cannot SELECT without a mailbox., xrefs: 00007FF63D90DB3F
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF63D90DCBD
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF63D90D9F8
Mime-Version, xrefs: 00007FF63D90DC16
Cannot APPEND without a mailbox., xrefs: 00007FF63D90DBB4
Cannot APPEND with unknown input file size, xrefs: 00007FF63D90DC87

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 7504568c3eadcb67795fcc710138e6e92c1df6eea46f795b5d6e6b2f2caaf592
Instruction ID: 2396a3e7f2bf1e0974c92b0f5fdf4ed89fa9fd0db2692c5a3eb879f780709e8b
Opcode Fuzzy Hash: 7504568c3eadcb67795fcc710138e6e92c1df6eea46f795b5d6e6b2f2caaf592
Instruction Fuzzy Hash: BE915D61B0CA4A86FB649BA1A8503B96394EF45BC4F044035DA4E87BCBFF7CE854E340

Function 00007FF63D8F4590 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F5584
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F559A
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55AE
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55C2
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55D6
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55EA
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55FE
Part of subcall function 00007FF63D8F5570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F5612

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F4612

Part of subcall function 00007FF63D91E540: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E555
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E56F
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E58A
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5A6
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5C2
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5DA
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5F2
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E60A
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E622
Part of subcall function 00007FF63D91E540: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E63A
Part of subcall function 00007FF63D91E540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E654

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F4816
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F4859
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D8F499E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F4A1B

Strings

Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF63D8F475F
file, xrefs: 00007FF63D8F4903, 00007FF63D8F497C
%s://%s, xrefs: 00007FF63D8F461F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: aede1fb7b6da657e8b39b25d02583713103dfba9771a86412c2b46d958339e45
Instruction ID: d9de5b5788ccf8486b83b22a36f18200278f1f100013526694ee61dae981155d
Opcode Fuzzy Hash: aede1fb7b6da657e8b39b25d02583713103dfba9771a86412c2b46d958339e45
Instruction Fuzzy Hash: 3AC15132B0C68A86FB698AB9A9503F923D8AB45744F040532CA1DC7795FF3CF554A300

Function 00007FF63D8D1FB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8D2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2469
Part of subcall function 00007FF63D8D2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D24A8

Part of subcall function 00007FF63D8D4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D8D4341

Part of subcall function 00007FF63D8D3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF63D8D1D8B), ref: 00007FF63D8D3BF6

Part of subcall function 00007FF63D8D5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5E61

Part of subcall function 00007FF63D8D3C30: memcpy.VCRUNTIME140 ref: 00007FF63D8D3C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2121
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2171
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D21C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2202
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2254
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2293
__std_exception_copy.VCRUNTIME140 ref: 00007FF63D8D22E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2337

Strings

parse_error, xrefs: 00007FF63D8D2011
parse error, xrefs: 00007FF63D8D203B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: b9f953f85efe2737f4ea5801a044b849877f2ec745bd3841908ce74f93fcba4a
Instruction ID: 1b309f9a5db027241c0adf9fd386ef6cfd5b235eb76459790ffd0d621c7a777c
Opcode Fuzzy Hash: b9f953f85efe2737f4ea5801a044b849877f2ec745bd3841908ce74f93fcba4a
Instruction Fuzzy Hash: 0AB18662A04B4985FB00CBA5E8443AD7771EB457A8F505631EA6D53BEAEF78E1C4E300

Function 00007FF63D8FBDD0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FBE4A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FBE65
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FBEE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FBF6C

Strings

Switch from POST to GET, xrefs: 00007FF63D8FC036
GET, xrefs: 00007FF63D8FBFDE
Switch to %s, xrefs: 00007FF63D8FBFF7
Issue another request to this URL: '%s', xrefs: 00007FF63D8FBF77
Maximum (%ld) redirects followed, xrefs: 00007FF63D8FBF37
HEAD, xrefs: 00007FF63D8FBFD7

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: b941f56203112eb735e749685b5e095cafadd7fb3b5203ee30a478e70944225f
Instruction ID: c27af957f7d05b8c61886a650f9405c1be01ee86b776d5370b174775ab48431b
Opcode Fuzzy Hash: b941f56203112eb735e749685b5e095cafadd7fb3b5203ee30a478e70944225f
Instruction Fuzzy Hash: F971C472A0C68A80E761CBA9A4403BD37E9EB85B94F180031DE4DC7799EF3DF581A351

Function 00007FF63D8F0F70 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F0FED
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F100A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F101E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F103A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F1057
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F107A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F108E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10C8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10DC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F10F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F113F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F114C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F1175

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 31be3772069e500a7aef819516f3faf0ac6f02a24d8bfe9d18ec5130e08255e8
Instruction ID: 5fe1e37a770d60b8f4f95f90c9b5e7b3d4ad356b49bcc742cea3b552d68a0676
Opcode Fuzzy Hash: 31be3772069e500a7aef819516f3faf0ac6f02a24d8bfe9d18ec5130e08255e8
Instruction Fuzzy Hash: 74510131919A8681EB14DF71E8512FD23A4FF85F98F085031DE4E8B79ADF39A095A350

Function 00007FF63D92B680 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92BB4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92BBA3

Strings

XOAUTH2, xrefs: 00007FF63D92BA05
EXTERNAL, xrefs: 00007FF63D92B79B
NTLM, xrefs: 00007FF63D92B909
CRAM-MD5, xrefs: 00007FF63D92B8D2
GSSAPI, xrefs: 00007FF63D92B816
OAUTHBEARER, xrefs: 00007FF63D92B992
LOGIN, xrefs: 00007FF63D92BAC3
PLAIN, xrefs: 00007FF63D92BA5A
DIGEST-MD5, xrefs: 00007FF63D92B8B3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: 13ca91801db0d7697efb043c9153a7fd339819c6765acc440fe6433b89c3a7f6
Instruction ID: 069e4d5a7909ae622cf1c43e1131a41c1ea33b275249cfc836bfd960165895bc
Opcode Fuzzy Hash: 13ca91801db0d7697efb043c9153a7fd339819c6765acc440fe6433b89c3a7f6
Instruction Fuzzy Hash: 69D14962909A8A85EB618B91E8403AA77E4FB8475CF040236DE8C477DEEF3CE545D714

Function 00007FF63D90D6B0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D90C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF63D8F340F), ref: 00007FF63D90C0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90D94E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90D958
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90D9B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90D9BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90D9CA

Strings

PARTIAL, xrefs: 00007FF63D90D906
MAILINDEX, xrefs: 00007FF63D90D887
UID, xrefs: 00007FF63D90D846
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF63D90D6B8
SECTION, xrefs: 00007FF63D90D8C8
UIDVALIDITY, xrefs: 00007FF63D90D805

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 8e1e589f99b5e9eb405cff7163e3db68d2180580e02b1a305af9f4982e269c67
Instruction ID: 993cd73caefb15556b64bab6e23077ab5813fbbd33d10b2192c25a1cb518236d
Opcode Fuzzy Hash: 8e1e589f99b5e9eb405cff7163e3db68d2180580e02b1a305af9f4982e269c67
Instruction Fuzzy Hash: 94A1446290968A85EB518F65E8503B827A0FF45BD8F481031EE5E87FCAEF39D485E300

Function 00007FF63D8EC930 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF63D8EC977
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF63D8EC987
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EC99E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8ECA1A
strrchr.VCRUNTIME140 ref: 00007FF63D8ECA37
strrchr.VCRUNTIME140 ref: 00007FF63D8ECA47
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8ECA77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8ECA83
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8ECA92
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8ECAA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8ECAB9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 65c608ef1fe535978de831929790de7b27f3758338418f5053a35891be0bad24
Instruction ID: 57e6e2d1dc0fbcc3e9caad177597eba6fc5df0d7980cc60e2592a1a48aa188f3
Opcode Fuzzy Hash: 65c608ef1fe535978de831929790de7b27f3758338418f5053a35891be0bad24
Instruction Fuzzy Hash: 13417F61B09B4A86FA60EF92A44027963A0FF48B90F481134EE5D87795FF3CF455A700

Function 00007FF63D91E540 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E555
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E56F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E58A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5DA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E5F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E60A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E622
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E63A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F45B5,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D91E654

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: b29704e7a7bafcfd67e48d247ff31038bc34b79da22b3b3364008b4691575eec
Instruction ID: c1ced85695f99626a705222817c77a2c67e81eacbc811d633ba4c8cd3439b4f8
Opcode Fuzzy Hash: b29704e7a7bafcfd67e48d247ff31038bc34b79da22b3b3364008b4691575eec
Instruction Fuzzy Hash: EE31ED65A16B0A86FE6ACFD6A15017823E4FF48B54F4C0535CA1E827CAFF3CE464A350

Function 00007FF63D8F1C60 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF63D8F1C98
strchr.VCRUNTIME140 ref: 00007FF63D8F1CBF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1D74
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1DBB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1DCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1DD5
memcpy.VCRUNTIME140 ref: 00007FF63D8F1DF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1E07
memcpy.VCRUNTIME140 ref: 00007FF63D8F1E24
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1E39
memcpy.VCRUNTIME140 ref: 00007FF63D8F1E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F1E66

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction ID: 30c2550067ce04c728be66068db2fe987a571ec4b64f10f399165c6e9dbb2a71
Opcode Fuzzy Hash: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction Fuzzy Hash: AE517D25B19B8985EA65EF95B5142B963E9BF44BC4F084430DE8D87789FF3CF419A300

Function 00007FF63D8F3B80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF63D8F3D09

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 68ac9eeb43db9e5fab4e5cb7431107d5fc0a2d7964483fdef9680f4b84830d14
Instruction ID: a43ac5fef16b76e1c38c6165105520cd8c40d8f19358743f9c08f8928c423d7f
Opcode Fuzzy Hash: 68ac9eeb43db9e5fab4e5cb7431107d5fc0a2d7964483fdef9680f4b84830d14
Instruction Fuzzy Hash: EE71AF22E08B8A86EB65ABA5E4543B967E8FB84784F140035DB5D87395EF3EF454E300

Function 00007FF63D8F3B29 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F3C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8F3C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF63D8F3D09

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 409e8ccf2cd3c48ddd194ed0cbd5bbb9f08e90a8da56c531e43f24badbebf168
Instruction ID: d5b0f2ab0bc6e2a29b84fb1d9e01beda2df6f970577d8c08fa8a3c80a18fd094
Opcode Fuzzy Hash: 409e8ccf2cd3c48ddd194ed0cbd5bbb9f08e90a8da56c531e43f24badbebf168
Instruction Fuzzy Hash: 5E61C222A08B8686E765DBA5E8643AD7BA4FB44B84F094031CB9D87391EF3DF455E300

Function 00007FF63D914590 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 00007FF63D9145D0
%s%s%s, xrefs: 00007FF63D9146B5
LIST, xrefs: 00007FF63D914692
Couldn't set desired mode, xrefs: 00007FF63D9145AE
NLST, xrefs: 00007FF63D91468B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 10e739815150c1fc96bd3dcf5279b1569fc72bf075f00fb4c524cee43709b833
Instruction ID: 8443a761dafdc031485714c0be997e1f635d67499f72e422a50d22c0b903500e
Opcode Fuzzy Hash: 10e739815150c1fc96bd3dcf5279b1569fc72bf075f00fb4c524cee43709b833
Instruction Fuzzy Hash: 9E41B222B0865AC6EB249BE5E8401BD63A4BF49BD4F444131DA4D877DBFF7CE944A700

Function 00007FF63D9275CE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D927602
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
TRUE, xrefs: 00007FF63D9275F0
FALSE, xrefs: 00007FF63D9275F7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 0f6e6d2ff9e25c00b2ba7230e7ec17ef429f3a51a60f19fd29005913708eaf6c
Instruction ID: f1d3c61ca057d3230623748293424558db4bb3a062379992e4db9e75305f57cc
Opcode Fuzzy Hash: 0f6e6d2ff9e25c00b2ba7230e7ec17ef429f3a51a60f19fd29005913708eaf6c
Instruction Fuzzy Hash: EA41B366A0878E49EB118BA5A8442F927A5BF0578CF480431CE4D9B3DBFF3CE554E300

Function 00007FF63D8E2640 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF63D8E265C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E2664
FormatMessageA.KERNEL32 ref: 00007FF63D8E269E
strchr.VCRUNTIME140 ref: 00007FF63D8E26B3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E26FC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E2706
GetLastError.KERNEL32 ref: 00007FF63D8E270E
SetLastError.KERNEL32 ref: 00007FF63D8E271A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF63D8E26EA

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: 6db4a148488e5faae759fa00f2047bf7036d17ce9e803fcf4c659236faa6b94c
Instruction ID: 2cfb492d48af6246a2a0033eb83ef4d7ecc41b1f672a07aa5ff11f73655012d8
Opcode Fuzzy Hash: 6db4a148488e5faae759fa00f2047bf7036d17ce9e803fcf4c659236faa6b94c
Instruction Fuzzy Hash: 5D219362A0C78982EB215FA1A80032E7BE0BF54BD0F085534DE4D937A9EF3CE5559B10

Function 00007FF63D8E1E42 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95
SEC_E_BAD_BINDINGS, xrefs: 00007FF63D8E1E42

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: e72c6dac9182f083b27a246ce7e39daeaee275ef12f8df3a52750dc7f20c32e7
Instruction ID: 4ac9c56545031556cc3913e139454e29e8c5d6e3053b87f04ddea94f658d69cf
Opcode Fuzzy Hash: e72c6dac9182f083b27a246ce7e39daeaee275ef12f8df3a52750dc7f20c32e7
Instruction Fuzzy Hash: 30318A62A0C7C586E7219BA0E4543BEB7A4FB84740F840535DA8D82B9AEF3CE544DB10

Function 00007FF63D8E1E72 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95
SEC_E_CANNOT_PACK, xrefs: 00007FF63D8E1E72

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 22f5f913cf0be7411f16a76cd575f268f1e4d73e328349b01835e54fb8980df1
Instruction ID: 9b21313e5fb0a685cf85ecb682578081d64dede411bf1699871812b907bb9e4f
Opcode Fuzzy Hash: 22f5f913cf0be7411f16a76cd575f268f1e4d73e328349b01835e54fb8980df1
Instruction Fuzzy Hash: 5D318A62A0C7C586E7219BA0E4543BEB7A4FB84740F840535DA8D8279AEF3CE544DB10

Function 00007FF63D8E1E66 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

SEC_E_CANNOT_INSTALL, xrefs: 00007FF63D8E1E66
%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: d674bc91ab309861c4f229d8fb5e2326304ccee02d36cd07337ee2d10ece94b6
Instruction ID: 5cff0a3546ac081ac63ebf9b4d376bc2b7d0a530c8e708721d7b35e82d103b22
Opcode Fuzzy Hash: d674bc91ab309861c4f229d8fb5e2326304ccee02d36cd07337ee2d10ece94b6
Instruction Fuzzy Hash: 8A318A62A0C7C586E7219BA0E8543BEB7A4FB84740F840535DA8D82B9AEF3CE544DB10

