Edit tour

Windows Analysis Report
flX5YA1C09.exe

Overview

General Information

Sample name:	flX5YA1C09.exe renamed because original name is a hash value
Original sample name:	2ab72b91ce16dd1252e5a054ac75752e.exe
Analysis ID:	1538243
MD5:	2ab72b91ce16dd1252e5a054ac75752e
SHA1:	a9b72d4e2e3ced63e58d36e11d0bf5e8a3132f0f
SHA256:	ef1550c124e6a450ffce5f4ffe0313962c73e2169b7f6e4b289bafa386912400
Tags:	64exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

flX5YA1C09.exe (PID: 1468 cmdline: "C:\Users\user\Desktop\flX5YA1C09.exe" MD5: 2AB72B91CE16DD1252E5A054AC75752E)

conhost.exe (PID: 5100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6288 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2096 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5332 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6684 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6048 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5156 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 368 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5956 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4416 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 2760 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 4080 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3552 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3200 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6436 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5828 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1924 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2096 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6288 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5732 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5160 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5256 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5936 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 368 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2760 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4416 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 672 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3552 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3416 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 6436 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3200 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5328 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5756 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 3984 cmdline: C:\Windows\system32\WerFault.exe -u -p 1468 -s 1012 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: flX5YA1C09.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: flX5YA1C09.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791569F8D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF791569F8D
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791569280 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF791569280
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79156C260 CryptHashData,	0_2_00007FF79156C260
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79156C270 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF79156C270
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79156C210 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF79156C210
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791586440 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF791586440
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791569350 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF791569350
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791585B20 CertOpenStore,GetLastError,CertCreateCertificateChainuser,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainuser,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF791585B20
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158CE90 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF79158CE90
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158EF80 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF79158EF80

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF79154F130
Source: flX5YA1C09.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF791578B50

Source: unknown

HTTPS traffic detected: 172.67.72.57:443 -> 192.168.2.6:49721 version: TLS 1.2

Source: flX5YA1C09.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant ESP\x64\Release\EpicGames.pdb source: flX5YA1C09.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 172.67.72.57 172.67.72.57

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF791541580 rand,rand,rand,SetConsoleTitleA,_invalid_parameter_noinfo_noreturn,GetConsoleWindow,GetWindowLongPtrA,SetWindowLongPtrA,SetLayeredWindowAttributes,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,GetStdHandle,SetConsoleTextAttribute,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,URLDownloadToFileA,system,system,Sleep,exit,URLDownloadToFileA,system,system,Sleep,exit,_invalid_parameter_noinfo_noreturn,

0_2_00007FF791541580

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: flX5YA1C09.exe	String found in binary or memory: http://185.101.104.122/esphvciforabronkz.exe
Source: flX5YA1C09.exe	String found in binary or memory: http://185.101.104.122/esphvciforabronkz.exeC:
Source: flX5YA1C09.exe	String found in binary or memory: http://185.101.104.122/esphvcionbronkz.exe
Source: flX5YA1C09.exe	String found in binary or memory: http://185.101.104.122/esphvcionbronkz.exeC:
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: flX5YA1C09.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: flX5YA1C09.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/64
Source: flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ITECT
Source: flX5YA1C09.exe, flX5YA1C09.exe, 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmp, flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/gramW
Source: flX5YA1C09.exe, 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: unknown

HTTPS traffic detected: 172.67.72.57:443 -> 192.168.2.6:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF79158CE90 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF79158CE90

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791541580	0_2_00007FF791541580
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79155F5E0	0_2_00007FF79155F5E0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF7915589D0	0_2_00007FF7915589D0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF7915569D0	0_2_00007FF7915569D0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791557D10	0_2_00007FF791557D10
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791569F8D	0_2_00007FF791569F8D
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79157D270	0_2_00007FF79157D270
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79153D2A0	0_2_00007FF79153D2A0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791565430	0_2_00007FF791565430
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791553380	0_2_00007FF791553380
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791550650	0_2_00007FF791550650
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79156C620	0_2_00007FF79156C620
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791579570	0_2_00007FF791579570
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791581600	0_2_00007FF791581600
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF7915805D0	0_2_00007FF7915805D0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF7915395AD	0_2_00007FF7915395AD
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791559890	0_2_00007FF791559890
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF7915628E0	0_2_00007FF7915628E0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79153978B	0_2_00007FF79153978B
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791574A40	0_2_00007FF791574A40
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF7915489E0	0_2_00007FF7915489E0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79153AC4D	0_2_00007FF79153AC4D
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791567D10	0_2_00007FF791567D10
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791585B20	0_2_00007FF791585B20
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79153EBC0	0_2_00007FF79153EBC0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158CE90	0_2_00007FF79158CE90
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79153DE30	0_2_00007FF79153DE30
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158EF10	0_2_00007FF79158EF10
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79156A04C	0_2_00007FF79156A04C
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79156A055	0_2_00007FF79156A055
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791531000	0_2_00007FF791531000

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF791558ED0 appears 36 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF7915559C0 appears 381 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF791555B40 appears 327 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF79155A460 appears 34 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF791543080 appears 49 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF791558E00 appears 46 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF79155A2F0 appears 37 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF791590286 appears 47 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF79155A380 appears 33 times
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: String function: 00007FF791550290 appears 70 times

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1468 -s 1012

Source: classification engine

Classification label: mal56.evad.winEXE@67/22@1/2

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF791542690 GetLastError,_errno,FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF791542690

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1468
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5100:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8dd36976-5025-4431-9558-94be19ff8c12

Jump to behavior

Source: flX5YA1C09.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: flX5YA1C09.exe

ReversingLabs: Detection: 26%

Source: flX5YA1C09.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\flX5YA1C09.exe "C:\Users\user\Desktop\flX5YA1C09.exe"
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1468 -s 1012
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: flX5YA1C09.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: flX5YA1C09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: flX5YA1C09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: flX5YA1C09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: flX5YA1C09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: flX5YA1C09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: flX5YA1C09.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: flX5YA1C09.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: flX5YA1C09.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant ESP\x64\Release\EpicGames.pdb source: flX5YA1C09.exe

Source: flX5YA1C09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: flX5YA1C09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: flX5YA1C09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: flX5YA1C09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: flX5YA1C09.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF7915586B0 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7915586B0

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF79154C3F4 push rax; ret

0_2_00007FF79154C3F5

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\flX5YA1C09.exe

API coverage: 4.3 %

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF791590138 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF791590138

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF791590138 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF791590138

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF7915586B0 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7915586B0

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158FA44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF79158FA44
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158FD9C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79158FD9C
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79158FF44 SetUnhandledExceptionFilter,	0_2_00007FF79158FF44

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T

Source: C:\Users\user\Desktop\flX5YA1C09.exe

Code function: 0_2_00007FF79158FFB4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF79158FFB4

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791564AB0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF791564AB0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791557680 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF791557680
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79157B54D calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF79157B54D
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF79157B7A0 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF79157B7A0
Source: C:\Users\user\Desktop\flX5YA1C09.exe	Code function: 0_2_00007FF791574A40 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF791574A40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
flX5YA1C09.exe	26%	ReversingLabs	Win64.Trojan.Generic
flX5YA1C09.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
keyauth.win	172.67.72.57	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.101.104.122/esphvciforabronkz.exe	flX5YA1C09.exe	false		unknown
https://keyauth.win/api/1.1/ITECT	flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/esphvcionbronkz.exe	flX5YA1C09.exe	false		unknown
https://keyauth.win/api/1.1/64	flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/esphvcionbronkz.exeC:	flX5YA1C09.exe	false		unknown
http://upx.sf.net	Amcache.hve.38.dr	false	URL Reputation: safe	unknown
https://keyauth.win/api/1.2/gramW	flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/esphvciforabronkz.exeC:	flX5YA1C09.exe	false		unknown
https://keyauth.win/api/1.2/p	flX5YA1C09.exe, 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://curl.haxx.se/docs/http-cookies.html	flX5YA1C09.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	flX5YA1C09.exe	false		unknown
https://keyauth.win/api/1.2/	flX5YA1C09.exe, flX5YA1C09.exe, 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmp, flX5YA1C09.exe, 00000000.00000002.2311388651.0000016082A2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.72.57	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538243
Start date and time:	2024-10-20 21:20:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	flX5YA1C09.exe renamed because original name is a hash value
Original Sample Name:	2ab72b91ce16dd1252e5a054ac75752e.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@67/22@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 218
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: flX5YA1C09.exe

Simulations

Behavior and APIs

Time	Type	Description
15:21:21	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.72.57	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse
	fox vanguard bypass.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.28454.21428.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MulDrop28.40.18458.1049.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MulDrop28.40.18458.1049.exe	Get hash	malicious	Unknown	Browse
	aj.exe	Get hash	malicious	Unknown	Browse
	Loader (3).exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.20301.32747.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.32411.29244.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Frozen_Slotted.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse	192.229.221.95
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.4973.23208.exe	Get hash	malicious	RMSRemoteAdmin	Browse	192.229.221.95
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse	192.229.221.95
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.4973.23208.exe	Get hash	malicious	RMSRemoteAdmin	Browse	192.229.221.95
	file.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://kongtuke.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	whrbuflqwhah.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	2WWOAq4c3b.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
bg.microsoft.map.fastly.net	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse	199.232.210.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	http://kongtuke.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	https://sub.investorscabirigroup.com/4WQbos10596ktJI775idiwtbqpkk1528WGTFCWTFRKDXPVO305927/749609o14	Get hash	malicious	Phisher	Browse	199.232.214.172
	SecuriteInfo.com.Win64.MalwareX-gen.9093.5876.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	172.67.72.57
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	172.67.72.57
	ojSv9FmOwn.lnk	Get hash	malicious	Unknown	Browse	172.67.72.57
	a1OueQJq4d.exe	Get hash	malicious	DCRat	Browse	172.67.72.57
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	172.67.72.57
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.72.57