Function 00007FF63D8E1E5A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

%s - %s, xrefs: 00007FF63D8E2299
SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF63D8E1E5A
%s (0x%08X), xrefs: 00007FF63D8E1D95

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 21007d3461f6208895004d40506dbe1f915b5f9fd6c49eefa50c2d29984a337d
Instruction ID: f2d0cfa6c792caff169c64790a23808699c5b2f74ef855e16c22235008d92cb5
Opcode Fuzzy Hash: 21007d3461f6208895004d40506dbe1f915b5f9fd6c49eefa50c2d29984a337d
Instruction Fuzzy Hash: 0C318A62A0C7C586E7219BA0E4543BEB7A4FB84740F840535DA8D8279AEF3CE544DB10

Function 00007FF63D8E1E8A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95
SEC_E_CERT_UNKNOWN, xrefs: 00007FF63D8E1E8A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 867b3c2889ea910bc82d5d4d60626029d6c103a08cfe34e10975424c7ee76e4e
Instruction ID: 3d44b10ed3025448960fbab3b30217ccf00ab450bd3a5b74b28a400e675e8229
Opcode Fuzzy Hash: 867b3c2889ea910bc82d5d4d60626029d6c103a08cfe34e10975424c7ee76e4e
Instruction Fuzzy Hash: 7A318A62A0C7C586E7219BA0E4543BEB7A4FB84740F840535DA8D8279AEF3CE544DB10

Function 00007FF63D8E1E7E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

SEC_E_CERT_EXPIRED, xrefs: 00007FF63D8E1E7E
%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: e21ee0f88ee939b7acd86ddd09091f8135850e0e83f13a8bc41a40d40aa2e6f4
Instruction ID: 50ce24eb7a1a051cffa549c94067988f4d487a0e4b6216a6cedbb8856dafef3b
Opcode Fuzzy Hash: e21ee0f88ee939b7acd86ddd09091f8135850e0e83f13a8bc41a40d40aa2e6f4
Instruction Fuzzy Hash: 15318A62A0C7C586E7219BA0E4543BEB7A4FB84740F840535DA8D82B9AEF3CE544EB10

Function 00007FF63D8E1D8E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF63D8E1DE9
strchr.VCRUNTIME140 ref: 00007FF63D8E1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8E22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E22C5
GetLastError.KERNEL32 ref: 00007FF63D8E22CE
SetLastError.KERNEL32 ref: 00007FF63D8E22DA

Strings

%s - %s, xrefs: 00007FF63D8E2299
%s (0x%08X), xrefs: 00007FF63D8E1D95
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF63D8E1D8E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: 16bb4725a52e87406c64d7570a0d1708fd42835543bc5ceca5d1af16b41e7555
Instruction ID: ec8262318676465fc24e25a348986d7e31c0d11aa276dd8bbe4a238f40fad27c
Opcode Fuzzy Hash: 16bb4725a52e87406c64d7570a0d1708fd42835543bc5ceca5d1af16b41e7555
Instruction Fuzzy Hash: 4D319C6260C7C586EB319FA0E8443AEB794FB85744F840535DA8D8279AEF3CE544DB10

Function 00007FF63D8EA970 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF63D8EA3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8F10B9), ref: 00007FF63D8EA993
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA9E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA9F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EA9FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EAA38

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction ID: 0b76c43a2e6a7d27679c758d0cca2d5b852ea1a8d882b971e8a037dde04f2860
Opcode Fuzzy Hash: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction Fuzzy Hash: 4C21FF36A18A4581DB20DF62E9441796370FF49F94F055071DE9E8375AEF3CE485E740

Function 00007FF63D8F3FF0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F40CC
strchr.VCRUNTIME140 ref: 00007FF63D8F4100
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D8F4120
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F41A4

Strings

%s%s%s, xrefs: 00007FF63D8F408F
anonymous, xrefs: 00007FF63D8F4000
Connecting to hostname: %s, xrefs: 00007FF63D8F417B
Connecting to port: %d, xrefs: 00007FF63D8F41C0

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: b1d23da1f6448ceea52aefbd53d22620ef15af7bfc877e12de7476ea10bbd4ea
Instruction ID: 495339150b1fd2fbc1c6d0f3427464234f569a6dfa7a782d4e9bf11669f2a2be
Opcode Fuzzy Hash: b1d23da1f6448ceea52aefbd53d22620ef15af7bfc877e12de7476ea10bbd4ea
Instruction Fuzzy Hash: E051C622A0CBCA84EB219FA9B8403A927D8FB41B98F444136DE9D87795EF3DE545D300

Function 00007FF63D9106A0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91075F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D9107A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D910860

Strings

EXPN, xrefs: 00007FF63D9106E7
%s %s%s, xrefs: 00007FF63D910729
VRFY %s%s%s%s, xrefs: 00007FF63D91082E
SMTPUTF8, xrefs: 00007FF63D91070D, 00007FF63D910815
HELP, xrefs: 00007FF63D910895

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: 7750b02f0dbcdff0acb3bf35a48202898c7d4dc77abf2a9b37d649822f35866f
Instruction ID: 183ce105683a2e8394a2d2d1ed988cd14553cf5df5391f65073a758e41cd96d5
Opcode Fuzzy Hash: 7750b02f0dbcdff0acb3bf35a48202898c7d4dc77abf2a9b37d649822f35866f
Instruction Fuzzy Hash: 2851C662F1CB8991EB11CB52E8107B967A4FB86B84F450231DA8D837CAEF3EE554D340

Function 00007FF63D8E4067 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

RELOAD, xrefs: 00007FF63D8E4115
SESS, xrefs: 00007FF63D8E40B3
ALL, xrefs: 00007FF63D8E4073
Set-Cookie:, xrefs: 00007FF63D8E4188
FLUSH, xrefs: 00007FF63D8E40F3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 567cec5eb1f694fa24dd200d27c250479e4804b01726046d216b7bbc46925cfe
Instruction ID: 90b1f60c6e663335d41ab483f4d2fd5745e8267940f87501b9f62a3616fbeabb
Opcode Fuzzy Hash: 567cec5eb1f694fa24dd200d27c250479e4804b01726046d216b7bbc46925cfe
Instruction Fuzzy Hash: 55416211F0C54B42FA18ABB5A9502B96395AF84BD0F486031DE0EC77D6FE3DF415BA40

Function 00007FF63D926A9C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D926AC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
FALSE, xrefs: 00007FF63D926AB8
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: e343febf516ec9d38bf4e5ff34aca985b545a36e1131153d014cfbc99d8ea65a
Instruction ID: 8ddd91d0fdb6f663e26bc3e9a3e25e8c4ba1a103d96d2fe8129b390a826aa4f0
Opcode Fuzzy Hash: e343febf516ec9d38bf4e5ff34aca985b545a36e1131153d014cfbc99d8ea65a
Instruction Fuzzy Hash: 0241AE62B0978A85EF158BA5E8442F927A5BF0578CF480475CE4E8B7DBEF3CE154A300

Function 00007FF63D8E96A0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E96CD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E96F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E9701
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E970B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E9715
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E971F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E9729
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E9733
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E973D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E9746
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF63D8F10B9,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8E9761

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: dca2646a6d4bee659c796f93a2f38fa2669d1fcc608c2bf197bd4bbed9a2a8d6
Instruction ID: 821ac013b8a77292c6114442e6e4dd34b126fce573848de09cabc34519d69768
Opcode Fuzzy Hash: dca2646a6d4bee659c796f93a2f38fa2669d1fcc608c2bf197bd4bbed9a2a8d6
Instruction Fuzzy Hash: 5421D876A28A4582DB20DF61F8541696370FF89F99F141071DE9E8376ADE3CD889E700

Function 00007FF63D91E8E0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EA35
memcpy.VCRUNTIME140 ref: 00007FF63D91EA52

Strings

%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF63D91EC22
file://%s%s%s, xrefs: 00007FF63D91E92E
https, xrefs: 00007FF63D91E970
%%25%s], xrefs: 00007FF63D91EA62
file, xrefs: 00007FF63D91E8FB
%ld, xrefs: 00007FF63D91E99E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: b4658a80f4914b881289cdf9ec249ecfe85db5b317b3999fd571b759e4aeb899
Instruction ID: 5766e31f430bec095332be35b77ed31473f431a4b34a3d1337f17f4e74be69a8
Opcode Fuzzy Hash: b4658a80f4914b881289cdf9ec249ecfe85db5b317b3999fd571b759e4aeb899
Instruction Fuzzy Hash: EDA15062B09B8A89EB658F91A9403A973A8FF44B84F444135DE5D837DEEF3CE454E700

Function 00007FF63D92794C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92798F
memcpy.VCRUNTIME140 ref: 00007FF63D9279B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927A88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 675581fe95d70d56e8e3699e3a784245db5b4a778fe3a8afeca15a521e899947
Instruction ID: 933b98266c2a249c885a665674fb9ea82fa4108f0bacb420e5cee770a3117147
Opcode Fuzzy Hash: 675581fe95d70d56e8e3699e3a784245db5b4a778fe3a8afeca15a521e899947
Instruction Fuzzy Hash: 0A612665A0878E45EF188BA198152F927A2BF0579CF444535CE5E9B7CBFE3CE154A300

Function 00007FF63D926DD6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926E0F
memcpy.VCRUNTIME140 ref: 00007FF63D926E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: d4e23496baadb6999b3355ec43cb5b2942b84d7c3c397044e5b8f182b07cf7af
Instruction ID: 660da6e8f1f95b64b6392d9e0c6dba0d3bf061cbdb633b2aa52ea0802ba34f08
Opcode Fuzzy Hash: d4e23496baadb6999b3355ec43cb5b2942b84d7c3c397044e5b8f182b07cf7af
Instruction Fuzzy Hash: 0161F352A0978E45EF198BA5D4542F927A2AF0579CF084535CE1E8BBCFFE3CA159A300

Function 00007FF63D920E80 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF63D9044E8), ref: 00007FF63D921010
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF63D9044E8), ref: 00007FF63D921047
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF63D9044E8), ref: 00007FF63D92106E

Strings

%sAuthorization: NTLM %s, xrefs: 00007FF63D921028, 00007FF63D9210D4
NTLM, xrefs: 00007FF63D920E86
Proxy-, xrefs: 00007FF63D92101E, 00007FF63D9210CA
HTTP, xrefs: 00007FF63D920E96

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: 72266c120b509359db8940e29d2bafec9ecaf846b70da79a858558816950a900
Instruction ID: 5ec78a250ade60919dd209c2b37505bde70d1ccbbe297086a37a0891882b547d
Opcode Fuzzy Hash: 72266c120b509359db8940e29d2bafec9ecaf846b70da79a858558816950a900
Instruction Fuzzy Hash: 74617132A09B8985EB60CF95E8443AA73A4FB45BC8F004136DE8D8779AEF3CD555D701

Function 00007FF63D917B10 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8EAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EAB64

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D917C2D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D917C85
memcpy.VCRUNTIME140 ref: 00007FF63D917CAA

Strings

Session:, xrefs: 00007FF63D917B9E
Got a blank Session ID, xrefs: 00007FF63D917BD7
CSeq:, xrefs: 00007FF63D917B2D
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF63D917C3E
Unable to read the CSeq header: [%s], xrefs: 00007FF63D917B82
: %ld, xrefs: 00007FF63D917B51

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 5dbef2c0e756209cfb9fc127f82bb29073db9982edaea3d0de072ac830874615
Instruction ID: 8ba005d22edbc5a848637687c50d68a95c4f144b3d4ee474423c254c3f8f5ad2
Opcode Fuzzy Hash: 5dbef2c0e756209cfb9fc127f82bb29073db9982edaea3d0de072ac830874615
Instruction Fuzzy Hash: C9418421A0C68B81EB549FA5E9402B967A4AF45BC8F444131DA5EC73DBFF2CE905E710

Function 00007FF63D92BC20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92BCB8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92BD14
strchr.VCRUNTIME140 ref: 00007FF63D92BEFC
strchr.VCRUNTIME140 ref: 00007FF63D92BF6A

Strings

APM0123456789:, xrefs: 00007FF63D92BEF5
<DIR>, xrefs: 00007FF63D92BE40
0123456789-, xrefs: 00007FF63D92BF63

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 047adec88dde980229124f4fd7082d4da4df1b56da47dff766f1abbd12e4aa1d
Instruction ID: 84f32fded5980d615b457f4886b3620ab8b4632faca4a5b5a1cc640ccb6f9794
Opcode Fuzzy Hash: 047adec88dde980229124f4fd7082d4da4df1b56da47dff766f1abbd12e4aa1d
Instruction Fuzzy Hash: C6B16836A08A0E8AEB259F65D09037927A4FB44B4CF144435DA4E877DEEF39E490E780

Function 00007FF63D91DEF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91DF37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91E0CF

Part of subcall function 00007FF63D90C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF63D8F340F), ref: 00007FF63D90C0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91DFCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91E10D

Strings

%s?%s, xrefs: 00007FF63D91DF29
Failed sending Gopher request, xrefs: 00007FF63D91E0D5

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: b97149f697a4ec87fa41c7b983c173117a12b1e15fcd256f89d3e8d393aeb69b
Instruction ID: 1a86c6cf442d0fc7062f3f80be82f87a63b38e4fd4a0a40bb0a7261dbb18e03f
Opcode Fuzzy Hash: b97149f697a4ec87fa41c7b983c173117a12b1e15fcd256f89d3e8d393aeb69b
Instruction Fuzzy Hash: BD51A522B1DA4A86E6119BA5B8001BA6794FF45BE4F440331EE6DC37DAFE3CD542A700

Function 00007FF63D8DAB70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF63D8DC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC333

Strings

value, xrefs: 00007FF63D8DC1D8

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 2065c7959cdada8ae0f43b3798bb766cff933abfead470087c45b528edc7a64a
Instruction ID: 81e1afeeda3fc6d0e006dee460f5b0d11248f2a71763ebf82997abafc67dd325
Opcode Fuzzy Hash: 2065c7959cdada8ae0f43b3798bb766cff933abfead470087c45b528edc7a64a
Instruction Fuzzy Hash: D761A922A18A8985EB10DFB5E8443ED6361FF497A4F105332EA5D96BD9EF7CE085D300

Function 00007FF63D916BC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF63D916BF6
_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D916C4B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF63D916CBC
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D916CC9
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D916DDB

Strings

Can't get the size of %s, xrefs: 00007FF63D916CD2
Can't open %s for writing, xrefs: 00007FF63D916C5B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: d58b5c5ccc483598e4832854e43a540fe0e2e1d4e81638e85a20253436b34479
Instruction ID: 06452a9d11c2615f86390152a58369dea69540751a08044d5b7fe462b362717d
Opcode Fuzzy Hash: d58b5c5ccc483598e4832854e43a540fe0e2e1d4e81638e85a20253436b34479
Instruction Fuzzy Hash: D2518661B08A4A81EB249BA5E8103B963E5FF85BD4F444535DA5EC73DAFF3CE446A300

Function 00007FF63D91EE30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF63D91EE40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: bdf0f05f73a0858c45583dfff4fa5f00b36286e0bbb8b8d5827946e5d5b25b73
Instruction ID: 54ca44976745a887e61ff379d712bfb3569318551dfe984566213e2d298b2f1e
Opcode Fuzzy Hash: bdf0f05f73a0858c45583dfff4fa5f00b36286e0bbb8b8d5827946e5d5b25b73
Instruction Fuzzy Hash: 2651D312A0D28E45FB22CBA1A0143786B95AF46794F080171DE9E873CBFE3DE544E301

Function 00007FF63D91EE06 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EE13
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: a8ab935ad872045f021220b571eaedcfb8e3157dc64c221794b8d50643bb9222
Instruction ID: a2d8e9769c0ad6c9f1267666b2927dab04eb9483904b350715f902ad0971b740
Opcode Fuzzy Hash: a8ab935ad872045f021220b571eaedcfb8e3157dc64c221794b8d50643bb9222
Instruction Fuzzy Hash: 2D41C212A0D69E49FA32CBA160143B96BE5AF46794F080171DE9E873CBFE3DE544E311

Function 00007FF63D91A6A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF63D91A70C
htons.WS2_32 ref: 00007FF63D91A722
send.WS2_32 ref: 00007FF63D91A7C8
WSAGetLastError.WS2_32 ref: 00007FF63D91A7DC
send.WS2_32 ref: 00007FF63D91A81E
WSAGetLastError.WS2_32 ref: 00007FF63D91A828

Strings

Sending data failed (%d), xrefs: 00007FF63D91A7E2, 00007FF63D91A82E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: e72ffad40c6c327c58e12ef2ac7cdfaf983506424d5196833446f5a155874149
Instruction ID: 715e58c75c86a7b1a54ada95b0e1a5c9251009328c12904e7265e44cc877f6e3
Opcode Fuzzy Hash: e72ffad40c6c327c58e12ef2ac7cdfaf983506424d5196833446f5a155874149
Instruction Fuzzy Hash: AE41A132A08A8985E7055FB5E810AA83734F751F99F444632DB8D8379AEF7CE51AD301

Function 00007FF63D9276BE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D9276C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: 3fbb2ee2ed78fb502877e763017400895ae92542c223960a27efdc1935aabdc9
Instruction ID: ba9324554e3016e3dbf88666ea86996bd8120a4b3707e048e69bb852b0edbb9f
Opcode Fuzzy Hash: 3fbb2ee2ed78fb502877e763017400895ae92542c223960a27efdc1935aabdc9
Instruction Fuzzy Hash: 26319266A0878E49EB159BE1A8441F927A5BF0578CF440875CE4E9B3DBFF3CE554A300

Function 00007FF63D926B6E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D926B71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: d10775beb8856261a6a377fe09b1f7ea7cce4b85b7cdecb8f317ba190c89088c
Instruction ID: 69da26bbc72a8f1ab93ccdf5c31514d82226c7f256f05b9b7fcfa72d0696fd0a
Opcode Fuzzy Hash: d10775beb8856261a6a377fe09b1f7ea7cce4b85b7cdecb8f317ba190c89088c
Instruction Fuzzy Hash: 52319E52A0978E45EF158BA1A8441F927A5BF0578CF481875DE0E9B7DBFF3CA154A300

Function 00007FF63D8D1BA0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8D1D6A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D1E2D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D1E7B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D1EBB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D1F0A

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: f3abccec7c814f59f06d8638c2ddefffc87fb1d2fde3f04ad7c776f3c612ad4c
Instruction ID: f6263520a447811e1f916d1b0774acfc3aaa0509665a40fe709b643b6d2ef1bb
Opcode Fuzzy Hash: f3abccec7c814f59f06d8638c2ddefffc87fb1d2fde3f04ad7c776f3c612ad4c
Instruction Fuzzy Hash: 3CB1A222B18B4985FB10DBA5E5443AD2361EF447A8F404636DE6C977DAEF3CE099E340

Function 00007FF63D9277BD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF63D9278F1
GMT, xrefs: 00007FF63D92787E
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: 20c586ed46f578d029fc1c4b89a0decbb4f5f629725f0b5f4d429cc534bf48d2
Instruction ID: a3118bc11b7eb934dbe157229e71cb229112539f911f9aac77511f4f317457d6
Opcode Fuzzy Hash: 20c586ed46f578d029fc1c4b89a0decbb4f5f629725f0b5f4d429cc534bf48d2
Instruction Fuzzy Hash: 6871AE62A0868E88EB148BA1A8441F96BB5FB05789F444536CA4D977DBFF3CE554E300

Function 00007FF63D926C5D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF63D926D81
Serial Number: %s, xrefs: 00007FF63D926F6C
GMT, xrefs: 00007FF63D926D0E
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 63857b9f88c73a3064a1e0c02ff08f03428f3bc832e62006535a3ca44d91489c
Instruction ID: 8103d7d1a04e63d22dde3d6c793778c060ca8e680272620b7569b5607a2a2b2f
Opcode Fuzzy Hash: 63857b9f88c73a3064a1e0c02ff08f03428f3bc832e62006535a3ca44d91489c
Instruction Fuzzy Hash: 3561FE62A0868E48EB10ABA1E8441F87BA5FF05788F444536CA4D87BDFEF3CE554E300

Function 00007FF63D927F55 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927F98
memcpy.VCRUNTIME140 ref: 00007FF63D927FBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928092
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 345c0efb75e5f5e3bfb360a7d56e46c10df3a749cc31020d7aafd10691290c92
Instruction ID: 9ab41db564cfe7607b6369bb341d7d90f7d2b568d9958257527248b1c5420fa6
Opcode Fuzzy Hash: 345c0efb75e5f5e3bfb360a7d56e46c10df3a749cc31020d7aafd10691290c92
Instruction Fuzzy Hash: E8510512B0968E46EE198B9594543F927A1FF45BD8F044635CA6F87BDBFE3CE045A300

Function 00007FF63D9276F4 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
GMT, xrefs: 00007FF63D927756
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF63D9277A9
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 8b14ffb17a7bed5e6f994567bd3f98ab4d170a11dbe0be09abedf0c16e82eb71
Instruction ID: 6361fcb94a9df09fce1a108db66c6bc9f5d5e0c45623a889eff159997811c2b5
Opcode Fuzzy Hash: 8b14ffb17a7bed5e6f994567bd3f98ab4d170a11dbe0be09abedf0c16e82eb71
Instruction Fuzzy Hash: D1517265A09B8E44EB108BA198441F977A5BB0578CF884535CE4DAB3DFEF7CE654E300

Function 00007FF63D8EEEA0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EEEE6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EEF12
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8EEF3E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction ID: cd6480f221b3f4a8c251b52a242a078bbcfa34b2185b0219426e416e9b595699
Opcode Fuzzy Hash: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction Fuzzy Hash: 33515226A1AB4182EB65CF95F04012C77A4FF48F94B082175EF5D43B49EF38E5E1A740

Function 00007FF63D926B97 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

GMT, xrefs: 00007FF63D926BF6
Serial Number: %s, xrefs: 00007FF63D926F6C
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF63D926C49
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 78f50a21b7f34b2d023b796abcd60e340b68c6140382275490a97a3042a013e5
Instruction ID: 57e18ee7b5816762f499119ddb528dfef74a1c64af0a022554fac29f3d412a92
Opcode Fuzzy Hash: 78f50a21b7f34b2d023b796abcd60e340b68c6140382275490a97a3042a013e5
Instruction Fuzzy Hash: 21518062A0DB8E84EB109BA1E8401F967A5BB05B8CF484535DA4D9B7DFEF3CE554E300

Function 00007FF63D927954 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92798F
memcpy.VCRUNTIME140 ref: 00007FF63D9279B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 6033982258b0eef9005531746be83ee8e6b9dd8905cea50568e3603bd33cd3c7
Instruction ID: 804b2d9f75fc45c105d1c504d8914731a33e48946b2841f9ce9e69c8a3136aea
Opcode Fuzzy Hash: 6033982258b0eef9005531746be83ee8e6b9dd8905cea50568e3603bd33cd3c7
Instruction Fuzzy Hash: B241AC65A0878E45EF159BA1A8041F927A2BF09BDCF480935CE1D9B7DBFE3CA514A300

Function 00007FF63D9157B6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9157DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D915895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9158A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9158D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91594C

Strings

Failed to figure out path, xrefs: 00007FF63D915952
SYST, xrefs: 00007FF63D915876
Entry path is '%s', xrefs: 00007FF63D9158AE, 00007FF63D9158E5

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: b76e7acda3d1431c819e0a95e862e65b45221f05599d27ce728834a38d5ef351
Instruction ID: 9dd83120f2842149344c26e61fbd3986a8142f2ff389e58040c2b0d4f2afc2c2
Opcode Fuzzy Hash: b76e7acda3d1431c819e0a95e862e65b45221f05599d27ce728834a38d5ef351
Instruction Fuzzy Hash: BF418571A0878A86EB618FA5E4403F827B8BB45798F914471CA9E837DBEE3CD455E300

Function 00007FF63D90C930 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90C9FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA18
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA34
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA50
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90CA6C

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1e9cdfff36ca690872912e0e694f6311f5828980c35702adb4f25b4d88f6cc40
Instruction ID: 48ce4c564cd52cc49aa084443db0dbb58766a588ecc62c7e4bece1457893a57f
Opcode Fuzzy Hash: 1e9cdfff36ca690872912e0e694f6311f5828980c35702adb4f25b4d88f6cc40
Instruction Fuzzy Hash: A4414E32918B4A82E761CF61E44027933B4FB49F98F044175EA9D9339EEF38D891E380

Function 00007FF63D8E9870 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E98EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E98F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E98FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9912
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E991C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9926
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9930
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E9939

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction ID: e5620bc7ce6391da091c55e3aba7cc0e688acbb1e23823638097b3ccc4453bbe
Opcode Fuzzy Hash: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction Fuzzy Hash: 20312C36A28A5581D720EF52E8441697370FB85FD4F080031DE9D87BA9EF7CE446E700

Function 00007FF63D8E9990 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8E99F8

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 734636d28ebe92a552abe8424702d892e2a077f184f451bb8255f658a3df093b
Instruction ID: 71bd353d8ed4c92a95cdac488bd17b871ad1f99eff9b87813df420efa454726a
Opcode Fuzzy Hash: 734636d28ebe92a552abe8424702d892e2a077f184f451bb8255f658a3df093b
Instruction Fuzzy Hash: 2A018C65634A0582DB14DF62ED540786330FF89F99B041071CD9E8376ADF3CE899E340

Function 00007FF63D9236A0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF63D922AB3), ref: 00007FF63D923748
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF63D922AB3), ref: 00007FF63D92378A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF63D922AB3), ref: 00007FF63D92382F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF63D922AB3), ref: 00007FF63D923842
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D923D27

Strings

Failed to encode DOH packet [%d], xrefs: 00007FF63D923881
%s?dns=%s, xrefs: 00007FF63D923818

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: d32a9535cb046ac46ed60313e465b9cac3221bdd75689f286ff64116ab2ec733
Instruction ID: be9c1a6eeffccc480d9d48753c5598c9819da48d9dcc3e6a529c976e2ba5be89
Opcode Fuzzy Hash: d32a9535cb046ac46ed60313e465b9cac3221bdd75689f286ff64116ab2ec733
Instruction Fuzzy Hash: 2102A161F087CB46F7119AE698447B92795AB4978CF444039DE0DCB7CBFE78E844A380

Function 00007FF63D923F20 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8EBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EBC36
Part of subcall function 00007FF63D8EBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EBC46
Part of subcall function 00007FF63D8EBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EBC54
Part of subcall function 00007FF63D8EBC00: memset.VCRUNTIME140 ref: 00007FF63D8EBC8F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D923FE9
memcpy.VCRUNTIME140 ref: 00007FF63D924004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92401E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: acd390c1a12e34a85b50b4d437532fee1f9e274726e5f98373e38d2a703eb18b
Instruction ID: abf0fd8ab484f66f5eff87eb87e8dd276960d335587db4dd9611eea67046c823
Opcode Fuzzy Hash: acd390c1a12e34a85b50b4d437532fee1f9e274726e5f98373e38d2a703eb18b
Instruction Fuzzy Hash: 90917D61B0974E82EA559AE6A45137A62A0AFA5BC8F084034DE5DC77CBFF3CE451A700

Function 00007FF63D8F8FE0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF63D8F8FA8), ref: 00007FF63D8F90F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF63D8F8FA8), ref: 00007FF63D8F910F

Strings

I64, xrefs: 00007FF63D8F9105, 00007FF63D8F916F
I32, xrefs: 00007FF63D8F90E5, 00007FF63D8F9145
Internal error removing splay node = %d, xrefs: 00007FF63D8F8FF2

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: bd4a6c465e0bce7c2a912e253289e6a8022db79ca8432d680972d7c5c4570fb2
Instruction ID: 0df09a1b68fb5848301ba7b706805e0f73127afa6fd41fbb74bffeb2fb069ba5
Opcode Fuzzy Hash: bd4a6c465e0bce7c2a912e253289e6a8022db79ca8432d680972d7c5c4570fb2
Instruction Fuzzy Hash: 88A1D673A0864986EB209F55E45477D7BE8FB48B48F168135CA8D83399EF3CE219D700

Function 00007FF63D908EB0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9090DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90911F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D909147
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D909189

Strings

schannel: ApplyControlToken failure: %s, xrefs: 00007FF63D908FB8
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF63D9090A3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF63D908F2E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: c74913c289f09ae1ee76359fbca19a34e67593ca543870b10d4fd17b6b441526
Instruction ID: 1d62a7e230a0ea11394ab8c23b3a0f23c00e5de5d12cdf54085339d33b320642
Opcode Fuzzy Hash: c74913c289f09ae1ee76359fbca19a34e67593ca543870b10d4fd17b6b441526
Instruction Fuzzy Hash: F6914936604F8986EB10CFA5E8506AE37B5FB88B84F044135DE4D877A9EF38D455DB00

Function 00007FF63D907900 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF63D8EA92A,?,?,?,?,?,?,?,00007FF63D8EA6F7), ref: 00007FF63D907911
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF63D907AB3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF63D907AD0

Strings

0123456789ABCDEF, xrefs: 00007FF63D907AC2, 00007FF63D907AC9
TRUE, xrefs: 00007FF63D907A3C
0123456789abcdef, xrefs: 00007FF63D907AA2, 00007FF63D907AAC

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 20cffc9857d5c3f46d7d6b21cac0e35f38831cc88af52eadf473f723694601ae
Instruction ID: 103840407054db8f134ec1908ebf13167f5b5022721995bc594b70b51cc8d220
Opcode Fuzzy Hash: 20cffc9857d5c3f46d7d6b21cac0e35f38831cc88af52eadf473f723694601ae
Instruction Fuzzy Hash: A651D422E0D78E41EA218BA5BC5017A6790AB55BE8F944131DA8D867CEFE2CE941E300

Function 00007FF63D92962A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9299AE