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_flX5YA1C09.exe_6193f6e47d768fb07ef4e778aeb03f9f2b24ff_41b9c7aa_8ba48ea0-4bd8-4fb0-9fd2-b26a74e926a9\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9989196732181074
Encrypted:	false
SSDEEP:	96:74FmXAJ6PsBh8z75fQbQXIDcQNc6GcEOcw3X+HbHg/8BRTf3o8Fa9KifQvH+DFdO:s4G6Pf0jCUAjvVm8zuiFVZ24lO8L
MD5:	D4EEA43C6D13EEB3C3DA1A888F6EADF3
SHA1:	3B2AA851D572D4CC7EFA3668A9B8E4C81B335B0C
SHA-256:	1A06BB69A0B9711B750E2B4C346A6861A1647D73F9FF80B1EA26B4289BD43E84
SHA-512:	0F8D02CC1CC21527DC2825541AF33879998C4F5951482698B0EB1CA9C413FE8539E1570FCDFA7572244B7715CAFC6A868313564A6503E860AB7DAD5268F9501D
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.2.5.6.7.6.0.4.0.2.1.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.2.5.6.7.6.7.1.2.0.9.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.a.4.8.e.a.0.-.4.b.d.8.-.4.f.b.0.-.9.f.d.2.-.b.2.6.a.7.4.e.9.2.6.a.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.1.1.e.2.1.1.-.f.7.c.3.-.4.4.9.b.-.8.6.0.a.-.b.f.5.f.3.9.b.1.c.c.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.l.X.5.Y.A.1.C.0.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.b.c.-.0.0.0.1.-.0.0.1.5.-.e.4.9.1.-.4.d.3.6.2.5.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.e.7.8.0.b.b.2.8.9.6.8.6.9.2.0.4.7.d.4.7.8.e.a.c.f.3.9.a.4.e.f.0.0.0.0.f.f.f.f.!.0.0.0.0.a.9.b.7.2.d.4.e.2.e.3.c.e.d.6.3.e.5.8.d.3.6.e.1.1.d.0.b.f.5.e.8.a.3.1.3.2.f.0.f.!.f.l.X.5.Y.A.1.C.0.9...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCC0.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 19:21:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	106948
Entropy (8bit):	1.6017360298464471
Encrypted:	false
SSDEEP:	384:0JKKOFDj81+20DMjbnRafpqwSRuKLBIihjj+kJAkBYpmrIrbW:gyf8s20HSRuKLBLjVKpm0b
MD5:	4529676BF936B99A49941F7220BB959F
SHA1:	F314297396CD324BB9CCA7B179C6CFB2A5ED288B
SHA-256:	51C7F271E180FEBA698820B6ECF9D0A330E55EDAD0547CDC80D9187E0719254D
SHA-512:	CA9984D5D6FFAA07F6325F91AC034FB6DF41952CA326C3A2259BEBEEF8F7AE04BB422CA59FDD751E02F5E2A50AAB26AF1FAF6D31A8F07B61CA9FAE3079B535DC
Malicious:	false
Preview:	MDMP..a..... .......,X.g............$...............,............J..........T.......8...........T...........p'..Tz.......................!..............................................................................eJ......T"......Lw......................T..........."X.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDEA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10138
Entropy (8bit):	3.7148182515668258
Encrypted:	false
SSDEEP:	192:R6l7wVeJmFaO6Y2D1Kphkgmf9+pr+89bC0h+f3Qim:R6lXJM16YgKpCgmf98BIfS
MD5:	ABC89B928323F66B6223D326BF32946E
SHA1:	59249ED0C5C239FA9D6C98F003B2F182625AEC5F
SHA-256:	AE73307E20511B2868F882FD54EB55A417E6DFE3B32530F996F518A7A626600F
SHA-512:	DE004C5AF18A65B473CF8B88E7E12E632B0CE3F1DD1C39D57301648358BF72F161075A8819D5FFC6A689507C3B2A40FC69C40534C14D13A17A54634A2FD9CD5D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE1A.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.467744226737068
Encrypted:	false
SSDEEP:	48:cvIwWl8zskJg771I9bQWpW8VYlYm8M4J1QmeQXZFVpmyq85lQ1QNl/iXjHOd:uIjfiI78p7VFJakZpmTaPiXjHOd
MD5:	32F0003900DCE39DCEBD21FE39ADDA36
SHA1:	88B521D67069882C318ED1D84D60F9CBB37F4F85
SHA-256:	133D333FAA4C19FC12517A394580078DADD139C1639B275FAD939DFDF1571CC7
SHA-512:	4B082A57F83FD62FFDF90D4EABB4C0AD7057F23429D82F920C8CB43BE22198F4F3E72C96B7F3DB2057CF2E449803FC4C2D8632BF423D95B857FDA6B1B6A7BFC8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552143" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468735284041842
Encrypted:	false
SSDEEP:	6144:YzZfpi6ceLPx9skLmb0fxZWSP3aJG8nAgeiJRMMhA2zX4WABluuNSjDH5S:OZHtxZWOKnMM6bFpYj4
MD5:	77E3835604A82A39AB556865220851D4
SHA1:	EBF4C8D0E2FB8621875B5D2C5C866443C5105222
SHA-256:	D1ADE13663A813BA8C878F3F192B291F631E8132A793018988B9A29A5139DFF5
SHA-512:	444E94997467B5E790B8EE6268C2451906F967C323C4DBC9E97BD0F5ACA0A9734E2C0C142CB30708199656322AE9A6E69A6898D2A8BD6D8766D2E387415D4539
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...;%#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.423212701081575
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	flX5YA1C09.exe
File size:	506'368 bytes
MD5:	2ab72b91ce16dd1252e5a054ac75752e
SHA1:	a9b72d4e2e3ced63e58d36e11d0bf5e8a3132f0f
SHA256:	ef1550c124e6a450ffce5f4ffe0313962c73e2169b7f6e4b289bafa386912400
SHA512:	83f8a0b269ce7755f973c0e67c5bb7ce7b8d62e4b534b8663d663168a1aaa5d8c1adaf5cfb122a3e2555464f4a7c939c3544d0b34c85aaa91d905fe951fb4e0c
SSDEEP:	12288:EcRxIa0CO71s6Hxw2KJrSddWzF1H43DPb6+:EoxIoOhlG2KJ2WR+Pb6
TLSH:	5BB46D96A7A807E9D1A7C03CC547C603E7B6B4991311DBDB43A4CA791F637E12E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005fa28
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671280FD [Fri Oct 18 15:38:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F58B90800E8h
dec eax
add esp, 28h
jmp 00007F58B907F9D7h
int3
int3
jmp 00007F58B9080398h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000173Bh]
dec eax
mov ecx, ebx
call dword ptr [000016A2h]
call dword ptr [00001724h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001720h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001714h]
test eax, eax
je 00007F58B907FB69h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018DC2h]
call 00007F58B907FD2Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EA9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E39h], eax
dec eax
mov eax, dword ptr [00018E92h]
dec eax
mov dword ptr [00018D03h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E07h], eax
mov dword ptr [00018CDDh], C0000409h
mov dword ptr [00018CD7h], 00000001h
mov dword ptr [000000E1h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdf8	0x5fe00	6e1e4d840b96fa78546683623c1ccd96	False	0.5328848191003911	data	6.336775963819167	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	52e99968a6c7e9d2b183e4b7669d7b0c	False	0.37964672046703296	data	5.5807888225661255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	187efa02209dcc291bd59d9caee44253	False	0.21484375	data	2.434631909806376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	258717b56f67e0367f4feb0b60186654	False	0.482421875	data	5.779326294134831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	39326fb49822ad82593e9e49b5e608b8	False	0.5123697916666666	data	4.849267575521713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:21:11.941822052 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:11.941884995 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:11.942189932 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:12.004559040 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:12.004600048 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:12.780273914 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:12.780354023 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:12.785415888 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:12.785432100 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:12.785697937 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:12.792165041 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:12.835402012 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:13.082602024 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:13.082658052 CEST	443	49721	172.67.72.57	192.168.2.6
Oct 20, 2024 21:21:13.082847118 CEST	49721	443	192.168.2.6	172.67.72.57
Oct 20, 2024 21:21:23.105897903 CEST	49721	443	192.168.2.6	172.67.72.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:21:11.911408901 CEST	54525	53	192.168.2.6	1.1.1.1
Oct 20, 2024 21:21:11.919394970 CEST	53	54525	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 21:21:11.911408901 CEST	192.168.2.6	1.1.1.1	0xd8db	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 21:21:03.663131952 CEST	1.1.1.1	192.168.2.6	0xe72a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 21:21:03.663131952 CEST	1.1.1.1	192.168.2.6	0xe72a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:05.348247051 CEST	1.1.1.1	192.168.2.6	0x5c53	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:05.348247051 CEST	1.1.1.1	192.168.2.6	0x5c53	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:11.919394970 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	keyauth.win		172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:11.919394970 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	keyauth.win		104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:21:11.919394970 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	keyauth.win		104.26.0.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	172.67.72.57	443	1468	C:\Users\user\Desktop\flX5YA1C09.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 19:21:12 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-20 19:21:12 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 32 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.2&name=loader principal&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	15:21:06
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\flX5YA1C09.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\flX5YA1C09.exe"
Imagebase:	0x7ff791530000
File size:	506'368 bytes
MD5 hash:	2AB72B91CE16DD1252E5A054AC75752E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:21:06
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:21:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff699af0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff699af0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:21:08
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3552, Parent PID: 4080