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF63D929751
GMT, xrefs: 00007FF63D9296DE
TRUE, xrefs: 00007FF63D92990D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 93edd36fceb0d69f2bb24ea6509d4cc8a93b47af0be9797d42cf70ab4cdd1ca4
Instruction ID: b8d7dee1eca2da0c5ee9466ec03d9d51248a5d0bdf3462a3d40f40808ed3b82e
Opcode Fuzzy Hash: 93edd36fceb0d69f2bb24ea6509d4cc8a93b47af0be9797d42cf70ab4cdd1ca4
Instruction Fuzzy Hash: E26149A1E4C69E68FB11CBA495042BA7BE9EB01798F544131C69EC2BDEEF3CD545E300

Function 00007FF63D8D5DD0 Relevance: 10.6, APIs: 7, Instructions: 146COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5E61
memcpy.VCRUNTIME140(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5EA5
memcpy.VCRUNTIME140(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5F42

Part of subcall function 00007FF63D92F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF63D8D43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D92F20A

memcpy.VCRUNTIME140(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5F74
memcpy.VCRUNTIME140(?,?,?,00007FF63D8D1DBA), ref: 00007FF63D8D5F8F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8D5FAC

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction ID: 0158d5ead25668418d49b76b8231d7bdd14105cc71a3789e706badcccec3ddfd
Opcode Fuzzy Hash: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction Fuzzy Hash: AF51EC32A09B8982EB04EFA5D5042682361FB15BD4F140A32DF6D977D6EF78F195E380

Function 00007FF63D927DCB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF63D927EEF
GMT, xrefs: 00007FF63D927E7E
Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: ed2e198dcc3b011cc1bfcec88ea1bc6807998eeb1b1d636bf5459b77496cbc5e
Instruction ID: ba206b8ec7eb816e90ac13fb221adb16aae5c2a312aa847063c8ec911df65a46
Opcode Fuzzy Hash: ed2e198dcc3b011cc1bfcec88ea1bc6807998eeb1b1d636bf5459b77496cbc5e
Instruction Fuzzy Hash: 7451E462A0C6CE85EB11CB94A8442B977B4FF45BA8F440532DA4D937EAEF3CE945D300

Function 00007FF63D91BFB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF63D91C010
memcpy.VCRUNTIME140 ref: 00007FF63D91C036
memchr.VCRUNTIME140 ref: 00007FF63D91C133

Strings

TFTP error: %s, xrefs: 00007FF63D91C150
Internal error: Unexpected packet, xrefs: 00007FF63D91C0D8
Received too short packet, xrefs: 00007FF63D91C062

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: d3f428e3e3a515e8a76563d932edcfca6e7b97f94956f80ba8286d8b94d8e803
Instruction ID: 8730a4f09a14acc044e6b9bac5516b3f332e93f189d1ca0bb27b201192f910a1
Opcode Fuzzy Hash: d3f428e3e3a515e8a76563d932edcfca6e7b97f94956f80ba8286d8b94d8e803
Instruction Fuzzy Hash: 67510572A0868A85EB649FA5D8153B9B7A4FB44B84F044132EE4EC77CAEE3CE445D700

Function 00007FF63D8D4A00 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4A93
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4AE7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4B0E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4B36
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4B83
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF63D8D314B,?,?,?,00007FF63D8D3104), ref: 00007FF63D8D4B90

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction ID: b419489e227dc66146bf8879ea00a8d290a5aa16527e43c9959e8744c9a47c3e
Opcode Fuzzy Hash: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction Fuzzy Hash: C8514432608A4581EB208BADD590238E7A0EF85F95F15C632CE5E837E5DF79E4469704

Function 00007FF63D920B30 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF63D9044C6), ref: 00007FF63D920C8D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF63D9044C6), ref: 00007FF63D920CA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D920CB5

Strings

Negotiate, xrefs: 00007FF63D920B36, 00007FF63D920C12
%sAuthorization: Negotiate %s, xrefs: 00007FF63D920C6E
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF63D920BE1
Proxy-, xrefs: 00007FF63D920C5D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: e970562c74868112c6df1a03012bf8c95489708dae6951303b259dec22d0baf0
Instruction ID: fb2cb690aed344360fd0909e7527dbe806dd3120f6f814e57d3ed2b821a41d1d
Opcode Fuzzy Hash: e970562c74868112c6df1a03012bf8c95489708dae6951303b259dec22d0baf0
Instruction Fuzzy Hash: ED51B262A0878E96FB21DBA5E8802BD2790FB51798F450032DA4DC77CAEF3CE465D350

Function 00007FF63D91EE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 86de3d7c9fee03b22631dcbbad5bbc54ee5ca30d69bbecc19bfd3f20b0975ccf
Instruction ID: 157bd93b3b3a6b3348abe0de64b2ca73ada3fded5f84ddd4927af3e311b9cb58
Opcode Fuzzy Hash: 86de3d7c9fee03b22631dcbbad5bbc54ee5ca30d69bbecc19bfd3f20b0975ccf
Instruction Fuzzy Hash: F441D412A0D69E49FB62CB5160143B96BE5AF46794F080171DE9E873CBFE3DE504E311

Function 00007FF63D91EE77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: e87370a5869864d495002ca49e55217450b4e01ac38c04b7491b294906ca183f
Instruction ID: 40021ee69e81ca0ca1a93e242342c6371f421900c3d76f2beffe38bfe6fdb154
Opcode Fuzzy Hash: e87370a5869864d495002ca49e55217450b4e01ac38c04b7491b294906ca183f
Instruction Fuzzy Hash: AB41D112A0D29E49FB22CBA160143B86B95AF46794F080171DE9E873CBFE3DE444E311

Function 00007FF63D91EDDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: eb8acf01f820f75c68904246a9ece804f2211bd47c51cec25c3a42db63dbcaa7
Instruction ID: d31a43b78e68cef36e8c3ecf618b3402d108b205477b0e12891956d2936c2d55
Opcode Fuzzy Hash: eb8acf01f820f75c68904246a9ece804f2211bd47c51cec25c3a42db63dbcaa7
Instruction Fuzzy Hash: 8541C112E0D69E49FA228BA160143B86BE5AF06794F080171DE9E873CBFE3DE544E311

Function 00007FF63D91EDEA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: e7d4bbfd5b38bbbd6d8bf0e475cbd4f94a9fc81eb8a3b1b531cbd017f784b84c
Instruction ID: 7aff875b9e5f9591c3fb077653b24af753cdeef3e5d1fcbefdb76498bd50abfe
Opcode Fuzzy Hash: e7d4bbfd5b38bbbd6d8bf0e475cbd4f94a9fc81eb8a3b1b531cbd017f784b84c
Instruction Fuzzy Hash: B241C112E0D69E49FA228BA160143B86BE5AF06794F080171DE9E873CBFE3DE504E311

Function 00007FF63D91EE22 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 9dce3a1e02d3dd0decdb27a30e4dbabf375221b931b30d07f11530cfea0de688
Instruction ID: 7a76629a5dc2f8139c4b758acc9371e6fab6575c0f5420db6e2e8cd23e4fd839
Opcode Fuzzy Hash: 9dce3a1e02d3dd0decdb27a30e4dbabf375221b931b30d07f11530cfea0de688
Instruction Fuzzy Hash: 8C41C012A0D69E49FA228BA160143B86BA5AF46794F080171DE9E873CBFE3DE444E311

Function 00007FF63D91EDF8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: eeb42b2a52bbdab434df15e2a6555f120b688906af1e5a0ec8f7357212fa5c02
Instruction ID: 52ac1ecfb3b6531405536637a0a9b49b6b60d66d92221b672a97355280d4b5c5
Opcode Fuzzy Hash: eeb42b2a52bbdab434df15e2a6555f120b688906af1e5a0ec8f7357212fa5c02
Instruction Fuzzy Hash: EA41C112E0D69E49FA228BA160143B86BE5AF06794F080171DE9E873CBFE3DE544E311

Function 00007FF63D91EEAD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91F0FB

Strings

%%%02x, xrefs: 00007FF63D91EFA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 89f36e15c459582ef8a19abe2e0c0d18899e06bfa663bf0be4ff2b53d824261c
Instruction ID: 9c87ddf0b1a796ee7c0a0fd79e4cabafafc757aabae780964199cd9927aa4d87
Opcode Fuzzy Hash: 89f36e15c459582ef8a19abe2e0c0d18899e06bfa663bf0be4ff2b53d824261c
Instruction Fuzzy Hash: 0E41C212A0D69E48FA628BA160143B86BE59F06794F080171DE9E873CBFE3DE444E311

Function 00007FF63D903F90 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF63D904076
strchr.VCRUNTIME140 ref: 00007FF63D904089
strchr.VCRUNTIME140 ref: 00007FF63D90409B

Strings

Expect, xrefs: 00007FF63D903FF7
Expect:, xrefs: 00007FF63D90401E
100-continue, xrefs: 00007FF63D9040B6
Expect: 100-continue, xrefs: 00007FF63D9040F8

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 9df210bce6356ebbc1900224a2991696d1098ea7454d5676cb9223a8ecd7a2ea
Instruction ID: df3b0d702ccf91f74cf48641f596bb347c8bd8d2dd07160d12a1933bf14a1425
Opcode Fuzzy Hash: 9df210bce6356ebbc1900224a2991696d1098ea7454d5676cb9223a8ecd7a2ea
Instruction Fuzzy Hash: B541D221B0C78AC5EB549BAAF8401B967A0EF55BC8F484034DA4E877DFFE2DE441A700

Function 00007FF63D91CB00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF63D91CB18
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF63D91CC81

Strings

set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF63D91CC5C
gfff, xrefs: 00007FF63D91CB8C
Connection time-out, xrefs: 00007FF63D91CB3B
gfff, xrefs: 00007FF63D91CBF8

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 816daf6425511fafc4144085c150fa208d6ed39076a45b0587e0b95dc59eac6e
Instruction ID: f23222686c62fd76ca85984f4cb59e6ae556342813b02e2e903a560fcd5c8526
Opcode Fuzzy Hash: 816daf6425511fafc4144085c150fa208d6ed39076a45b0587e0b95dc59eac6e
Instruction Fuzzy Hash: FB410672B1465D86DB20CF6AF00166877A4F798F88F505032EE0DC7B99EE39E951DB40

Function 00007FF63D927610 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
%s%lx, xrefs: 00007FF63D92766D
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: 53322ca47145cf0b56934f3223b1f0d61cfd0422896eed2fd94c1d26d7dd0d81
Instruction ID: e51b1f3f025f1c9ec98b57b399a4728cae3cfbbebbad2a14ccf5845682bc3b8c
Opcode Fuzzy Hash: 53322ca47145cf0b56934f3223b1f0d61cfd0422896eed2fd94c1d26d7dd0d81
Instruction Fuzzy Hash: 79419D62A0878E48EF149BA5A8451F927A6BF0578CF445831CE0E9B7CBFF3CE514A300

Function 00007FF63D927D0E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

GMT, xrefs: 00007FF63D927D64
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF63D927DA4
Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 3423c50565629b261c04f200d569919f8545122c186ea242b1492fb3335ace71
Instruction ID: 8e6b5697381e62405d522fa284493b3ffe5988156659b9ada26f369e09e5f808
Opcode Fuzzy Hash: 3423c50565629b261c04f200d569919f8545122c186ea242b1492fb3335ace71
Instruction Fuzzy Hash: 3A418226A08B8E85EB10CBA5E8441FAB3A4FF45788F580532DA4D9779BEF3CE545D700

Function 00007FF63D926AD1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
%s%lx, xrefs: 00007FF63D926B26
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 3a79513afe6aea4f96036019143dff1e5783e73f1d6728b543c147c9c275da5b
Instruction ID: 646aff260550cdaec419a57e399c5bc3da6ced7dfaad17b27cc8494649924b21
Opcode Fuzzy Hash: 3a79513afe6aea4f96036019143dff1e5783e73f1d6728b543c147c9c275da5b
Instruction Fuzzy Hash: F741A152B0978E49EF158BA5A8441F92BA1BF0578CF485875DE0E9B7CBFE3CE154A300

Function 00007FF63D90FE10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90FE4D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90FEBE

Strings

., xrefs: 00007FF63D90FEB7

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: 56123e3a473889bf9ea8c9488b22fdc8ba33d670e3acbcf3f2f06b941ca91a8c
Instruction ID: 0e5f13438b4491fe4fc4279ec02d56115e5e42771fd1ae000bf8576af7de30a3
Opcode Fuzzy Hash: 56123e3a473889bf9ea8c9488b22fdc8ba33d670e3acbcf3f2f06b941ca91a8c
Instruction Fuzzy Hash: 26414222B08B8A82E760DF51B90027963A4EB49B94F454131EB4E877DAEF3CE552A740

Function 00007FF63D926DDE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926E0F
memcpy.VCRUNTIME140 ref: 00007FF63D926E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 460a80e6cf153cb36f8422525b8caca0178bcd542308400b50d5b32dc07c46c2
Instruction ID: 36756107038f28e6f949ebae10cc0d17294f7ab2b5970b30347f1fae622b55be
Opcode Fuzzy Hash: 460a80e6cf153cb36f8422525b8caca0178bcd542308400b50d5b32dc07c46c2
Instruction Fuzzy Hash: 56418E65B0978A44EF158BA598442F927A1BF05B8CF484475CD0E9B7DBFF3CA554A300

Function 00007FF63D9297BD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9297F8
memcpy.VCRUNTIME140 ref: 00007FF63D92981D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9299AE

Strings

TRUE, xrefs: 00007FF63D92990D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: cb891c32c6e3222d2a6e5507c8be083332d8d010055dea793f0f17abb076a06c
Instruction ID: 196e3a2d7406b66d07d474ad4f61fd5392b9d7939c47b5bbaab124d55b83ebd1
Opcode Fuzzy Hash: cb891c32c6e3222d2a6e5507c8be083332d8d010055dea793f0f17abb076a06c
Instruction Fuzzy Hash: C0312A95E4D69E54FB12CBA585043786B969F11BA8F080631C99EC2BDFFF3C9541E300

Function 00007FF63D927F5D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927F98
memcpy.VCRUNTIME140 ref: 00007FF63D927FBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: fb3880e822f44cd4eb53f69da3d9ae151aad4d879054bdaf5fecb74b28bac563
Instruction ID: 75089147b80c9267bed4471e9321d006b0bed0625f7841712beb2f82901066b9
Opcode Fuzzy Hash: fb3880e822f44cd4eb53f69da3d9ae151aad4d879054bdaf5fecb74b28bac563
Instruction Fuzzy Hash: EC31A626B09B8A45EE55CB96A8443FA63A1BF85BD8F040531CE5D977DBFE3CE0459300

Function 00007FF63D90E936 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8EAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8EAB64

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90E974
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D90E986

Strings

Select failed, xrefs: 00007FF63D90EA18
Mailbox UIDVALIDITY has changed, xrefs: 00007FF63D90E9BE
OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF63D90E958

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 5a4ee0cb38acc090a0fbedc4f51c1d267081722fb7daa94e28cba8e938d1c70d
Instruction ID: 876663adab377ed061d4237609dfd94bc124669a5473e1ee49527f436c286cfa
Opcode Fuzzy Hash: 5a4ee0cb38acc090a0fbedc4f51c1d267081722fb7daa94e28cba8e938d1c70d
Instruction Fuzzy Hash: D5315C62E0DA4A89EA649BA0F4401BA2364BF45BD4F504432CE5E877DBEF3CE851E341

Function 00007FF63D927068 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D92709C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927589

Strings

Start Date: %s, xrefs: 00007FF63D927577
TRUE, xrefs: 00007FF63D92708A
FALSE, xrefs: 00007FF63D927091
Start Date, xrefs: 00007FF63D92755D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: ae907500a812d25586cfa41279ce18986c9e2021419cb2cd90361f473d061923
Instruction ID: c4272f72b5f021e63ef344b344297a609700cfe53e3c7fb71fb5be31f531ae74
Opcode Fuzzy Hash: ae907500a812d25586cfa41279ce18986c9e2021419cb2cd90361f473d061923
Instruction Fuzzy Hash: 3821D062A0C7CA85EB218B94A8442F92761BF05B88F480471CA4D973DBEF3CE194E300

Function 00007FF63D927CE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D927CE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: a68dbb86ef700e451aeb603a4cad13e7e7929bfbccc6980a137ba8f38b9cdaa9
Instruction ID: f0ef0baf6052da56525df40ea9015a6b240fcf511a1d92aff7fe98be385d80b5
Opcode Fuzzy Hash: a68dbb86ef700e451aeb603a4cad13e7e7929bfbccc6980a137ba8f38b9cdaa9
Instruction Fuzzy Hash: AE219666A08B8A46EA60CB95F8442FA63A4FF85788F440471DE4E8779BFF3CD045D700

Function 00007FF63D8F5640 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D8F5675
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D8F56A1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D8F56A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D8F56CB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF63D8F29BC), ref: 00007FF63D8F56E2

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF63D8F56B4

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 7d3ad36db36a946ac291080f8d2e221e09c17a1af24516dc27065fad3f0b3fed
Instruction ID: 03d38d76d120509cf74eb0823c38b6e27607143d724af068a62f9c3716c417a2
Opcode Fuzzy Hash: 7d3ad36db36a946ac291080f8d2e221e09c17a1af24516dc27065fad3f0b3fed
Instruction Fuzzy Hash: F3118632A0E64A86EB10DBA1E84027923B4EF85B58F540471DA1D877A9FF3CE844D700

Function 00007FF63D8F5570 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F5584
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F559A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55AE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55C2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55D6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F55FE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D8F5612

Part of subcall function 00007FF63D91E510: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F562B,?,?,00000000,00007FF63D8F1073,?,?,00000000,00007FF63D8F15F5), ref: 00007FF63D91E525

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction ID: f1eeabd847c4fa19967a7be1c8eafab599063ce8294ed40caedf48e0936c9952
Opcode Fuzzy Hash: 8c11188c648886522ce8a6e64f6b6562302f20e8865ed9cfa606d4a8050b4ce4
Instruction Fuzzy Hash: 08115236528E85C1D710DF61FD940E823A4FBC9B9AB180175DE9E8F79AAF3890959210

Function 00007FF63D8EF050 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF061
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF071
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF07F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF08D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF09B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8F2856), ref: 00007FF63D8EF0C5

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction ID: e4676ccb2bbb4e59a191f2b497b25b1dcf90775bb04a97f69df7b7a4a8a6372a
Opcode Fuzzy Hash: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction Fuzzy Hash: 2801B036528B05C2D720DF61F98407C33B8FB8AFA8B101165CE9E8275ADF38C4A9E240

Function 00007FF63D8DEE20 Relevance: 9.3, APIs: 6, Instructions: 273COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8DEF1C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DEF9D
memcpy.VCRUNTIME140 ref: 00007FF63D8DEF2F

Part of subcall function 00007FF63D92F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF63D8D43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D92F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8DEFAA
memcmp.VCRUNTIME140 ref: 00007FF63D8DF03D
memcmp.VCRUNTIME140 ref: 00007FF63D8DF0C1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcmpmemcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 2846809682-0
Opcode ID: 69c2e6193ddaa38194f47971ac0935eb94a2df83c2e04eaa05abd7d51751e23c
Instruction ID: 0c8a3ada0babcf345b0e4ee9da69cf79b35c2e34a1add8c220271bc92c19d6c4
Opcode Fuzzy Hash: 69c2e6193ddaa38194f47971ac0935eb94a2df83c2e04eaa05abd7d51751e23c
Instruction Fuzzy Hash: 46A1E122608B8986EB14CF66D4442A96361FF48BD4F588136DFAD87BC5EF3CE491E300

Function 00007FF63D8F2120 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF63D8F299B), ref: 00007FF63D8F2137
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF63D8F299B), ref: 00007FF63D8F2168

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: bc82dee56741fcdb2a61ea5e49477a01e532ce5743e5ef1c6ec771a3a7dfbefc
Instruction ID: 261e890498d1e5d314871096e760ed275174cbb4c77413c7b2e3e17bcf4a9bd8
Opcode Fuzzy Hash: bc82dee56741fcdb2a61ea5e49477a01e532ce5743e5ef1c6ec771a3a7dfbefc
Instruction Fuzzy Hash: 4D919E22609BC589D7558F74A4403ED37A4FB55B28F080235CFAC8B3DADF39A1A4D721

Function 00007FF63D8DC600 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8DC6EA
memcpy.VCRUNTIME140 ref: 00007FF63D8DC6F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8DC72D
memcpy.VCRUNTIME140 ref: 00007FF63D8DC734
memcpy.VCRUNTIME140 ref: 00007FF63D8DC743
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8DC768

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 56b14bdc5f89045d4f7b2da786287d42a27f2024155c1ece33cbbf5de22e5f5c
Instruction ID: 1047cc4a7de488475c5722d980e183815dafdf63d56673a994ba7bb03515fecc
Opcode Fuzzy Hash: 56b14bdc5f89045d4f7b2da786287d42a27f2024155c1ece33cbbf5de22e5f5c
Instruction Fuzzy Hash: C431C56271978985EE149F96A5041B8A365EF08BE0F540732EE6D877DAEF7CF051D300

Function 00007FF63D8D4EB0 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF63D8D3C25,?,?,?,?,?,00007FF63D8D1D8B), ref: 00007FF63D8D4FA3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF63D8D3C25,?,?,?,?,?,00007FF63D8D1D8B), ref: 00007FF63D8D4FB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF63D8D3C25,?,?,?,?,?,00007FF63D8D1D8B), ref: 00007FF63D8D4FEA
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF63D8D3C25,?,?,?,?,?,00007FF63D8D1D8B), ref: 00007FF63D8D4FF4
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF63D8D3C25,?,?,?,?,?,00007FF63D8D1D8B), ref: 00007FF63D8D5002
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8D5031

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: a0251d31b2e56c634ffd3971ee331e0c2d19140fef6248804dc9cc2118053b84
Instruction ID: 8db7a51061f5bed7e0100406b04343a3ee562e5e82daac12dca5d363f99c6862
Opcode Fuzzy Hash: a0251d31b2e56c634ffd3971ee331e0c2d19140fef6248804dc9cc2118053b84
Instruction Fuzzy Hash: A741F961709B8985EE149FA6A90426DA351FF04BE4F544732DFAD877DAEF3CE051A300

Function 00007FF63D8F8800 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF63D8F88E5
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F88F4
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8906
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F8918
VerSetConditionMask.KERNEL32 ref: 00007FF63D8F892E
VerifyVersionInfoA.KERNEL32 ref: 00007FF63D8F8941

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: b6c6db3b816de679375f91f2878e76babe7d6183a69cc8df1fcf61702d0bf89d
Instruction ID: df3e7bc56e3dbd4de562d589b784a47ffc786e7c62559311e32638d35a45fd6d
Opcode Fuzzy Hash: b6c6db3b816de679375f91f2878e76babe7d6183a69cc8df1fcf61702d0bf89d
Instruction Fuzzy Hash: FC41E462E2C68686F3308B92F4147BAA3A0FBD5700F015635E9DD46B95EF3DE494AF00

Function 00007FF63D92790F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 9dec1790426589c6bec882defff916bff345b07b4a0c113e656f09ef2ca887c0
Instruction ID: bc1fb79ebf209d4746c0ab6fe0776a9d6c401b45f6d38e2bd2c0cd13b6cc7b71
Opcode Fuzzy Hash: 9dec1790426589c6bec882defff916bff345b07b4a0c113e656f09ef2ca887c0
Instruction Fuzzy Hash: 3641D366A087CA49EB148BA198441F927A5BF0979CF484931CE5D9B7CBEF3CE154D300

Function 00007FF63D926D9F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 2dab462f5145bc0738b088c235cea5b0e6c2d607e6670f6eefb5e99da21a05ee
Instruction ID: b0a5e68374c71de243da01ad1a8420a40ec1b6f4848ce8a60a885033d8e70dd8
Opcode Fuzzy Hash: 2dab462f5145bc0738b088c235cea5b0e6c2d607e6670f6eefb5e99da21a05ee
Instruction Fuzzy Hash: 9E41C162B0878A49EF158BA198441F927A1BF05BCCF484871DE0E9B7CBEF3CE154A300

Function 00007FF63D92D850 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92D8F9
memcpy.VCRUNTIME140 ref: 00007FF63D92D915
memcpy.VCRUNTIME140 ref: 00007FF63D92D92C
memcpy.VCRUNTIME140 ref: 00007FF63D92D947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92D97A

Strings

PLAIN, xrefs: 00007FF63D92D85B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: 8f06fc03e41532ca5b0a05e7a0119cb7575dcb3cf368c3afc8c923dc2a594b74
Instruction ID: f94d4e7992f0224011a4100b9b74aa10214fe30e6ebd309d6d24396d5350e8d4
Opcode Fuzzy Hash: 8f06fc03e41532ca5b0a05e7a0119cb7575dcb3cf368c3afc8c923dc2a594b74
Instruction Fuzzy Hash: 8C31C866A08B8982EB11CF95E4403A9A790FB45BE8F498631DF9D877DAEE3CD045D340

Function 00007FF63D927685 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 2963d0671b70161468663b7bdc3d46495c8b6a5f4f70a29bc53403dd734bd104
Instruction ID: 5b3e879e122a6dc388a0d2c6c31325a43b390b4e68d4a293e23b6253fa9ad256
Opcode Fuzzy Hash: 2963d0671b70161468663b7bdc3d46495c8b6a5f4f70a29bc53403dd734bd104
Instruction Fuzzy Hash: A6318F66A0978E49EB159BE1A8451F927A6BF0578CF440835CE4E9B3CBFF3CE554A300

Function 00007FF63D90F931 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90F9B6
memcpy.VCRUNTIME140 ref: 00007FF63D90F9D1
strchr.VCRUNTIME140 ref: 00007FF63D90F9ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90F9FE

Strings

Got unexpected pop3-server response, xrefs: 00007FF63D90F951
CAPA, xrefs: 00007FF63D90FA14

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: 201f3c32be0abebb09fcfe128f2889ecaff817daab1915a220306004f407a3d4
Instruction ID: df9b3d990f80951d15d832bad902d1614596ec21f8b5d3e5efa33c5f93ccecad
Opcode Fuzzy Hash: 201f3c32be0abebb09fcfe128f2889ecaff817daab1915a220306004f407a3d4
Instruction Fuzzy Hash: 4931AF62B0978A91EB199FA5B4002B92394BF457D4F440135CA2E937DBFF3CE6A5E301

Function 00007FF63D9276D6 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D928800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 6f603f33f848ebba4556c22852868b21b3dd251d675c3a95975d4e36f17b5b88
Instruction ID: 5327955aac487528766e50858c350f2e9e5a6d594a59ac0514c81e691a3f79df
Opcode Fuzzy Hash: 6f603f33f848ebba4556c22852868b21b3dd251d675c3a95975d4e36f17b5b88
Instruction Fuzzy Hash: D231A066A0878E49EB149BE1A8451F927A6BF0578CF440875CE4E9B3CBFF3CE514A300

Function 00007FF63D9276A3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D92A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927BC2

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Public Key Algorithm, xrefs: 00007FF63D927B78
Expire Date: %s, xrefs: 00007FF63D927AE7
Public Key Algorithm: %s, xrefs: 00007FF63D927B92
Expire Date, xrefs: 00007FF63D927ACD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: bb4d56488f41999b2b9a4b6edf9b4030d84b897ccf009ae421a43553a3af00d7
Instruction ID: 2072f4f7e0130d1fdaca05d12d3321d27ed886be5a801589ce92fb039050ea5b
Opcode Fuzzy Hash: bb4d56488f41999b2b9a4b6edf9b4030d84b897ccf009ae421a43553a3af00d7
Instruction Fuzzy Hash: 4B31A062A0878E49EB149BE1A8451F927A6BF0578CF440835CE4E9B3CBFF3CE514A300

Function 00007FF63D927C40 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF
%s%lx, xrefs: 00007FF63D927C9D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 77be2812b9aa8131dd145d23130a352d1c51842506ecc649404dfcaa3bb354b8
Instruction ID: 5f6df906b67ada644320ba5cbed1b9d943ec8c71209af7e5ce06115fb911f6ae
Opcode Fuzzy Hash: 77be2812b9aa8131dd145d23130a352d1c51842506ecc649404dfcaa3bb354b8
Instruction Fuzzy Hash: F531D422B0868E45EE20CBA5E8442F963A5FF49B88F540431DE4E9779BFE3DE040D740

Function 00007FF63D917CD0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D917CE1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D917D4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D917D5F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction ID: 437f721c9c09f0c69ffe4d229202e5b0ca1e747fec9b59d070cb6b37f8b3670b
Opcode Fuzzy Hash: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction Fuzzy Hash: BC318836A04B8EC2EB51CB64E4503BD67A0EB86B88F184035DE4D477DAEF3DD5999700

Function 00007FF63D926B41 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 6747ec776cf2ce8da402bad2bb84dfc54471b3caf19a89f9e193f5818a58486c
Instruction ID: e24c4e24a117bd83725c6a552c28194473f796e62abce1a6651f702017b0bbd6
Opcode Fuzzy Hash: 6747ec776cf2ce8da402bad2bb84dfc54471b3caf19a89f9e193f5818a58486c
Instruction Fuzzy Hash: 35318D52A0978E44EF159BA5A8401F927A1BF0578CF481875DE0E9B7DFFE3CE154A300

Function 00007FF63D926B7F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D928800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 430c93e604ecb33b3ff84b76402e8b8dd37a4f1645805b06affe485f7e029d85
Instruction ID: 76f76a8c3480e2c53d585faeb093d9ebe5700d69a0162da0fed80e33f936e498
Opcode Fuzzy Hash: 430c93e604ecb33b3ff84b76402e8b8dd37a4f1645805b06affe485f7e029d85
Instruction Fuzzy Hash: D6319A62A0978E48EF158BA1A8401F927A1BF0578CF481875DE0E9B7DBFE3CE154A300

Function 00007FF63D926B59 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D92A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D926F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927023

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Serial Number: %s, xrefs: 00007FF63D926F6C
Signature Algorithm, xrefs: 00007FF63D926FF7
Signature Algorithm: %s, xrefs: 00007FF63D927011
Serial Number, xrefs: 00007FF63D926F52