General

Target ID:	15
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6436, Parent PID: 3200

General

Target ID:	17
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1924, Parent PID: 5828

General

Target ID:	19
Start time:	15:21:09
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6288, Parent PID: 2096

General

Target ID:	21
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff699af0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5160, Parent PID: 5732

General

Target ID:	23
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff699af0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:21:10
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 5936, Parent PID: 1468

General

Target ID:	25
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:21:14
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 4416, Parent PID: 2760

General

Target ID:	28
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3552, Parent PID: 672

General

Target ID:	30
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff624060000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6436, Parent PID: 3416

General

Target ID:	32
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff699af0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff699af0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff676220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:21:15
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1468 -s 1012
Imagebase:	0x7ff609560000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF79155F5E0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155F6B8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155F6C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155F798
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155F81C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155F8C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155F95A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155FA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155FA5D
strchr.VCRUNTIME140 ref: 00007FF79155FBD7
strchr.VCRUNTIME140 ref: 00007FF79155FBEA
strchr.VCRUNTIME140 ref: 00007FF79155FBFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155FD03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155FD73
memcpy.VCRUNTIME140 ref: 00007FF79155FD9A
strchr.VCRUNTIME140 ref: 00007FF79155FDAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155FDC2
strstr.VCRUNTIME140 ref: 00007FF79155FFF8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791560131
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915602A9

Part of subcall function 00007FF791558E00: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791558E73

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156035C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915603E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156063A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791560650
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156065F

Part of subcall function 00007FF7915619B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A0A

strchr.VCRUNTIME140 ref: 00007FF791560C17
strchr.VCRUNTIME140 ref: 00007FF791560C2A
strchr.VCRUNTIME140 ref: 00007FF791560C3C

Part of subcall function 00007FF7915619B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A2A
Part of subcall function 00007FF7915619B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A33

strchr.VCRUNTIME140 ref: 00007FF791560E8F
strchr.VCRUNTIME140 ref: 00007FF791560EA2
strchr.VCRUNTIME140 ref: 00007FF791560EB4

Part of subcall function 00007FF791563FE0: strchr.VCRUNTIME140 ref: 00007FF7915640C6
Part of subcall function 00007FF791563FE0: strchr.VCRUNTIME140 ref: 00007FF7915640D9
Part of subcall function 00007FF791563FE0: strchr.VCRUNTIME140 ref: 00007FF7915640EB

Strings

Content-Range: bytes %s/%I64d, xrefs: 00007FF7915602F6
Failed sending POST request, xrefs: 00007FF791560AE9, 00007FF791560D2D
Proxy-Connection: Keep-Alive, xrefs: 00007FF7915604DF, 00007FF7915604F4
Cookie, xrefs: 00007FF79155F9E2
Failed sending PUT request, xrefs: 00007FF791560A89
Host: %s%s%s:%d, xrefs: 00007FF79155FEC2
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF791560E11
Content-Length: %I64d, xrefs: 00007FF791560A0B, 00007FF791560B60, 00007FF791560DE5
%x, xrefs: 00007FF791560FB5
?%s, xrefs: 00007FF79156044B
%s?%s, xrefs: 00007FF79155F7B5
Range, xrefs: 00007FF791560112
100-continue, xrefs: 00007FF791560C56, 00007FF791560ED6
Accept-Encoding: %s, xrefs: 00007FF79155FA32
%s%s=%s, xrefs: 00007FF791560769
User-Agent, xrefs: 00007FF79155F77D
%s%s, xrefs: 00007FF7915607F0
POST, xrefs: 00007FF79155F765
Referer, xrefs: 00007FF79155F973
0, xrefs: 00007FF791561006, 00007FF791561105
Content-Range, xrefs: 00007FF79156028E
%s, xrefs: 00007FF791560B93
Could not seek stream, xrefs: 00007FF7915601A8
Failed sending HTTP request, xrefs: 00007FF791560D86
Could only read %I64d bytes from the input, xrefs: 00007FF791560265
http, xrefs: 00007FF79155FF5B
1.0, xrefs: 00007FF791560340
Accept, xrefs: 00007FF7915600B3
;type=%c, xrefs: 00007FF791560061
ftp, xrefs: 00007FF79155FFC9
Host:%s, xrefs: 00007FF79155FE06
PUT, xrefs: 00007FF79155F758
multipart/form-data, xrefs: 00007FF79155FB0A
GET, xrefs: 00007FF79155F772
%s , xrefs: 00007FF791560373
Cookie: , xrefs: 00007FF79156074E, 00007FF7915607C4
Host, xrefs: 00007FF79155FD09
Content-Type, xrefs: 00007FF79155FAC7, 00007FF791560DFD
Range: bytes=%s, xrefs: 00007FF79156013E
Content-Length: 0, xrefs: 00007FF791560AB0
If-Modified-Since, xrefs: 00007FF7915608AD
Host: %s%s%s, xrefs: 00007FF79155FE7D
Transfer-Encoding, xrefs: 00007FF79155FB6D
Host:, xrefs: 00007FF79155FDD1
Expect, xrefs: 00007FF791560BB4, 00007FF791560E29
Proxy-Connection, xrefs: 00007FF7915604B3
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF7915602E8
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF79156061B
Transfer-Encoding: chunked, xrefs: 00007FF79155FCCF
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF79155FCDC
Failed sending HTTP POST request, xrefs: 00007FF7915610BB
;type=, xrefs: 00007FF79155FFEE
chunked, xrefs: 00007FF79155FC16
OPTIONS, xrefs: 00007FF79155F74B
Content-Length, xrefs: 00007FF7915609F4, 00007FF791560B49, 00007FF791560DCE
HEAD, xrefs: 00007FF79155F721
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF7915611BE
Last-Modified, xrefs: 00007FF79156089B
Accept-Encoding, xrefs: 00007FF79155FA01
ftp://%s:%s@%s, xrefs: 00007FF79156040B
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF791560934
Invalid TIMEVALUE, xrefs: 00007FF791560863
If-Unmodified-Since, xrefs: 00007FF7915608A4
1.1, xrefs: 00007FF79156034E
Accept: */*, xrefs: 00007FF7915600C5
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF7915602C4
Expect:, xrefs: 00007FF791560BD5, 00007FF791560E4A
Transfer-Encoding:, xrefs: 00007FF79155FB8E
Referer: %s, xrefs: 00007FF79155F98E
File already completely uploaded, xrefs: 00007FF791560249

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 4331d76cf981f97f77d3108d7678a40f23c061385753817b2e423e2649427988
Instruction ID: e326b0acc2e60d9e119f49b5dfa631c27339bf3fcb41c3174fb013b1e7d50877
Opcode Fuzzy Hash: 4331d76cf981f97f77d3108d7678a40f23c061385753817b2e423e2649427988
Instruction Fuzzy Hash: 5303B121A08B8286FB74AB31D4502BDA7A1AF41BC4FC64036DE4D476B9DFBCE465C361

Function 00007FF791569F8D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79156A0E8
strchr.VCRUNTIME140 ref: 00007FF79156A114
strchr.VCRUNTIME140 ref: 00007FF79156A14E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79156A172
strchr.VCRUNTIME140 ref: 00007FF79156A282
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79156A29A

Strings

schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF79156A59F
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF79156A705
http/1.1, xrefs: 00007FF79156A7A3
Services, xrefs: 00007FF79156A1E7
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF79156A554
LocalMachineGroupPolicy, xrefs: 00007FF79156A23C
Microsoft Unified Security Protocol Provider, xrefs: 00007FF79156A68F
LocalMachine, xrefs: 00007FF79156A1A3
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF79156A672
LocalMachineEnterprise, xrefs: 00007FF79156A25B
Users, xrefs: 00007FF79156A206
CurrentUser, xrefs: 00007FF79156A162
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF79156A300
schannel: ALPN, offering %s, xrefs: 00007FF79156A7C5
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF79156A529
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF79156A783
http/1.1, xrefs: 00007FF79156A7B7
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF79156A187
CurrentService, xrefs: 00007FF79156A1C5
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF79156A01B
schannel: unable to allocate memory, xrefs: 00007FF79156A60C, 00007FF79156A897
CurrentUserGroupPolicy, xrefs: 00007FF79156A21D
schannel: Failed to read cert file %s, xrefs: 00007FF79156A649

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 25a2e078a990ac9a65d758b5cfc621f7c6e1c9ce43f4154468b8d776fed08757
Instruction ID: 216915d6566cac8cb155d63bccde698e039adf21cecdb155370eca9ea11a295f
Opcode Fuzzy Hash: 25a2e078a990ac9a65d758b5cfc621f7c6e1c9ce43f4154468b8d776fed08757
Instruction Fuzzy Hash: 25429C21A08B4286EB34AB31E8506B9B3A4FF45BD4FC24135DA1E477A4DFBCE564C760

Function 00007FF791541580 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7915415AA
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7915415E6
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF791541612
SetConsoleTitleA.KERNEL32 ref: 00007FF791541690
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915416C9
GetConsoleWindow.KERNELBASE ref: 00007FF7915416D5
GetWindowLongPtrA.USER32 ref: 00007FF7915416E6
SetWindowLongPtrA.USER32 ref: 00007FF7915416FC
SetLayeredWindowAttributes.USER32 ref: 00007FF791541710
GetStdHandle.KERNEL32 ref: 00007FF791541720
SetConsoleTextAttribute.KERNELBASE ref: 00007FF79154172C
GetStdHandle.KERNEL32 ref: 00007FF791541737
SetConsoleTextAttribute.KERNELBASE ref: 00007FF791541743
GetStdHandle.KERNEL32 ref: 00007FF79154175A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF791541766