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: f38fd06d586284ddde5e18db3b0b80492eb2fbc1132887621bdcaf4423ed1ca7
Instruction ID: 81e58327f8dd46379d61b0d88d5316c05a1c68f1876e2e550b4f9f3ae2dfef82
Opcode Fuzzy Hash: f38fd06d586284ddde5e18db3b0b80492eb2fbc1132887621bdcaf4423ed1ca7
Instruction Fuzzy Hash: 16319A62A0978E48EF158BA1A8401F927A1BF0578CF481875DE0E9B7DFFE3CE154A300

Function 00007FF63D915963 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91597F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9159FB

Strings

SITE NAMEFMT 1, xrefs: 00007FF63D9159DC
OS/400, xrefs: 00007FF63D9159C9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 924411b33166fe90b7481d7a5f125ceca56f5dad428a03f15fc2c6138f981451
Instruction ID: ba9baa6f7d505baf4c372f738481e65adb6d5264425fa8be7c22479e54e26cca
Opcode Fuzzy Hash: 924411b33166fe90b7481d7a5f125ceca56f5dad428a03f15fc2c6138f981451
Instruction Fuzzy Hash: A4318421A1C68A46F7B58B55A4503B823B4BF45798F904031CA9D977CFFE3CE546E701

Function 00007FF63D8EB070 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF63D8EB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF63D8EB0B7
CloseHandle.KERNEL32 ref: 00007FF63D8EB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF63D8EB0E6
closesocket.WS2_32 ref: 00007FF63D8EB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF63D8EB11D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction ID: 24bea39599f589645ff50bf2479cebd4c59caea060f2cc0d0f232b296753e8aa
Opcode Fuzzy Hash: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction Fuzzy Hash: 25211D36609A4996E721DF96E9402697370FB89B90F044131DF8E83B95EF3DF4A59700

Function 00007FF63D8D2610 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8D4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF63D8D1B49), ref: 00007FF63D8D4341

Part of subcall function 00007FF63D8D3C30: memcpy.VCRUNTIME140 ref: 00007FF63D8D3C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D26E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D2730
__std_exception_copy.VCRUNTIME140 ref: 00007FF63D8D2780
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D27CD

Strings

out_of_range, xrefs: 00007FF63D8D2656

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: ffcb1dd9954a8bed1128b9b45f87da7a32f8492f75755f77d0c05d6c16dedd1a
Instruction ID: 626d09225be366568b57cc274f6aaffaae1d79b23c7ef81c9756a28a89a8c9e2
Opcode Fuzzy Hash: ffcb1dd9954a8bed1128b9b45f87da7a32f8492f75755f77d0c05d6c16dedd1a
Instruction Fuzzy Hash: 34517372A18B4999FB00DFA5E8403AC3365FF447A8F405235DA6D52BD9EF78E1A5D300

Function 00007FF63D91F580 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F5F8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F62A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F69A

Part of subcall function 00007FF63D907900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF63D8EA92A,?,?,?,?,?,?,?,00007FF63D8EA6F7), ref: 00007FF63D907911

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91F715

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF63D91F5EE

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: a8a3a5dd2038b67971282b16d8888a121d149a91a9dbb00d32b5e69f4339c014
Instruction ID: b03f1616ff2a21e58476ca3fc8efdfb75d6a10600614fa035e85193f3245d641
Opcode Fuzzy Hash: a8a3a5dd2038b67971282b16d8888a121d149a91a9dbb00d32b5e69f4339c014
Instruction Fuzzy Hash: 1A41D423A0DACD45EF228FA498043B93799EB06794F480231DA8D877DBEF2CE455E701

Function 00007FF63D929568 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9299AE

Strings

GMT, xrefs: 00007FF63D9295C4
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF63D929616

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 1546a41c3cf0fa7789e2e6a29b1ef5ab1d392cc0b06c06d356420f0a5f695d78
Instruction ID: 90d59840edd6ccdb2ccabb7d9f12f4bd31b8bc676fb969177e66b2f9b02e6608
Opcode Fuzzy Hash: 1546a41c3cf0fa7789e2e6a29b1ef5ab1d392cc0b06c06d356420f0a5f695d78
Instruction Fuzzy Hash: 0941F7A1E4CA8EA5F711CBE594442B9BBA9EB45798F480131C68E827DFEF3CD545E300

Function 00007FF63D8FEF50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FEFBA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FF02B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF63D8FF08B

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00007FF63D8FF0B2
:%u, xrefs: 00007FF63D8FEFCE, 00007FF63D8FF034

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: b3832e9ae83c2f818d8e5f20c02279ad86dc294354eb5af68b8479754fb5ab38
Instruction ID: 8a67ab0ebf1d126b2c20a831c3a4a8bf3a4098a31758028fc53e2bff5c1ed5cc
Opcode Fuzzy Hash: b3832e9ae83c2f818d8e5f20c02279ad86dc294354eb5af68b8479754fb5ab38
Instruction Fuzzy Hash: 9C41B56261868A95EB21DB51F4407BD67A5FB88B88F444231DE4E877D6EF3CE009D300

Function 00007FF63D8E0680 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF63D8D11FA), ref: 00007FF63D8E075F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF63D8D11FA), ref: 00007FF63D8E079C
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF63D8D11FA), ref: 00007FF63D8E07A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8E07D9

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF63D8E0682

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: e4ce4394363e5324866952fb85af2f58288ab99f1bf50804098d43e406ae33b8
Instruction ID: b39efa7e4d8cdb88814293b3d61c9e62be335f855c8c85e84936f0d26418bd0c
Opcode Fuzzy Hash: e4ce4394363e5324866952fb85af2f58288ab99f1bf50804098d43e406ae33b8
Instruction Fuzzy Hash: 793136A2B0975994EE109F92A9003696351EB04BD0F580A31DE5D4B7CAEF7DF061E700

Function 00007FF63D916A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D90C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF63D8F340F), ref: 00007FF63D90C0AE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D916ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D916B1B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D916B32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D916B4B

Strings

Couldn't open file %s, xrefs: 00007FF63D916AF9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 95857b77417a878704d7fdb905165e311696dfc49cd5d2f0f3364ef33b98184e
Instruction ID: a5b6ec61aea8674e3573a814a15186d1945c2cc0b6be18257e2c16b4758e3394
Opcode Fuzzy Hash: 95857b77417a878704d7fdb905165e311696dfc49cd5d2f0f3364ef33b98184e
Instruction Fuzzy Hash: EA418232A0CB8981EB148F65E84027AA7A5FB45BD4F18C131DA9D877DEEF7CE4459700

Function 00007FF63D8F5D80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8F5DFE

Part of subcall function 00007FF63D8E2500: GetLastError.KERNEL32 ref: 00007FF63D8E2522
Part of subcall function 00007FF63D8E2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E252A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F5E1C
recv.WS2_32 ref: 00007FF63D8F5E47
WSAGetLastError.WS2_32 ref: 00007FF63D8F5E59

Strings

Recv failure: %s, xrefs: 00007FF63D8F5E85

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: be7537aced1d6328b3c5947b8cb48486490fdd45464f7ecb243888b41117e164
Instruction ID: 1ef8a1c5d164d35fbfbcfc35803a0f434675e279effe01dab9105daf0f4ffa24
Opcode Fuzzy Hash: be7537aced1d6328b3c5947b8cb48486490fdd45464f7ecb243888b41117e164
Instruction Fuzzy Hash: 48319F72B06B4981EB50DFA2F8402A933A4BB58FD8F504135DE5D87385EE3CE466E340

Function 00007FF63D8FC810 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FC905
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FC964

Strings

REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF63D8FC89B
Connection died, tried %d times before giving up, xrefs: 00007FF63D8FC8C8
Connection died, retrying a fresh connect, xrefs: 00007FF63D8FC8EF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: 427686f8d707d859e0364fb1270cb692fdecbdb31599b6ac3ad766ef55f4a22a
Instruction ID: e008319f8f4fb51ad644ea82ac82dbb4c9dc344b334bc55bd3dca9f8b7e6b4b4
Opcode Fuzzy Hash: 427686f8d707d859e0364fb1270cb692fdecbdb31599b6ac3ad766ef55f4a22a
Instruction Fuzzy Hash: 5D416122B1868A81E755CB66F4803B967A4EB84B88F4C4031EA4D87799EF7DE5A1D700

Function 00007FF63D910DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D910E0B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D910E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D910EB6

Strings

RCPT TO:<%s@%s>, xrefs: 00007FF63D910E8D
RCPT TO:<%s>, xrefs: 00007FF63D910E9B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 85d63cd334a15fffc10c553eae93822cc61512cdc19f79a5e6d0144d017ae251
Instruction ID: 35a49533f38fd3b98ab01144c2b5a2319e92f4452d21d6d8df3e90cc955bc7da
Opcode Fuzzy Hash: 85d63cd334a15fffc10c553eae93822cc61512cdc19f79a5e6d0144d017ae251
Instruction Fuzzy Hash: CF31C462A18B8981EB01CB66E4403B9A3A4FB84BD4F484231EA9E437DAEF7CD545D300

Function 00007FF63D928D00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D928D2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9291F6

Strings

TRUE, xrefs: 00007FF63D928D1B
FALSE, xrefs: 00007FF63D928D22
%s: %s, xrefs: 00007FF63D9291E1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 27fd7b92b08e80c62ef846c0a086f2f778ba8bb1206fe5054450fd63a8227f2e
Instruction ID: de1b68812a9d960d2904a4eebc662549b4de5197c633861f9d3eaba7d049c3f9
Opcode Fuzzy Hash: 27fd7b92b08e80c62ef846c0a086f2f778ba8bb1206fe5054450fd63a8227f2e
Instruction Fuzzy Hash: 52018851A0C7CE95EB659B96E8453F51394BF06B94F444031CE4E833DBEE3CE185A300

Function 00007FF63D8E07E0 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8D3D70: memcpy.VCRUNTIME140(?,?,0000000100000000,00007FF63D8E083D), ref: 00007FF63D8D3E22
Part of subcall function 00007FF63D8D3D70: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8D3E47

Part of subcall function 00007FF63D8D3D70: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0000000100000000,00007FF63D8E083D), ref: 00007FF63D8D3E04

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E0A50
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E0A57
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E0A5E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E0A65
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8E0A6C

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: 5e99ca1bde4e1416277db961ec109b41f83edf1a84fdc12d99675d70987ffbfa
Instruction ID: 57ba2140720628e1ecf636e1f74649c4f4fad928c604c9eef98b751e6205255d
Opcode Fuzzy Hash: 5e99ca1bde4e1416277db961ec109b41f83edf1a84fdc12d99675d70987ffbfa
Instruction Fuzzy Hash: D161B572A08B8985EB10DFA1E8487BD3361EB45BC4F405431DA8D46BAAEF7DE494E300

Function 00007FF63D911A3B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D911AF0

Strings

ABOR, xrefs: 00007FF63D911BEB
Failure sending ABOR command: %s, xrefs: 00007FF63D911C11
control connection looks dead, xrefs: 00007FF63D911CE2
Remembering we are in dir "%s", xrefs: 00007FF63D911B88

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 64235b987dc4283eb39a3e46cb9056cdcaac1d29d970c9d48b0a8f2c00d34f7d
Instruction ID: 11e05d377ed8b2526f89681391a419c880665427885de04839818d66f6cb4d06
Opcode Fuzzy Hash: 64235b987dc4283eb39a3e46cb9056cdcaac1d29d970c9d48b0a8f2c00d34f7d
Instruction Fuzzy Hash: 3E51D562A0C68B51EA64D7B0A0413B96798BB413A4F400335CAAD977CBFF7CF449A300

Function 00007FF63D929D35 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929D78
memcpy.VCRUNTIME140 ref: 00007FF63D929D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929E6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929EBF

Strings

TRUE, xrefs: 00007FF63D929EC9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 602671d3a2d94d0c58c6a2817907598d8b60c771bcf79690e693e34a726910cb
Instruction ID: 8487c8dc56508c7bd3e1611acbb2db6a3b6ad4be47a98171dac1bd552414b147
Opcode Fuzzy Hash: 602671d3a2d94d0c58c6a2817907598d8b60c771bcf79690e693e34a726910cb
Instruction Fuzzy Hash: F84178A2A5969E15FF098A6585143782756EB41BF8F044631CA6EC77CFED2CE185E300

Function 00007FF63D92D5E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF63D92D5A0), ref: 00007FF63D92D64F

Part of subcall function 00007FF63D907900: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF63D8EA92A,?,?,?,?,?,?,?,00007FF63D8EA6F7), ref: 00007FF63D907911

Part of subcall function 00007FF63D907900: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF63D907AB3
Part of subcall function 00007FF63D907900: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF63D907AD0

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF63D92D5A0), ref: 00007FF63D92D6BE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF63D92D5A0), ref: 00007FF63D92D6D8
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF63D92D5A0), ref: 00007FF63D92D70E

Strings

xn--, xrefs: 00007FF63D92D6F5

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: 0482d43a5dde45dd05f52a108a77ab978c10832de55e94877db1e2a1dabc5794
Instruction ID: b4234bf3bccce68894fd20f1c6ff40dc8f39851ed7562a08dba67608b6f80f1d
Opcode Fuzzy Hash: 0482d43a5dde45dd05f52a108a77ab978c10832de55e94877db1e2a1dabc5794
Instruction Fuzzy Hash: C841F391B1D68E05FB549BA199143B95689AF45FD4F488134DE4EC7BCBFE3CE0029340

Function 00007FF63D8FB6D0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF63D8FB778
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FB7F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FB8A2

Strings

allocate connect buffer!, xrefs: 00007FF63D8FB81F
CONNECT phase completed!, xrefs: 00007FF63D8FB8E3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 19a2770aa77b3fa0689d2492ca67e253766b0bf91735c74c89d5515d28d14041
Instruction ID: da52428efe877e4a714efd833821274f83ac61583980d7aae2ffddfb6155487b
Opcode Fuzzy Hash: 19a2770aa77b3fa0689d2492ca67e253766b0bf91735c74c89d5515d28d14041
Instruction Fuzzy Hash: 1C517072A086CA92F71A8BAAE5443B973D4FB84B88F044035CB5D87395EF78F5659300

Function 00007FF63D929049 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92908C
memcpy.VCRUNTIME140 ref: 00007FF63D9290B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9291F6

Strings

%s: %s, xrefs: 00007FF63D9291E1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 5bb74c90d2b924d3d46db183046a0a2a57736da918594bd6e258ae812eb30cc8
Instruction ID: baec89fa060a6c6d87b88d4675125c728f6be68253b42e9bc3ace47833cb2aa8
Opcode Fuzzy Hash: 5bb74c90d2b924d3d46db183046a0a2a57736da918594bd6e258ae812eb30cc8
Instruction Fuzzy Hash: ED417C91A492DD56FA288A8694193B55791FB46BE4F044236CEAF877CFFD2CE045B300

Function 00007FF63D927F1E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 8c86ff128ba9d3563ac51cb2b2091eae2cf1052a09e38ac452feb21dadc9144c
Instruction ID: 168a6673fc4bb2a098c1dd49ceda5c298ac7362f0142773b97cfe2e37ffa9fc9
Opcode Fuzzy Hash: 8c86ff128ba9d3563ac51cb2b2091eae2cf1052a09e38ac452feb21dadc9144c
Instruction Fuzzy Hash: D1218226B08ACA46EA10CB55E8442EA63A4FF45BD8F084532DE5D877DBEE3CD145D700

Function 00007FF63D911F90 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91205B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912074
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912088

Strings

QUIT, xrefs: 00007FF63D911FBF
Failure sending QUIT command: %s, xrefs: 00007FF63D911FE3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 7d883075aae54850d3eb03df06446082c78f0e0411fe14da9346d1acb75fded0
Instruction ID: 8783c9740483692f35aedd56ccb4bd8a8ede435b0efe41d088f7a40b2de4b6be
Opcode Fuzzy Hash: 7d883075aae54850d3eb03df06446082c78f0e0411fe14da9346d1acb75fded0
Instruction Fuzzy Hash: AD319C32B08B8A81EB54DFA1A4413B933A8FB45B88F484131DA4D8B79AEF3CE141D340

Function 00007FF63D908B90 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F4F70), ref: 00007FF63D908BC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F4F70), ref: 00007FF63D908BDA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F4F70), ref: 00007FF63D908BEF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F4F70), ref: 00007FF63D908C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F4F70), ref: 00007FF63D908C25
memcpy.VCRUNTIME140(?,?,?,00007FF63D8F4F70), ref: 00007FF63D908C59

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction ID: d6f073a1fcda1dbf7519771014d5aaa4858722c2d3bc36433832e12ed8f608a9
Opcode Fuzzy Hash: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction Fuzzy Hash: 4B21E2B1A1978986E714EF51A81023977B0FF48BD0F444275DA9D973DAEF3CD4509700

Function 00007FF63D917E00 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D917E31
strchr.VCRUNTIME140 ref: 00007FF63D917E5D
strchr.VCRUNTIME140 ref: 00007FF63D917E74
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D917E93

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction ID: 18e7dd5c24d2840b93b3a9e540c4df377ba1b4aa8bf042d981951676d00c5a07
Opcode Fuzzy Hash: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction Fuzzy Hash: EE21A462A15B8A81EB81CF65D4403A823E4EF45B54F0C0134DE4D8BB9AFF3DD590D320

Function 00007FF63D927CB8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 80d941fe8a2562cfa1d9bd5d0ddd1395d7de46f75ffb7d469e30cae601067e19
Instruction ID: c5106427a3a56679d95acda5e978f499a3e4374e40202402fae283bb0422dfc4
Opcode Fuzzy Hash: 80d941fe8a2562cfa1d9bd5d0ddd1395d7de46f75ffb7d469e30cae601067e19
Instruction Fuzzy Hash: 08218666A08A8E46EA50DB95F8442FA63A4FF857C8F440431DE4E9779BFE3CD041D700

Function 00007FF63D927CF6 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D928800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: e9065b80354950d0c0a22d29add7bf103f3a31efd183f5bfd048baa5b73aabb4
Instruction ID: 03b369d9a4838cf60df559b6d2200776e6c937f77e3b11aeadd6b806dffbd977
Opcode Fuzzy Hash: e9065b80354950d0c0a22d29add7bf103f3a31efd183f5bfd048baa5b73aabb4
Instruction Fuzzy Hash: 82218466A08A8A86EB50CB95F8442EA63A4FF857C8F440472DE4D8779BFF3CD045D700

Function 00007FF63D927CD0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D92A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9280F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D928139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92814C

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

Signature: %s, xrefs: 00007FF63D9280E7
Signature, xrefs: 00007FF63D9280CF

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 351cc430754a4aa9ce224d767375869e203a95fb4cbef21fa980b6650913238a
Instruction ID: 2ca8391411f16c924a3a526e06f34cbb29fd81a839d9d130d5696e45c57f5d24
Opcode Fuzzy Hash: 351cc430754a4aa9ce224d767375869e203a95fb4cbef21fa980b6650913238a
Instruction Fuzzy Hash: 21218466A08A8A86EB50CB95F8442EA63A4FF857C8F440432DE4E9779BFF3CD045D700

Function 00007FF63D8E2C40 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF63D8E2579), ref: 00007FF63D8E2EDF

Strings

No data record of requested type, xrefs: 00007FF63D8E2EC3
Host not found, xrefs: 00007FF63D8E2EA8
Host not found, try again, xrefs: 00007FF63D8E2ED5
Unrecoverable error in call to nameserver, xrefs: 00007FF63D8E2ECC

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 87e7efae683d90ae9f7ffd3d2827c118d7d582aa4952cc6e8680895ff73779e2
Instruction ID: 7897013181aaaeaffd2bfdce198bb9cf88269ef8bf85262e85f648cabdb9e15d
Opcode Fuzzy Hash: 87e7efae683d90ae9f7ffd3d2827c118d7d582aa4952cc6e8680895ff73779e2
Instruction Fuzzy Hash: 48117752A0C69B41FB6987A8F95537832909F05780F486175C61E867D7EE7CF6D0A700

Function 00007FF63D8EAC00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF63D8EB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF63D8EB0B7
CloseHandle.KERNEL32 ref: 00007FF63D8EB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF63D8EB0E6
closesocket.WS2_32 ref: 00007FF63D8EB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF63D8EB11D

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction ID: 6de3e528603bafee2800f647f3a2be902f0604870d15a7681e3b8747fcf02c5e
Opcode Fuzzy Hash: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction Fuzzy Hash: 67112836A09B49C6E7219F96E5402697370FB89B90F144131DF8E83B55EF39F4A59B00

Function 00007FF63D9299F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929EBF

Strings

TRUE, xrefs: 00007FF63D929EC9
FALSE, xrefs: 00007FF63D929A10

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: 18f56905f20e121188a22abea656a85f17a1ee6d051de28b0ad6ada156964aaf
Instruction ID: 3363288b30bc2317660c38ae8b1b0f424a3396abaade179669467b8ad94c9660
Opcode Fuzzy Hash: 18f56905f20e121188a22abea656a85f17a1ee6d051de28b0ad6ada156964aaf
Instruction Fuzzy Hash: 0A41C5E2B4935D94FF158A99D4143BC2799AB057A9F484932CE5DC63CAFE3CE544A300

Function 00007FF63D91BA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF63D91BA81
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF63D91BAC0
WSAGetLastError.WS2_32 ref: 00007FF63D91BB18

Strings

TFTP response timeout, xrefs: 00007FF63D91BADA

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: 8347cac327bb24b5d574b77b49ec0f6cd9e89f2d5a1a1fa804789b694d9cfef2
Instruction ID: 32d0f1b781ea018416f96fe10732f13f04e541d162b456db489b52934d3d1e50
Opcode Fuzzy Hash: 8347cac327bb24b5d574b77b49ec0f6cd9e89f2d5a1a1fa804789b694d9cfef2
Instruction Fuzzy Hash: FD41B132608A4981EB619FA6E8103BA2795EB49BA8F444231DE2D877DEFF3CD4459740

Function 00007FF63D8F5AF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8F5C15
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF63D8F5C30

Strings

..., xrefs: 00007FF63D8F5B98
..., xrefs: 00007FF63D8F5B82

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: ce52080936e4f8e8d2536faf948e6cb61c3c5a059659c50af308800804d1eb0d
Instruction ID: 451292101959af15e635999c6ffa15d595d75620fcdbed2f63fd6f53c550f00d
Opcode Fuzzy Hash: ce52080936e4f8e8d2536faf948e6cb61c3c5a059659c50af308800804d1eb0d
Instruction Fuzzy Hash: 19310321A0DA8991EB24CB61E4047F963E5FB84B84F458231CA9E837D5EF3DE055D780

Function 00007FF63D912590 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF63D9125E2
accept.WS2_32 ref: 00007FF63D912601

Part of subcall function 00007FF63D904C90: ioctlsocket.WS2_32 ref: 00007FF63D904CA9

Strings

Error accept()ing server connect, xrefs: 00007FF63D91261E
Connection accepted from server, xrefs: 00007FF63D91262F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 37eff06c670ceac0791a01fedf0a1c54ff6c4c3372e9d23781156f68b02f578b
Instruction ID: c2ad25a1a78aa88152d806e4be0e0936f24dbd73935027bdc367aa8e22e6b9f1
Opcode Fuzzy Hash: 37eff06c670ceac0791a01fedf0a1c54ff6c4c3372e9d23781156f68b02f578b
Instruction Fuzzy Hash: DE31B42170868986FB64DF61E4453AA7394FB88BE4F440231DA6D8B7CAEF7DE5059700

Function 00007FF63D904130 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D903B69), ref: 00007FF63D9041BD

Strings

Failed to alloc memory for big header!, xrefs: 00007FF63D9041C8
Rejected %zu bytes header (max is %d)!, xrefs: 00007FF63D90415B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: fd2de4368d3f59bb441b9b1cd9bd76850ec27dc8a676fb8f2278394dc7b74183
Instruction ID: 6ba86ff4b5702c3af63a99e624b2873f13c6e344863cbbabb6b37190e637294c
Opcode Fuzzy Hash: fd2de4368d3f59bb441b9b1cd9bd76850ec27dc8a676fb8f2278394dc7b74183
Instruction Fuzzy Hash: CA215C32B08A8886EB449B65F5402AD67A5FB49FC4F444036EF9D87B5ADF38D4A2D700

Function 00007FF63D90DEE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF63D90DF67
%s%s, xrefs: 00007FF63D90DF13

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 9ad9c9c743700dca674b2ef310e13197ed19483ca3184e6ea3a8d7b69f8cecd6
Instruction ID: 99e8f347f3f42ba7b82f1fad25d0bf08170c199dfc1868a8e23f931f65a367b9
Opcode Fuzzy Hash: 9ad9c9c743700dca674b2ef310e13197ed19483ca3184e6ea3a8d7b69f8cecd6
Instruction Fuzzy Hash: 8C115E22B1D64A81EB54CB95F9401B96360EF48FC4F484136EE0D87B9AFF3CE985A340

Function 00007FF63D902090 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF63D9020F4
strchr.VCRUNTIME140 ref: 00007FF63D902107
strchr.VCRUNTIME140 ref: 00007FF63D902119
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D90214B
memcpy.VCRUNTIME140 ref: 00007FF63D902175

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction ID: 5087605957bc99fb25d3a401c78c9c761b1aa5ce065df484adc574f30328ce47
Opcode Fuzzy Hash: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction Fuzzy Hash: F621E211A0D79A41EE958B9165102B9A7D29F45BC8F4C8071EE8D8B7CFFE2CE616E310

Function 00007FF63D9015A0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D9019B5), ref: 00007FF63D9015D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D9019B5), ref: 00007FF63D9015E1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D9019B5), ref: 00007FF63D90165A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D9019B5), ref: 00007FF63D90166B
memcpy.VCRUNTIME140(?,?,00000000,00007FF63D9019B5), ref: 00007FF63D901694

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: e5aaf608392412e8d4b9a1dc4236b9329a67fb2d8f166538309d8ae37baf092e
Instruction ID: a2bdd1aa07d3eb706ec1084b102e6552b1fd54b06b0d975ca797254cad2ba0ac
Opcode Fuzzy Hash: e5aaf608392412e8d4b9a1dc4236b9329a67fb2d8f166538309d8ae37baf092e
Instruction Fuzzy Hash: 6F315022A09B4981EB10DF91F9402A963A4EB49FE4F480631DE6ED77CAEF3CD454A300

Function 00007FF63D929BAF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929EBF

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF63D929CD1
GMT, xrefs: 00007FF63D929C5E
TRUE, xrefs: 00007FF63D929EC9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 02a75f58ffacef6802f716bea87759d1f8428b31b63a0010405d9e98485556c6
Instruction ID: c610f4b8bd510f2fbe75e9d9d4641d9a20eae41ecb8299c67a5dd25ed0fe7c84
Opcode Fuzzy Hash: 02a75f58ffacef6802f716bea87759d1f8428b31b63a0010405d9e98485556c6
Instruction Fuzzy Hash: 645106F2A4C69E64EB11CBA5A9441B97BA9EB05798F444032CA4D827DEEF3CE545E300

Function 00007FF63D928EC0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9291F6

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF63D928FEA
GMT, xrefs: 00007FF63D928F7E
%s: %s, xrefs: 00007FF63D9291E1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: f60b2e51f519615eef786d8073e28d31358248af6a85787eb4334c3cf12e941d
Instruction ID: 7e3ee76e09b6ce73cd943f74821cf6be9639166873467f6127dde5b2e0dce9cc
Opcode Fuzzy Hash: f60b2e51f519615eef786d8073e28d31358248af6a85787eb4334c3cf12e941d
Instruction Fuzzy Hash: 6F41E561B0C69E89EB608B91A4442F9B795FB05794F444171CE4D837DAEF3CE846E300

Function 00007FF63D92A830 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF63D90C9DB), ref: 00007FF63D92A88E

Strings

%s, xrefs: 00007FF63D92A864

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: e8563760c9da6c2e55638eb9222dc2312effe998e0ffc11f539499322c92f9db
Instruction ID: 21db645328951cad00bea38d830fe00be943f02d7281aea36c1709ec1c2dc4eb
Opcode Fuzzy Hash: e8563760c9da6c2e55638eb9222dc2312effe998e0ffc11f539499322c92f9db
Instruction Fuzzy Hash: D4418433A18B4982EB50CB56F4401AA77A4FB85BA4F140135DF9E47BA6EF3CE495D340

Function 00007FF63D92AC70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF63D90E220,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF63D92ACC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92AD4C

Strings

%s, xrefs: 00007FF63D92AC95

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: dce2de37e97ba3121b39420a420f3ffe21f4b37a0ee740fa9a1d3028c897691b
Instruction ID: 172c5532474c98d02f0b7ec72fdb0240dd3234c97b9e884cc825d71020071340
Opcode Fuzzy Hash: dce2de37e97ba3121b39420a420f3ffe21f4b37a0ee740fa9a1d3028c897691b
Instruction Fuzzy Hash: E0419533618B8982EA51DB56F4401AAB3E4FB45B94F044235DF8D87BA6EF3CF0959700

Function 00007FF63D8D4D50 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF63D8D4E2F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF63D8D4E6C
memcpy.VCRUNTIME140 ref: 00007FF63D8D4E76
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8D4EA3

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: e60ed55956e50edfbe7ea8bb8067bec7a55e8f8f967eba0faf20a733e55885ad
Instruction ID: 66ec41d59798035687c9fdc1287985b50e46d5a9dd6f0779dbb27c8691a6826c
Opcode Fuzzy Hash: e60ed55956e50edfbe7ea8bb8067bec7a55e8f8f967eba0faf20a733e55885ad
Instruction Fuzzy Hash: FB31F52270978968EE149FAAA5042A8A351AF04BF0F580736DF6D477DAEF7CF051A300

Function 00007FF63D929AF5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929EBF