Part of subcall function 00007FF7915406D0: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF791531205), ref: 00007FF7915407AF

Part of subcall function 00007FF791541AC0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF791541778), ref: 00007FF791541AE4
Part of subcall function 00007FF791541AC0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF791541778), ref: 00007FF791541B05

GetStdHandle.KERNEL32 ref: 00007FF791541789
SetConsoleTextAttribute.KERNEL32 ref: 00007FF791541795
GetStdHandle.KERNEL32 ref: 00007FF7915417AC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7915417B8
GetStdHandle.KERNEL32 ref: 00007FF7915417CF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7915417DB
GetStdHandle.KERNEL32 ref: 00007FF7915417F2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7915417FE
GetStdHandle.KERNEL32 ref: 00007FF791541815
SetConsoleTextAttribute.KERNEL32 ref: 00007FF791541821
GetStdHandle.KERNEL32 ref: 00007FF791541838
SetConsoleTextAttribute.KERNEL32 ref: 00007FF791541844
GetStdHandle.KERNEL32 ref: 00007FF791541867
SetConsoleTextAttribute.KERNEL32 ref: 00007FF791541873
GetStdHandle.KERNEL32 ref: 00007FF79154188A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF791541896
GetStdHandle.KERNEL32 ref: 00007FF7915418AD
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7915418B9
GetStdHandle.KERNEL32 ref: 00007FF7915418DC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7915418E8
GetStdHandle.KERNEL32 ref: 00007FF7915418FF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79154190B
GetStdHandle.KERNEL32 ref: 00007FF791541922
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79154192E
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF79154194B
URLDownloadToFileA.URLMON ref: 00007FF79154199F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915419AB
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915419B8
Sleep.KERNEL32 ref: 00007FF7915419C3
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915419CB
URLDownloadToFileA.URLMON ref: 00007FF791541A1D
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791541A29
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791541A36
Sleep.KERNEL32 ref: 00007FF791541A41
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791541A49
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791541A82

Strings

.exe, xrefs: 00007FF7915415B3
Selecione a opcao: , xrefs: 00007FF791541934
##########################################################, xrefs: 00007FF7915417BE
http://185.101.104.122/esphvcionbronkz.exe, xrefs: 00007FF7915419D7
cd C:\, xrefs: 00007FF7915419A4, 00007FF791541A22
start C:\Windows\System32\SeieHuSttinstialog.exe, xrefs: 00007FF7915419B1
start C:\Windows\System32\SeuetingsHostialog.exe, xrefs: 00007FF791541A2F
C:\Windows\System32\SeuetingsHostialog.exe, xrefs: 00007FF7915419E8
##########################################################, xrefs: 00007FF791541778
http://185.101.104.122/esphvciforabronkz.exe, xrefs: 00007FF791541959
Iniciar Valorant ESP (HVCI HABILITADO): , xrefs: 00007FF7915418BF
C:\Windows\System32\SeieHuSttinstialog.exe, xrefs: 00007FF79154196A
[ Selecione uma opcao: ], xrefs: 00007FF79154179B
Iniciar Valorant ESP (HVCI DESLIGADO): , xrefs: 00007FF79154184A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant ESP (HVCI DESLIGADO): $ Iniciar Valorant ESP (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SeieHuSttinstialog.exe$C:\Windows\System32\SeuetingsHostialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/esphvciforabronkz.exe$http://185.101.104.122/esphvcionbronkz.exe$start C:\Windows\System32\SeieHuSttinstialog.exe$start C:\Windows\System32\SeuetingsHostialog.exe
API String ID: 2233566951-2931392240
Opcode ID: a0ccd1d23ba874ec03ef257653d175f206dabadea0ba06dd86c4f0158f85fb67
Instruction ID: 978df7b95747943def99185b55008779d036d12726730a92a8a36be01f863ac5
Opcode Fuzzy Hash: a0ccd1d23ba874ec03ef257653d175f206dabadea0ba06dd86c4f0158f85fb67
Instruction Fuzzy Hash: 3EE19161E08A4381EB20FB71D8941B8B361AF847A4FC64235D51FC66F5DEFCA469C361

Function 00007FF7915589D0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF7915589F8
WSACleanup.WS2_32 ref: 00007FF791558A13
GetModuleHandleA.KERNEL32 ref: 00007FF791558A64
GetProcAddress.KERNEL32 ref: 00007FF791558A90
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791558AAA
LoadLibraryA.KERNEL32 ref: 00007FF791558ACD
GetProcAddress.KERNEL32 ref: 00007FF791558AEA
LoadLibraryExA.KERNELBASE ref: 00007FF791558B00
GetSystemDirectoryA.KERNEL32 ref: 00007FF791558B16
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791558B2E
GetSystemDirectoryA.KERNEL32 ref: 00007FF791558B42
LoadLibraryA.KERNEL32 ref: 00007FF791558BB0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791558BBC
GetProcAddress.KERNEL32 ref: 00007FF791558BE8
VerSetConditionMask.KERNEL32 ref: 00007FF791558C71
VerSetConditionMask.KERNEL32 ref: 00007FF791558C84
VerSetConditionMask.KERNEL32 ref: 00007FF791558C93
VerSetConditionMask.KERNEL32 ref: 00007FF791558CA2
VerSetConditionMask.KERNEL32 ref: 00007FF791558CB2
VerifyVersionInfoA.KERNEL32 ref: 00007FF791558CC3
QueryPerformanceFrequency.KERNEL32 ref: 00007FF791558CDF

Strings

iphlpapi.dll, xrefs: 00007FF791558A96
if_nametoindex, xrefs: 00007FF791558BDE
kernel32, xrefs: 00007FF791558A4B
LoadLibraryExA, xrefs: 00007FF791558A7E
AddDllDirectory, xrefs: 00007FF791558AE0

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: e8985ec7fb3c371ba82b911c2ec9c70f227decb0dfb4da8fc6d992bb26964cff
Instruction ID: 598c9e8ca4ce0b0f65271853b78021bde52822723c1e6ea41e227705ea65ddba
Opcode Fuzzy Hash: e8985ec7fb3c371ba82b911c2ec9c70f227decb0dfb4da8fc6d992bb26964cff
Instruction Fuzzy Hash: 34916261A0978286EB70AB32E4543B9B391FB89B90FC64135D94E47774EFBCE0658720

Function 00007FF791557D10 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF791557DAC
socket.WS2_32 ref: 00007FF791557DF5
htons.WS2_32 ref: 00007FF791557E81
setsockopt.WS2_32 ref: 00007FF791557EE3
WSAGetLastError.WS2_32 ref: 00007FF791557EED
getsockopt.WS2_32 ref: 00007FF791557F8F
setsockopt.WS2_32 ref: 00007FF791557FBE
setsockopt.WS2_32 ref: 00007FF791557FFD
WSAIoctl.WS2_32 ref: 00007FF79155808A
WSAGetLastError.WS2_32 ref: 00007FF791558094

Part of subcall function 00007FF791564CE0: ioctlsocket.WS2_32 ref: 00007FF791564CF9

Part of subcall function 00007FF79155D800: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF79154587F), ref: 00007FF79155D817

connect.WS2_32 ref: 00007FF7915581BB
WSAGetLastError.WS2_32 ref: 00007FF7915581D8

Part of subcall function 00007FF791542550: GetLastError.KERNEL32 ref: 00007FF791542572
Part of subcall function 00007FF791542550: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154257A

Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C65
Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C80

Part of subcall function 00007FF791556620: closesocket.WS2_32 ref: 00007FF791556663

Strings

sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF79155827E
Trying %s:%ld..., xrefs: 00007FF791557E8F
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF79155809D
Could not set TCP_NODELAY: %s, xrefs: 00007FF791557F0A
Immediate connect fail for %s: %s, xrefs: 00007FF791558208
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF79155800A
@, xrefs: 00007FF791557F27

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 13fbb7af70b5c68f2c31b92b67b3173c801f34fb863e3f20c1c82c9e9a3d679c
Instruction ID: 7b66376772ef09c8d32c2cde89ca8b6de7af22d0d9535297e76e68530402cef8
Opcode Fuzzy Hash: 13fbb7af70b5c68f2c31b92b67b3173c801f34fb863e3f20c1c82c9e9a3d679c
Instruction Fuzzy Hash: B0F1BF71A0868286E730EB35D4642BDB7A0FB44794FC24035EA4D87AB4DFBCE555CB20

Function 00007FF7915586B0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF79158250A,?,?,?,?,00007FF791558A3B), ref: 00007FF7915586C4
GetProcAddress.KERNEL32(?,?,00007FF79158250A,?,?,?,?,00007FF791558A3B), ref: 00007FF7915586E9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF79158250A,?,?,?,?,00007FF791558A3B), ref: 00007FF7915586FC

Strings

kernel32, xrefs: 00007FF7915586BD
LoadLibraryExA, xrefs: 00007FF7915586DA
AddDllDirectory, xrefs: 00007FF791558743

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 4dd7a7bec3778505651e24fe35f71610763a5e881d0948d01e6d731c7a0f3486
Instruction ID: ac40eca4d8b832926e03eb57aa929a6f82b412db21dec94d60890231f7194bdc
Opcode Fuzzy Hash: 4dd7a7bec3778505651e24fe35f71610763a5e881d0948d01e6d731c7a0f3486
Instruction Fuzzy Hash: A541E652B09A4286EB25AF33A850139A791EF45FE1FC94130DE0E077B0DE7DE4A6C320

Function 00007FF791564AB0 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF791564AF1
htonl.WS2_32 ref: 00007FF791564B1E
setsockopt.WS2_32 ref: 00007FF791564B55
bind.WS2_32 ref: 00007FF791564B70
getsockname.WS2_32 ref: 00007FF791564B8C
listen.WS2_32 ref: 00007FF791564BA1
socket.WS2_32 ref: 00007FF791564BB8
connect.WS2_32 ref: 00007FF791564BD7
accept.WS2_32 ref: 00007FF791564BEE
send.WS2_32 ref: 00007FF791564C3C
recv.WS2_32 ref: 00007FF791564C5A
memcmp.VCRUNTIME140 ref: 00007FF791564C75
closesocket.WS2_32 ref: 00007FF791564C81

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 134dca1b78ca657fffabd6dfe8f524be0cec472b378b214e5a4b578b0c111f4b
Instruction ID: 1bfa28484012e79a4fdbc8b4adbdb0b7850c3654971243d7eabc79a4dbbd1ec8
Opcode Fuzzy Hash: 134dca1b78ca657fffabd6dfe8f524be0cec472b378b214e5a4b578b0c111f4b
Instruction Fuzzy Hash: 57515F31608A4286E760AB35E584169B3A1EB84BB4FD54330EA7F43BF8DFBCD8558750

Function 00007FF7915569D0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

connect to %s port %ld failed: %s, xrefs: 00007FF791556C4D
Connection time-out, xrefs: 00007FF791556AB9
Failed to connect to %s port %ld: %s, xrefs: 00007FF791556EFE
After %I64dms connect time, move on!, xrefs: 00007FF791556B95
Connection failed, xrefs: 00007FF791556DB6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: 4364df8d52fc6405048d3634ce423f9be7205a83e27d6a22880c12e7e853aef9
Instruction ID: 89054c82cc11a875d26cc56be4e2ce7c1a2ad3d65b0de53088cafbf712dae9ef
Opcode Fuzzy Hash: 4364df8d52fc6405048d3634ce423f9be7205a83e27d6a22880c12e7e853aef9
Instruction Fuzzy Hash: 1AE1E171A186C282EB34AB35D4602B9A7A0FB487A4FC54235EA5E077E5DFBCE461C710

Function 00007FF791532AF0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915328F7
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532967
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915329C7
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532A17
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532A67

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532C98

Part of subcall function 00007FF791534910: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915349D0

Part of subcall function 00007FF79158F240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79153443E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF79158F25A

Part of subcall function 00007FF791534360: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532CE8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532D27
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532D75
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532DB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532E68
memcpy.VCRUNTIME140 ref: 00007FF791532E8D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532F63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532FAA
ShellExecuteA.SHELL32 ref: 00007FF7915330A2
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915330AA
MessageBoxA.USER32 ref: 00007FF7915330E0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915330F1
Sleep.KERNEL32 ref: 00007FF791533159
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791533161
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF791533168

Part of subcall function 00007FF7915331B0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915332BF
Part of subcall function 00007FF7915331B0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791533300

Part of subcall function 00007FF791533C80: memcpy.VCRUNTIME140 ref: 00007FF791533CD3

Part of subcall function 00007FF791533320: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791533400

Part of subcall function 00007FF791533420: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791533500

Strings

message, xrefs: 00007FF791532FF3, 00007FF7915330B1
success, xrefs: 00007FF791532EC6
open, xrefs: 00007FF791533099
download, xrefs: 00007FF791533065
Failure, xrefs: 00007FF7915330D7
invalidver, xrefs: 00007FF791533029
sessionid, xrefs: 00007FF791532EEE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 337789b302f75f523bb674596e188a8674e470494e6e28e9ddfb9047656d617b
Instruction ID: a4fb1730dc24b87788152c6e6bd3780d12306981db853598f342c3ccdd22bbe8
Opcode Fuzzy Hash: 337789b302f75f523bb674596e188a8674e470494e6e28e9ddfb9047656d617b
Instruction Fuzzy Hash: 9402F362A08B8285FB20AB78D4443ADB761FB447E4FC25235DAAD07AE5DFBCD091C350

Function 00007FF79156B610 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF79156BC51
memcpy.VCRUNTIME140 ref: 00007FF79156BC6D

Strings

schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF79156B6B5
schannel: failed to read data from server: %s, xrefs: 00007FF79156BBA2
schannel: Curl_read_plain returned error %d, xrefs: 00007FF79156B9B1
schannel: can't renogotiate, an error is pending, xrefs: 00007FF79156BBD2
schannel: renegotiation failed, xrefs: 00007FF79156BBDE
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF79156BBF2
schannel: failed to decrypt data, need more data, xrefs: 00007FF79156BB7A
schannel: server closed the connection, xrefs: 00007FF79156BAE4
schannel: remote party requests renegotiation, xrefs: 00007FF79156BA32
schannel: server indicated shutdown in a prior call, xrefs: 00007FF79156B6D8
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF79156BBFE
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF79156B7DD
schannel: unable to re-allocate memory, xrefs: 00007FF79156B74D, 00007FF79156BBB6
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF79156BA68
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF79156BAAF
schannel: enough decrypted data is already available, xrefs: 00007FF79156B695

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 468c7f387ab69de67b9c46178fe798ccc1586622e1c440d156092cfc90ce2348
Instruction ID: 732a4d0550fed4e12480024e36ca5085e3a27fd674ca81bdd8a436a0e13c5bac
Opcode Fuzzy Hash: 468c7f387ab69de67b9c46178fe798ccc1586622e1c440d156092cfc90ce2348
Instruction Fuzzy Hash: 1702DD72B18E8585EB70EB2AD4543AAB7A4FB40BD0F920536DA4D473B0DFB8D451C750

Function 00007FF79156AAA0 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156AB90
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156ABE1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156AC24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156AD07
memcpy.VCRUNTIME140 ref: 00007FF79156ADA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156AE12
memcpy.VCRUNTIME140 ref: 00007FF79156AEEA
memset.VCRUNTIME140 ref: 00007FF79156B0B7
CertFreeCertificateContext.CRYPT32 ref: 00007FF79156B11A

Strings

schannel: Failed to read remote certificate context: %s, xrefs: 00007FF79156B15A
schannel: SNI or certificate check failed: %s, xrefs: 00007FF79156AF7B
SSL: failed retrieving public key from server certificate, xrefs: 00007FF79156B13A
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF79156AF16
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF79156AFAE, 00007FF79156B1C2
schannel: unable to allocate memory, xrefs: 00007FF79156B20F
schannel: unable to re-allocate memory, xrefs: 00007FF79156AC32
SSL: public key does not match pinned public key!, xrefs: 00007FF79156B0FC, 00007FF79156B124
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF79156AFC4

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: a284abad33f343ce1916dba049f66a931e121b00332314a9f25fae0c54c3845f
Instruction ID: bb9df86c43f15fc8e1de2843c1e158d614bf58ad80af1933d42a202e7b9c2bb0
Opcode Fuzzy Hash: a284abad33f343ce1916dba049f66a931e121b00332314a9f25fae0c54c3845f
Instruction Fuzzy Hash: E4129D72A08F8186EB74AB39D8503AEB7A0FB44B84F910136DA5E477A4DFBCE451C750

Function 00007FF791569CC0 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF791569D91
GetProcAddress.KERNEL32 ref: 00007FF791569DA1

Strings

http/1.1, xrefs: 00007FF79156A7A3
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF79156AA39
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF79156A95C, 00007FF79156A9A3
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF791569E32
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF79156A73F
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF791569D72
schannel: ALPN, offering %s, xrefs: 00007FF79156A7C5
schannel: SNI or certificate check failed: %s, xrefs: 00007FF79156A97D
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF79156A783
http/1.1, xrefs: 00007FF79156A7B7
ntdll, xrefs: 00007FF791569D8A
wine_get_version, xrefs: 00007FF791569D9A
schannel: unable to allocate memory, xrefs: 00007FF79156A897

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 2a96a85dd682720a2a0395f41ca8cbf193f7a3b01dc20dd8288eab63dec27fe3
Instruction ID: 2fd9d84b3f67bc318bb3d49022cc4c729c7648f32636bf913e4751c30f4af739
Opcode Fuzzy Hash: 2a96a85dd682720a2a0395f41ca8cbf193f7a3b01dc20dd8288eab63dec27fe3
Instruction Fuzzy Hash: 0402E032A08B818AE720AB35D8503FEB7A4FB44788F824136DA5D477A5DFBCE564C750

Function 00007FF79154B300 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B332
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B3CD
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF79154B3E6

Part of subcall function 00007FF791564AB0: socket.WS2_32 ref: 00007FF791564AF1

DeleteCriticalSection.KERNEL32 ref: 00007FF79154B420
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B42A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B434
closesocket.WS2_32 ref: 00007FF79154B452
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B488
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154B48E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154B4BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B4D7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154B4E0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154B515
EnterCriticalSection.KERNEL32 ref: 00007FF79154B536
LeaveCriticalSection.KERNEL32 ref: 00007FF79154B54A
CloseHandle.KERNEL32 ref: 00007FF79154B557
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B582
closesocket.WS2_32 ref: 00007FF79154B59B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B5AF

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 0f176e75cecbb76cdcc7bf5b0f645a93cc3ee423f56b65c4fd695de7eb201e46
Instruction ID: 39b8268c0613a9733b327f36b1afd456675fc6cd9ef9b16413efe827f4e2e793
Opcode Fuzzy Hash: 0f176e75cecbb76cdcc7bf5b0f645a93cc3ee423f56b65c4fd695de7eb201e46
Instruction Fuzzy Hash: 69813E32D09B8182E734EF21E550269B360FB94754F965235DB9E037A1EFB8E5E48350

Function 00007FF791552970 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

No connections available in cache, xrefs: 00007FF79155336B
host, xrefs: 00007FF791553040
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF7915531F0
proxy, xrefs: 00007FF791553032
No more connections allowed to host %s: %zu, xrefs: 00007FF791553102
anonymous, xrefs: 00007FF791552B28
ftp@example.com, xrefs: 00007FF791552B2F
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF7915531C2
No connections available., xrefs: 00007FF791553111
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF791553053

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 6b313b1ff0a45369b508b08826f8d8bd13a0b577d4460adc72fd130e75a4694e
Instruction ID: 3e5ff9254d9ae2f3bed85da7cdf459800c60aae8372f5f9e88a45259e3f7f490
Opcode Fuzzy Hash: 6b313b1ff0a45369b508b08826f8d8bd13a0b577d4460adc72fd130e75a4694e
Instruction Fuzzy Hash: 3E42D722B09BC291EBA9AB3195603B9B7A0FB45B84F850035DE5D477A5DFBCE470C320

Function 00007FF791551900 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791541BB1,?,?,?,?,00007FF7915335E1), ref: 00007FF791551918
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551961

Strings

<, xrefs: 00007FF791551A77
`, xrefs: 00007FF791551BFA
v, xrefs: 00007FF791551C0F
<, xrefs: 00007FF791551B9E
<, xrefs: 00007FF791551BA8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 595ef5842befdeb713a6ddf656bd9ecb5cca7743d9590fe775feb76880473611
Instruction ID: 916b835c25f50f2efc98154ac1648f1a4eda0df41f270473655df3740e194504
Opcode Fuzzy Hash: 595ef5842befdeb713a6ddf656bd9ecb5cca7743d9590fe775feb76880473611
Instruction Fuzzy Hash: 34915C32908BC186E3109F34D4443E877A0FB55B5CF595238DF991B7AADFBAA0A4C720

Function 00007FF791557350 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF7915573BC
WSAGetLastError.WS2_32 ref: 00007FF7915573C6

Part of subcall function 00007FF791542550: GetLastError.KERNEL32 ref: 00007FF791542572
Part of subcall function 00007FF791542550: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154257A

getsockname.WS2_32 ref: 00007FF791557446
WSAGetLastError.WS2_32 ref: 00007FF791557450

Strings

getsockname() failed with errno %d: %s, xrefs: 00007FF791557470
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF79155756C
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF7915574D6
getpeername() failed with errno %d: %s, xrefs: 00007FF7915573E6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: bbe4ceb424cf4d9b4c806e7f93ced93b9e3da9280fb0904b96d2e48ee7c611fa
Instruction ID: 33734c910f1482fe534e2a72cdfd158835985a3c21854b5a20eae5479d4a121f
Opcode Fuzzy Hash: bbe4ceb424cf4d9b4c806e7f93ced93b9e3da9280fb0904b96d2e48ee7c611fa
Instruction Fuzzy Hash: F8919F72A18BC182D720DF35D4502E973A0FB89B88F895236EF4C47665EF78E195CB21

Function 00007FF791568720 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF791568742
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF7915687AE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF7915687E8
memcpy.VCRUNTIME140(?,?,?,00007FF79154B245), ref: 00007FF791568801
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF79156880F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF79156884A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF791568853
freeaddrinfo.WS2_32(?,?,?,00007FF79154B245), ref: 00007FF791568881
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF791568895
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF79156889F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF7915688AC
WSASetLastError.WS2_32(?,?,?,00007FF79154B245), ref: 00007FF7915688CD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 1e773e6d1ef13c63b1b75f1c94382ef1f413d9554964dd35fc4ea277ad229414
Instruction ID: cc3627621de7f1adfc415b36adb827a5c2a7e08f1c0c5461e116c82a35da37e3
Opcode Fuzzy Hash: 1e773e6d1ef13c63b1b75f1c94382ef1f413d9554964dd35fc4ea277ad229414
Instruction Fuzzy Hash: 2D513D36A49B4282EB75AF61A55013AF7A0FB48BD4F8A4435CE8E13760DF7CE464C760

Function 00007FF791566030 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF79156608D
Sleep.KERNEL32 ref: 00007FF79156609E
WSASetLastError.WS2_32 ref: 00007FF791566208
Sleep.KERNEL32 ref: 00007FF791566219
__WSAFDIsSet.WS2_32 ref: 00007FF7915662CC
__WSAFDIsSet.WS2_32 ref: 00007FF7915662E3
__WSAFDIsSet.WS2_32 ref: 00007FF7915662FE
__WSAFDIsSet.WS2_32 ref: 00007FF791566312
__WSAFDIsSet.WS2_32 ref: 00007FF79156632D
__WSAFDIsSet.WS2_32 ref: 00007FF791566341

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: abd993cd88855e34aa5c9e26aa33cbd17ae10345d58ff1a7757adbdaf51f28e4
Instruction ID: aac827bb5ca988fc5eba24a754f67195fe6337c46007fac09d103a774169260b
Opcode Fuzzy Hash: abd993cd88855e34aa5c9e26aa33cbd17ae10345d58ff1a7757adbdaf51f28e4
Instruction Fuzzy Hash: F7912B31B0CE828AEB796E3599502B9E294FF843D4FD14134D91E87BE4DFBCD9618250

Function 00007FF791554F40 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554F8F

Strings

Unix socket path too long: '%s', xrefs: 00007FF791554FE6
Couldn't resolve host '%s', xrefs: 00007FF7915550C1
Couldn't resolve proxy '%s', xrefs: 00007FF79155516C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 68643da3fc30b0570181909e97d04cfee4669a67e8130e0b2375fa1add1ed4f3
Instruction ID: 850fcb22376dc724975b0d51e047074e079470a35169d4c5dc67c6b9b7d36efe
Opcode Fuzzy Hash: 68643da3fc30b0570181909e97d04cfee4669a67e8130e0b2375fa1add1ed4f3
Instruction Fuzzy Hash: 0351B561A0C78282F729AB359560379BBA0FB44790F950031EB8D437B0DF7DE4758720

Function 00007FF791532890 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915328F7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532967
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915329C7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532A17
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532A67
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532AD8

Strings

h%49, xrefs: 00007FF791532AAE
.8, xrefs: 00007FF791532AB5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: ec42c300fd7f31bbc5d13404be995d8a02917175fa4a498dfd81fcda4fec176c
Instruction ID: 0c814b9b92b6bfe5303eded5f0e7d99b5c3fec5f1fc5424565e466b2a6a0f575
Opcode Fuzzy Hash: ec42c300fd7f31bbc5d13404be995d8a02917175fa4a498dfd81fcda4fec176c
Instruction Fuzzy Hash: 0D618D22E18BD689F311DF78E8451BCBB70FB89748F855229CFC926D25EBA81109C395

Function 00007FF79154B1F0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791568720: getaddrinfo.WS2_32 ref: 00007FF791568742
Part of subcall function 00007FF791568720: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF7915687AE
Part of subcall function 00007FF791568720: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF7915687E8
Part of subcall function 00007FF791568720: memcpy.VCRUNTIME140(?,?,?,00007FF79154B245), ref: 00007FF791568801
Part of subcall function 00007FF791568720: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF79156880F
Part of subcall function 00007FF791568720: freeaddrinfo.WS2_32(?,?,?,00007FF79154B245), ref: 00007FF791568881
Part of subcall function 00007FF791568720: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF791568895
Part of subcall function 00007FF791568720: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF79156889F
Part of subcall function 00007FF791568720: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B245), ref: 00007FF7915688AC

WSAGetLastError.WS2_32 ref: 00007FF79154B24B
WSAGetLastError.WS2_32 ref: 00007FF79154B255
EnterCriticalSection.KERNEL32 ref: 00007FF79154B270
LeaveCriticalSection.KERNEL32 ref: 00007FF79154B27F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154B290
send.WS2_32 ref: 00007FF79154B2B3
WSAGetLastError.WS2_32 ref: 00007FF79154B2BD
LeaveCriticalSection.KERNEL32 ref: 00007FF79154B2D0

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: f7c4e5cbcd272fddd2bef9543e2f47016aea2c4402c0e504b2cf3b49b58bb64f
Instruction ID: c2125080378c4f2414e5fca2396a730fcd2cd41376274c6a33a87a20188532b7
Opcode Fuzzy Hash: f7c4e5cbcd272fddd2bef9543e2f47016aea2c4402c0e504b2cf3b49b58bb64f
Instruction Fuzzy Hash: 68316F31A0CA4686E760AF35E490269B7A0FF84BE8FD50131DA0E836B4DFBCD465C761

Function 00007FF791565C90 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF791565CF6
WSASetLastError.WS2_32 ref: 00007FF791565EB6
Sleep.KERNEL32 ref: 00007FF791565EC6
__WSAFDIsSet.WS2_32 ref: 00007FF791565FDA
__WSAFDIsSet.WS2_32 ref: 00007FF791565FF2
Sleep.KERNEL32 ref: 00007FF79156601D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 9f3e151cb250e305114643fab4248131c4be06f32a009a1ddd31ca33c14a965e
Instruction ID: 4c7cc324e204a8f9fc0dd7e3eef09db6c990a0e2d4a55e32a971ceb2b7857385
Opcode Fuzzy Hash: 9f3e151cb250e305114643fab4248131c4be06f32a009a1ddd31ca33c14a965e
Instruction Fuzzy Hash: C1A14DB1A78A4286EB795B34D808379E295FF44BD4F914234E92E877E4DFBCD9208350

Function 00007FF79156BCE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156BD7E
memcpy.VCRUNTIME140 ref: 00007FF79156BE16
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156BF4C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF79156BEF4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF79156BF14

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 4498ad4dcdc6d00945403b8a38ce96c10f752aea999d50e9d10c8de5344d2721
Instruction ID: 1434908aafbf3e97d905a9c3abe0de32ff584781458180a21494b2498525c4d5
Opcode Fuzzy Hash: 4498ad4dcdc6d00945403b8a38ce96c10f752aea999d50e9d10c8de5344d2721
Instruction Fuzzy Hash: CB719E72B04F018AEB20DB75D4506ADB3A1FB48BA8F814635DE2D477E4EE78E416C750

Function 00007FF79158F8AC Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF79158F943
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79158F991
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79158F996
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79158F99E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79158F9A6
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79158F9C8
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79158FA22

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: 5c1bf33a8262fb8a9265364dfe8b970797fd310612fa06bab78109a3e82c9b51
Instruction ID: 199d8f6ea9b24330783f5b68b96c661e84c5ab259161d214971970155d09f7d9
Opcode Fuzzy Hash: 5c1bf33a8262fb8a9265364dfe8b970797fd310612fa06bab78109a3e82c9b51
Instruction Fuzzy Hash: 70315121A0C24382FB34BB74D4513B9D391AF49784FC604B6D64E4BAF7DEEDA4658231

Function 00007FF791546D50 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546DB5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546EE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546F0E

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF791546FCB
%s, xrefs: 00007FF791547017

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 2ac45d0b3f8141cfc778614bb871165b0eab50eb157bb3d071267177eaa47ccd
Instruction ID: 484a7448a18e908c83d1fddf0e6e287042ee94009dc16f9873ee664818461a7c
Opcode Fuzzy Hash: 2ac45d0b3f8141cfc778614bb871165b0eab50eb157bb3d071267177eaa47ccd
Instruction Fuzzy Hash: 41916132A0868196EB78BB35D5503BEA3D1FB44B84FD64431DE5E076A9CFB8E4708760

Function 00007FF7915511E0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155120B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551221

Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155103D
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155105A
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155106E
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155108A
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF7915510A7
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF7915510CA
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF7915510DE
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF7915510F2
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF791551118
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155112C
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF791551140
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155118F
Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF79155119C

Part of subcall function 00007FF791550FC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791551645), ref: 00007FF7915511C5

memset.VCRUNTIME140 ref: 00007FF791551255

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF791551431
User-Agent: %s, xrefs: 00007FF7915512EF

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: cc270fcbb0397121c5c20b5635b5bdad10aec92339a197071a10f1228c485e1c
Instruction ID: 2823f42cfa62ade917fb1e9ced93b73383598472cfdf1d60454b25ec00b18e00
Opcode Fuzzy Hash: cc270fcbb0397121c5c20b5635b5bdad10aec92339a197071a10f1228c485e1c
Instruction Fuzzy Hash: 4571A56290CBC181E761EF3594603BDAB50FB41B94F8A4131EF5E4B6A6DFBCE4618360

Function 00007FF791561760 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915617F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561801
memcpy.VCRUNTIME140 ref: 00007FF79156181C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156197C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561985

Strings

1.1, xrefs: 00007FF79156176F

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: d6f711ccd9c413a7139487ff782507654feef34da79e39076222df88c29a3976
Instruction ID: 60476c8b1b3902e52df7eb251b4d4629ffa4219c7a6470ddc7b15ef9b8d26909
Opcode Fuzzy Hash: d6f711ccd9c413a7139487ff782507654feef34da79e39076222df88c29a3976
Instruction Fuzzy Hash: EB515C72608E8586D7759B22E5903BEB3A0FB85BC4F854031DE9E87764DF7CE0A48390

Function 00007FF791555F20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555FE6
recv.WS2_32 ref: 00007FF791556010
send.WS2_32 ref: 00007FF791556033
WSAGetLastError.WS2_32 ref: 00007FF791556045

Strings

Send failure: %s, xrefs: 00007FF791556075

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: bad8e2b9f78913238dd4996b2fe71e1ef4ab40e2601b9c16876674bf2ad8640e
Instruction ID: 9a6bc18993ebce001db5a35150eb8c4875ab7cb15477271b52bb3120103ab14d
Opcode Fuzzy Hash: bad8e2b9f78913238dd4996b2fe71e1ef4ab40e2601b9c16876674bf2ad8640e
Instruction Fuzzy Hash: 2741A072A05B8145EB70AF35E850779A6A0BB48BA8FC64235DE6D473A4DF7CE460C310

Function 00007FF791547E48 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791547F98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791547FDF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154800A

Part of subcall function 00007FF791546D50: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546D9E
Part of subcall function 00007FF791546D50: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546DB5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154803F

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF791547386

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 19717ebffcfcd34a4d805cd54382aed297bd2d9e9f6d8c6c265517247b27b987
Instruction ID: da42485f37334501872726742fc779dd136201e92a9719fce9732a64b1b240da
Opcode Fuzzy Hash: 19717ebffcfcd34a4d805cd54382aed297bd2d9e9f6d8c6c265517247b27b987
Instruction Fuzzy Hash: E3D1C361A0864285FB35AF7990503BDA3A1FF40B88FA55531DE0D076FADFB8E461C360

Function 00007FF7915335A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915328F7
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532967
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915329C7
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532A17
Part of subcall function 00007FF791532890: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532A67

MessageBoxA.USER32 ref: 00007FF791533777

Part of subcall function 00007FF791534360: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915337DA

Strings

null, xrefs: 00007FF791533602
keyauth.win, xrefs: 00007FF791533703

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: bf5030269bfb94014387a5e0b6dca6bb52eb33e27260a3917493ef355fe1072e
Instruction ID: 61a11c1b1f537cb19dd39e5fac5478171c883767c4be15018dd991cf7fd8cebe
Opcode Fuzzy Hash: bf5030269bfb94014387a5e0b6dca6bb52eb33e27260a3917493ef355fe1072e
Instruction Fuzzy Hash: 62512262B18B5285FB24EF74D4443AC6321FB05B88F914034DE4E1BFA6DFBC91A28350

Function 00007FF7915824D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7915586B0: GetModuleHandleA.KERNEL32(?,?,?,00007FF79158250A,?,?,?,?,00007FF791558A3B), ref: 00007FF7915586C4

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF791558A3B), ref: 00007FF791582520

Strings

secur32.dll, xrefs: 00007FF7915824F3
security.dll, xrefs: 00007FF7915824FA
InitSecurityInterfaceA, xrefs: 00007FF791582516

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 12e6e9e73077aa2a7666adcfea8b6f5d0d830d8a478b057c344a7f6495247157
Instruction ID: b00875ba261321a3589a49291b2e8b4a64d0983ff14a0c3fa84ae4d605ebc05d
Opcode Fuzzy Hash: 12e6e9e73077aa2a7666adcfea8b6f5d0d830d8a478b057c344a7f6495247157
Instruction Fuzzy Hash: CEF019A0E49A0241EF34BB25A8A1770A690AF15754FCA5434C40D467B0EEFCA1B9C361

Function 00007FF79154797B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF791547386

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: bf286e0b73a6494ad10689257a95318e8ba2473458c6853e381d0df7356fe23f
Instruction ID: 951fe397d84c6832ad941a96adc7cbc6a96718fc10587bb13053cabb9c0a47f2
Opcode Fuzzy Hash: bf286e0b73a6494ad10689257a95318e8ba2473458c6853e381d0df7356fe23f
Instruction Fuzzy Hash: 1EB19431A0864285FB74AE79945437DA3A1EF41B88FE65436DE0E472F9DFB8E460C360

Function 00007FF791561320 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561420

Part of subcall function 00007FF7915619B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A0A

Part of subcall function 00007FF791561760: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915617F8
Part of subcall function 00007FF791561760: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561801

Strings

TCP4, xrefs: 00007FF7915613BA
TCP6, xrefs: 00007FF7915613A7
PROXY %s %s %s %li %li, xrefs: 00007FF7915613F4

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 668fe629a6c5635f8bcc055ccf6d4ab737424927742c2c5532dfbb9c0fb4f5a2
Instruction ID: 4020add08da4500c1e8d747f21448701589b312215ca1dcafc2fe5690bc23efe
Opcode Fuzzy Hash: 668fe629a6c5635f8bcc055ccf6d4ab737424927742c2c5532dfbb9c0fb4f5a2
Instruction Fuzzy Hash: D841CB31A0CA8246E770EB75A4403BDB7A1AFC53C4FD54032DA4D876A9DEBCD414C760

Function 00007FF791545C10 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF791541C46,?,?,?,?,00000000,?,00007FF79153375E), ref: 00007FF791545C2D
closesocket.WS2_32 ref: 00007FF791545D39
closesocket.WS2_32 ref: 00007FF791545D46

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 09ff459787c39bcac5a193e56dccf02f8fcae5eab16e60d055e2f91dbe07d781
Instruction ID: 5b72422d4528cc2dfb1ab7f79d64036da5379883f5f3054ac40f54fc9f088c63
Opcode Fuzzy Hash: 09ff459787c39bcac5a193e56dccf02f8fcae5eab16e60d055e2f91dbe07d781
Instruction Fuzzy Hash: FF41A432A18A4281E760FF31D4502E9A361FF84764FDA4231EE5D472E6EFBCD5558320

Function 00007FF791569AD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF791569C13
SSL/TLS connection timeout, xrefs: 00007FF791569C2C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 794b31f334c449281c11ab67f53f58ecb1c6e5dddef2efe126c2f8c9882ce586
Instruction ID: 25bca8945e0e31f053e68f52d19e58bfbb06f157006fa27f97c0cd50bcbae3d6
Opcode Fuzzy Hash: 794b31f334c449281c11ab67f53f58ecb1c6e5dddef2efe126c2f8c9882ce586
Instruction Fuzzy Hash: 6C518331A0CA8689FB74AB31D540279A791FB547E4FD64231DA2D472F8DEBCE461C3A0

Function 00007FF791545E10 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF791546206
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791546227

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: cd816d89feecff3239274105a464d5646439d9ed679fb7c2ede5c68852553d24
Instruction ID: 1052db56fcea113d10a995d30260ae0e48ec0a6f18f8a32a9cde3bafaa4fc796
Opcode Fuzzy Hash: cd816d89feecff3239274105a464d5646439d9ed679fb7c2ede5c68852553d24
Instruction Fuzzy Hash: 06C11872A1C68246EB759B3594003BAB3A0FB447A4FE54235DE6E437E4EFBCE8518710

Function 00007FF791551EE0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551F45

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF791552084
User-Agent: %s, xrefs: 00007FF791551F56

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: fd4f73bd826b4c077320aa3d596d2b804dab94e412b9ceaa2e6d3a22cfc135d9
Instruction ID: 2eea94f0aa1b946edb950a6422a07f8f66150a537e0a62699f3a40a05f857669
Opcode Fuzzy Hash: fd4f73bd826b4c077320aa3d596d2b804dab94e412b9ceaa2e6d3a22cfc135d9
Instruction Fuzzy Hash: CC51A362A0CAC181E7619F35D4543ADA761EB84B98F8D4131EF5D0B3A9DFBDE4A0C320

Function 00007FF791555D40 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF791555D4C
WSAGetLastError.WS2_32 ref: 00007FF791555D5B

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 0aa2688d59615133f2fe807de81fb86dcc8fb5fa5c2b9f8e0691a090646b3fe9
Instruction ID: d6f630fee0a626805599f3d50fbf4af951443f6cad7fa40cf70e282a5dc435d9
Opcode Fuzzy Hash: 0aa2688d59615133f2fe807de81fb86dcc8fb5fa5c2b9f8e0691a090646b3fe9
Instruction Fuzzy Hash: 64E0DF61F0850543FF2967B0A8A433821909B44772F894734CA3BC63D0EAAC45E24711

Function 00007FF791556620 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF791556663

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: fa1ceb3494bdb5e2b5588c90cedee802df93630bbcbbbbf70f66840aa7ca4111
Instruction ID: c3cbe8cd95042bbceb3345c939547aaaaba46c02455682ba71591428b38bdf15
Opcode Fuzzy Hash: fa1ceb3494bdb5e2b5588c90cedee802df93630bbcbbbbf70f66840aa7ca4111
Instruction Fuzzy Hash: 4D01B92170958181EB64EB3AE19837DA360EF88B84FD98031D70D476E5CF78D4B58711

Function 00007FF79155E140 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF79155E169

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 4d238160c39bfdfa5611c95737f48be4a37f7ccb382ea55052af28b17d8103be
Instruction ID: 06baa404c7ceac828b4f860cb4023af26b43b86cc3506d077f5a1495bb9d6c86
Opcode Fuzzy Hash: 4d238160c39bfdfa5611c95737f48be4a37f7ccb382ea55052af28b17d8103be
Instruction Fuzzy Hash: 95E09B35F0654181DF58773584911B97351AB45734FC54371D53D033E1CE7D91669B10

Function 00007FF791568DA0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791568DBB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: cfbc4027307d02d34c0302ee7ff44f02ab6a9c9a70f40e165d9c6015fd17f9c6
Instruction ID: 738ae044b97a45184ba8bfa1490631a4e4790de4d6eb484595be78f5874cd93c
Opcode Fuzzy Hash: cfbc4027307d02d34c0302ee7ff44f02ab6a9c9a70f40e165d9c6015fd17f9c6
Instruction Fuzzy Hash: 0CD02B63B19A0083DF20DF72A840029E351B788774B884338AE7D827F0DB3CD1554600

Function 00007FF791564CE0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF791564CF9

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 17f50192cd42546436bcc8703bc05093b79cd1f5c006f56d2a4872af3a0c65db
Instruction ID: a253d1b9bc069982cd6eb5708ae8bdc13e4d42e2c4f6005b105d1290a1e46311
Opcode Fuzzy Hash: 17f50192cd42546436bcc8703bc05093b79cd1f5c006f56d2a4872af3a0c65db
Instruction Fuzzy Hash: DEC08026F14581C2D3446F7154C5087A771ABC4214FD55435D24B82134DD3CC2F58B51

Non-executed Functions

Function 00007FF7915628E0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791563AA3

Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C65
Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C80

memchr.VCRUNTIME140 ref: 00007FF791563B96
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791563CAE
strchr.VCRUNTIME140 ref: 00007FF791563CC2
strchr.VCRUNTIME140 ref: 00007FF791563CEA
strchr.VCRUNTIME140 ref: 00007FF791563D00

Strings

RTSP/%1d.%1d%c%3d, xrefs: 00007FF791562C6D
, xrefs: 00007FF791562ACC
Connection:, xrefs: 00007FF7915630AB, 00007FF791563160
HTTP 1.0, assume close after body, xrefs: 00007FF791562D47
false, xrefs: 00007FF791563650
The requested URL returned error: %s, xrefs: 00007FF791563D17
The requested URL returned error: %d, xrefs: 00007FF791563E73
Last-Modified:, xrefs: 00007FF791563517
RTSP/, xrefs: 00007FF7915629D4
Content-Type:, xrefs: 00007FF791562E96
HTTP/%1d.%1d%c%3d, xrefs: 00007FF791562A79
HTTP %3d, xrefs: 00007FF791562B48
Invalid Content-Length: value, xrefs: 00007FF791563D58
WWW-Authenticate:, xrefs: 00007FF791563576
keep-alive, xrefs: 00007FF791562FA6, 00007FF791563136
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF791563896
Overflow Content-Length: value!, xrefs: 00007FF791562E7B
Persistent-Auth, xrefs: 00007FF791563612
HTTP/1.1 proxy connection set close!, xrefs: 00007FF79156328D
Content-Range:, xrefs: 00007FF7915633AE
Got 417 while waiting for a 100, xrefs: 00007FF791563A83
Proxy-authenticate:, xrefs: 00007FF7915635A1
Retry-After:, xrefs: 00007FF791563323
HTTP, xrefs: 00007FF791563C9E
Content-Encoding:, xrefs: 00007FF7915632E1
Location:, xrefs: 00007FF7915636AE
Keep sending data to get tossed away!, xrefs: 00007FF791563B3C
Lying server, not serving HTTP/2, xrefs: 00007FF791562AFC
HTTP error before end of send, keep sending, xrefs: 00007FF791563AC9
Received HTTP/0.9 when not allowed, xrefs: 00007FF791563C0B
HTTP/, xrefs: 00007FF791562BE9
Unsupported HTTP version in response, xrefs: 00007FF791563C81
, xrefs: 00007FF791562C82
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF7915632AB
Received 101, xrefs: 00007FF791563D7B
HTTP/%1[23] %d, xrefs: 00007FF791562AA4
Set-Cookie:, xrefs: 00007FF791563473
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF79156326C
HTTP error before end of send, stop sending, xrefs: 00007FF791563AED
close, xrefs: 00007FF791563073, 00007FF7915631F3
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF79156366C
Mark bundle as not supporting multiuse, xrefs: 00007FF791562B1F
Maximum file size exceeded, xrefs: 00007FF791563D3F
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF7915638EC, 00007FF791563938
Content-Length:, xrefs: 00007FF791562DEF
Transfer-Encoding:, xrefs: 00007FF79156322A
Proxy-Connection:, xrefs: 00007FF791562F13, 00007FF791562FEC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: 5b10492e9d13c9207e1088f14adb912909160a337de8a4a85d45928daba8dc60
Instruction ID: b8fb97b6fe5171a2cc2ff01db3c8ac7e263004bc471ac0af8e95fe0605c08387
Opcode Fuzzy Hash: 5b10492e9d13c9207e1088f14adb912909160a337de8a4a85d45928daba8dc60
Instruction Fuzzy Hash: 95C29F71B08A8685FBB0AB3184543F9A791EF41BD8FCA4135DA4D0B2E5DEBCE465C360

Function 00007FF7915489E0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 728stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF79154A237), ref: 00007FF791548A50
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791548A6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791548AA4
strchr.VCRUNTIME140 ref: 00007FF791548AB7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791548C37
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791548C58
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791548C7B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791548C88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791548D21
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791548D2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791548D42
strchr.VCRUNTIME140 ref: 00007FF791548F2F
strchr.VCRUNTIME140 ref: 00007FF791548F49
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154903C
strchr.VCRUNTIME140 ref: 00007FF791549068
strrchr.VCRUNTIME140 ref: 00007FF79154907A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154909B
memcpy.VCRUNTIME140 ref: 00007FF7915490B4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549128
strchr.VCRUNTIME140 ref: 00007FF79154914B
strchr.VCRUNTIME140 ref: 00007FF791549160

Strings

expires, xrefs: 00007FF791548EC5
Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
localhost, xrefs: 00007FF791548D8F
TRUE, xrefs: 00007FF791549197
#HttpOnly_, xrefs: 00007FF79154911E
max-age, xrefs: 00007FF791548E98
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667
__Secure-, xrefs: 00007FF791548C30
domain, xrefs: 00007FF791548D61
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF791548E4E
version, xrefs: 00007FF791548E6B
secure, xrefs: 00007FF791548CAE
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF791548FBF
FALSE, xrefs: 00007FF79154919E, 00007FF79154939B
%4095[^;=] =%4095[^;], xrefs: 00007FF791548AF6
__Host-, xrefs: 00007FF791548C51
httponly, xrefs: 00007FF791548CE6
path, xrefs: 00007FF791548D0D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: 13625babc66ce8b67016afff6feda551413290e79ca40fbb8271c466a71a9eab
Instruction ID: 9eda508247fc3b4e552b49