Strings

GMT, xrefs: 00007FF63D929B49
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF63D929B9B
TRUE, xrefs: 00007FF63D929EC9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: cf9aa252f422a400f87b355d1684e97f3e4706dadaf5d5527515fc444d0a9930
Instruction ID: fddda13f0c187baf8ac15a4625a071720b0d962de1c7d30d94ada5abb47864a5
Opcode Fuzzy Hash: cf9aa252f422a400f87b355d1684e97f3e4706dadaf5d5527515fc444d0a9930
Instruction Fuzzy Hash: AB31B3B2A49B8DA4EB10CBA5E9402A97766FB457D8F484032CA4D877DEEF3CE545D300

Function 00007FF63D8E0580 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF63D8D11FA), ref: 00007FF63D8E05B8
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF63D8D11FA), ref: 00007FF63D8E0659
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF63D8E0677

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: de1c6875f200540c7d25ef907db20005fdec5c9f83ccc6c164fa8115f0418b6c
Instruction ID: 91e62f2ef573b515bc2e28bb82400fdc79aeceba188b3f2d559f3946909cd1ad
Opcode Fuzzy Hash: de1c6875f200540c7d25ef907db20005fdec5c9f83ccc6c164fa8115f0418b6c
Instruction Fuzzy Hash: CD21F762A0A75E45FA159BD1A5013382254AF44BE4F580B30DE6D4BBD6FF7CB4A2A700

Function 00007FF63D928E05 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9291F6

Strings

GMT, xrefs: 00007FF63D928E59
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF63D928EA9
%s: %s, xrefs: 00007FF63D9291E1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: c8d5e4a8ff85ba13f6c5b70e3070ea00d9005e9db9aac26ba7c889d65a3b0171
Instruction ID: c9248f9c4c9ff323b9930600761b5512c4c4198b8f20852ffbdfe12aecacc524
Opcode Fuzzy Hash: c8d5e4a8ff85ba13f6c5b70e3070ea00d9005e9db9aac26ba7c889d65a3b0171
Instruction Fuzzy Hash: 2231C462A0CB8D88EB649B91E4446E973A5FB49B94F544131CE4D873CBEF7CE549E300

Function 00007FF63D929D3D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929D78
memcpy.VCRUNTIME140 ref: 00007FF63D929D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929EBF

Strings

TRUE, xrefs: 00007FF63D929EC9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 0a46df6ddcc284711443a9b7be861963df002ccb44c57c74328d9d386c14981d
Instruction ID: 8f914239920bad9c0b41fc4bf0d2649810062b6c65987489edde99dece061d74
Opcode Fuzzy Hash: 0a46df6ddcc284711443a9b7be861963df002ccb44c57c74328d9d386c14981d
Instruction Fuzzy Hash: 5C21C1A6B4974E54FF068A96A5143B82766AB45BF8F044532CD1E837CEEE7CE5819300

Function 00007FF63D92953A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929541
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9299AE

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: c81d72406b07da167721bd56d756242438e8c37084d661deb41acdef60b828a0
Instruction ID: fe7b9cbff2f563ecc52dad5767e8c037eba0d6537c1aaf26808324996fb6b4cb
Opcode Fuzzy Hash: c81d72406b07da167721bd56d756242438e8c37084d661deb41acdef60b828a0
Instruction Fuzzy Hash: 5A212195E4D59E65FB12CBA488043786FA98B11B68F080530C1CEC1BDFEF2CD545E300

Function 00007FF63D929051 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92908C
memcpy.VCRUNTIME140 ref: 00007FF63D9290B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9291F6

Strings

%s: %s, xrefs: 00007FF63D9291E1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 5220cc3d17588d35cad3d5a67b2830ac868535652abc24202a45ac1b11bc70fb
Instruction ID: d03e4543c495261fd46be55d301314452a36c1b580664925d3752946d929b2a7
Opcode Fuzzy Hash: 5220cc3d17588d35cad3d5a67b2830ac868535652abc24202a45ac1b11bc70fb
Instruction Fuzzy Hash: B121D195B097C951FA659B87A9043B55395BF89FE4F044131CE5D87BCBEE3CE045A300

Function 00007FF63D9270AA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D927589

Strings

Start Date: %s, xrefs: 00007FF63D927577
Start Date, xrefs: 00007FF63D92755D
%s%lx, xrefs: 00007FF63D927105

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: d226b40c569d856c120d596ceab6aaf83955d24eba0c30aa2b7f35493c273657
Instruction ID: ea8783710870c0803451103ba99f2da8dff91dea46503c994fda56a1cd916ddf
Opcode Fuzzy Hash: d226b40c569d856c120d596ceab6aaf83955d24eba0c30aa2b7f35493c273657
Instruction Fuzzy Hash: A221CB51A0D28E45EF148BA598546F967A2AF0578CF445871C90EDB7CBFF3DE154A300

Function 00007FF63D923130 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D923E99,00000000,?,?,00007FF63D923456), ref: 00007FF63D923159
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D923E99,00000000,?,?,00007FF63D923456), ref: 00007FF63D923190
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D923E99,00000000,?,?,00007FF63D923456), ref: 00007FF63D9231A2
memcpy.VCRUNTIME140(?,?,?,00007FF63D923E99,00000000,?,?,00007FF63D923456), ref: 00007FF63D9231CA

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction ID: 81d7c44d62dd6d9dd7d4613d897de51ebf98efd278f24e5d157bba7ad527953c
Opcode Fuzzy Hash: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction Fuzzy Hash: 1F218E26A19B8582DB44CF66F49022963A0FB48FC8B488435DE5E4779EEF3CC492C300

Function 00007FF63D90BF40 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F04B9,?,?,?,?,00007FF63D8EF85B), ref: 00007FF63D90BF68
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF63D8F04B9,?,?,?,?,00007FF63D8EF85B), ref: 00007FF63D90BF8E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F04B9,?,?,?,?,00007FF63D8EF85B), ref: 00007FF63D90BFAF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8F04B9,?,?,?,?,00007FF63D8EF85B), ref: 00007FF63D90BFC0

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 4605cc5c122742bf078e2de82160463c2c23cd3f4f401cc025448c3935667395
Instruction ID: 0baf70e332cb85709e712f6dd0239ae779d5bdbe25e464e1f68123d171134241
Opcode Fuzzy Hash: 4605cc5c122742bf078e2de82160463c2c23cd3f4f401cc025448c3935667395
Instruction Fuzzy Hash: F3118A21B0D74681E661AB92B540239A291FF4CBCCF140435DE5D83BDEEE3DE4406B40

Function 00007FF63D901960 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9019E3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF63D901970

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction ID: 524ff0b656a1cd395862bc60cac09233093b9a5460966cafc892576d007e1a97
Opcode Fuzzy Hash: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction Fuzzy Hash: ED019B61F1574942FA159B95B8403B96290AF84BF0F044230DEBD877DAFF3CD4999340

Function 00007FF63D92D550 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D92D576
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D92D587
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92D5B6

Part of subcall function 00007FF63D92D5E0: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF63D92D5A0), ref: 00007FF63D92D64F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D92D5AD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 7cab5db05de9ca3a6ba704ce4dbf99f699dd45310a38cd1de36bc81fa6730da7
Instruction ID: aab17445936796c64c8eaf70a2f82e1c3ddd2eeee8e19ccc0f4fe98c73c230af
Opcode Fuzzy Hash: 7cab5db05de9ca3a6ba704ce4dbf99f699dd45310a38cd1de36bc81fa6730da7
Instruction Fuzzy Hash: 3601B161F1D78942FF698BD6755003852A0AF49BD8F080074EE5E83BCEFEACD885A340

Function 00007FF63D8EB130 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF63D8EB0E2,?,?,?,00000000), ref: 00007FF63D8EB141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB0E2,?,?,?,00000000), ref: 00007FF63D8EB14A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D8EB0E2,?,?,?,00000000), ref: 00007FF63D8EB154
closesocket.WS2_32 ref: 00007FF63D8EB172

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction ID: d0ffe444e1b7b9219ae5127e9c5c34458c462fc592e3b6745c9efcba7925227e
Opcode Fuzzy Hash: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction Fuzzy Hash: 59017513D29B8683EB15CFB5D8201782320FFE9F6CB056325DD6D812EAAF78A5D49200

Function 00007FF63D90CEE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF63D90C8C3), ref: 00007FF63D90CFB2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF63D90C8C3), ref: 00007FF63D90D003

Strings

(){ %*], xrefs: 00007FF63D90CEFD

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction ID: e1d3683263d038d4b13b884db7b1ac2eb5296494b1072cea72aa38fb5f82aa0a
Opcode Fuzzy Hash: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction Fuzzy Hash: 95315912A0D68E54FF214BA574403792BD19F5ABD4F588131FB8E837CBEE2DA805E312

Function 00007FF63D91E75F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D91E855
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D91E8B7

Strings

%ld, xrefs: 00007FF63D91E78C

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: b684a0f3a4480ac4010a0a53c987e4e88761b27135ebecd2b2aaf6e1a6ffc4de
Instruction ID: d093e96e421f6471360105fc2ea40e9e498efc613d14be94b598bae906ff02e4
Opcode Fuzzy Hash: b684a0f3a4480ac4010a0a53c987e4e88761b27135ebecd2b2aaf6e1a6ffc4de
Instruction Fuzzy Hash: 69318122E09A4A89FB76CB90A5603BA23E4AF44B54F494075DE5D837CAFF3CE444E710

Function 00007FF63D8FA680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8FA6F9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D8FA792

Strings

identity, xrefs: 00007FF63D8FA6B4, 00007FF63D8FA723, 00007FF63D8FA78B

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: 8690c95090deaf51d2efd87eea583d13a7b5cf8f3fd27f35376c74de60e9b24e
Instruction ID: 921dbcbac96d0bdf91ce90041be6f4d910ae16b741ab57f2167da1ac2fcea89b
Opcode Fuzzy Hash: 8690c95090deaf51d2efd87eea583d13a7b5cf8f3fd27f35376c74de60e9b24e
Instruction Fuzzy Hash: 68318165A09A4A81EB518B55E9403B967A4BF44FF8F194231CEAD833D9FE3CE4519300

Function 00007FF63D8F8CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F8D10
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F8D6B

Strings

, xrefs: 00007FF63D8F8D23

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction ID: 0298780055c8f01e8c782168ba8247b6062eed218affaf03c38b01667bde8534
Opcode Fuzzy Hash: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction Fuzzy Hash: CA11D0B260AB8182DB549F55F00026973B4FB18FD4F484A35DA5E47789EF3CE8A0C340

Function 00007FF63D8F7010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF63D8F708F
setsockopt.WS2_32 ref: 00007FF63D8F70BE

Strings

@, xrefs: 00007FF63D8F701F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction ID: ca7d0907b25e518272a4f969c55ecf2487367a23ec4ce23cfede41909aab7b3d
Opcode Fuzzy Hash: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction Fuzzy Hash: AC1142B1A0828A86F720CF90F804669B7E4FF85758F544034DA48877DAEF7DE589DB00

Function 00007FF63D929AC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D929ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D929EBF

Strings

TRUE, xrefs: 00007FF63D929EC9

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: b9bcba089e7daf5a5108d1bf9e552f43ea53acd441afa2f1c8325fcdf4de783d
Instruction ID: fd85170d8d212f70e5ab5f232039c60c58d53861255bea1e22b92b6f952d3906
Opcode Fuzzy Hash: b9bcba089e7daf5a5108d1bf9e552f43ea53acd441afa2f1c8325fcdf4de783d
Instruction Fuzzy Hash: DE019EB2A4A65D94FB028B95E9102782766BB05BE8F444432CE1E863CAEE3CD585E300

Function 00007FF63D928DD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF63D928DDF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D9291F6

Part of subcall function 00007FF63D8F0240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8F0292

Strings

%s: %s, xrefs: 00007FF63D9291E1

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: c54095af87d9a4b0217f03e264ff0f02705c9544dec9f5f692171f7663123aa3
Instruction ID: 1f4074a8e67b987448deb4bf98986fdeb0e99f499a7b965cbcfd6a3d6559646a
Opcode Fuzzy Hash: c54095af87d9a4b0217f03e264ff0f02705c9544dec9f5f692171f7663123aa3
Instruction Fuzzy Hash: 65F0AF91A0C78986EA619782B8047E51394BF4ABD4F480031CE5E873DBAF3CE585A300

Function 00007FF63D8EBC00 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D8E5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8EFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8E1B61), ref: 00007FF63D8E5757
Part of subcall function 00007FF63D8E5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D8EFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D8E1B61), ref: 00007FF63D8E5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EBC36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EBC46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D8EBC54
memset.VCRUNTIME140 ref: 00007FF63D8EBC8F

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction ID: 2b91ab523b66f65f6ba60fd184d1ddaae99919091987bbfcb2ec28aa0ec7fd26
Opcode Fuzzy Hash: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction Fuzzy Hash: 99212F32E28B95A3E704CB22DA402A87360FB99744F51A225EB9C43B52EF74F1F1D700

Function 00007FF63D92AE10 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D90CC93), ref: 00007FF63D92DDA6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D90CC93), ref: 00007FF63D92DDC5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D90CC93), ref: 00007FF63D92DDDF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF63D90CC93), ref: 00007FF63D92DDED

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction ID: 9ab39fd6dfc0d88450b3938af1ca61b5ec4deac5b43ac57a97783a90d1fc24f8
Opcode Fuzzy Hash: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction Fuzzy Hash: 5411FE36A18A4981EB54DFA5E89023C63B4FF94F98F144131CA5E837AADF3CD895E340

Function 00007FF63D912C00 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912C5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912C7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF63D912C8E

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction ID: 8784115a0c41c7da99867dc442e4ad70d98034360d74efdca0372c9c5c9f7275
Opcode Fuzzy Hash: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction Fuzzy Hash: 9F113A36624B44C6D750DF65E58026873A4FB84F88F084075DF8E97369CF38E899D740

Function 00007FF63D924840 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D92093E), ref: 00007FF63D924866
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D92093E), ref: 00007FF63D924887
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D92093E), ref: 00007FF63D9248A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF63D92093E), ref: 00007FF63D9248B0

Memory Dump Source

Source File: 00000000.00000002.2278030298.00007FF63D8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63D8D0000, based on PE: true

Associated: 00000000.00000002.2278010747.00007FF63D8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278086593.00007FF63D931000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278117777.00007FF63D948000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2278139919.00007FF63D949000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63d8d0000_J1un7vGf29.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2124235a9113e76acb7eecb01da0754f535a2c886931aa00cef68c70ac2a9cfc
Instruction ID: 9fe705b38f9aded912717ec534cc1cb04a82888d111eb5853e0a09934e0bce32
Opcode Fuzzy Hash: 2124235a9113e76acb7eecb01da0754f535a2c886931aa00cef68c70ac2a9cfc
Instruction Fuzzy Hash: 7F11B736624B4982EB14DF66E89003C73B4FF95F887104066CE5D83BAADF38D895E380

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report J1un7vGf29.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_J1un7vGf29.exe_5cd87136c5f8c6d2a2edad2aab90e620989ace30_5a213bd4_6075f31e-8a75-4958-baa0-25eb9dc96c5d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD85B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB1B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB4B.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
J1un7vGf29.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre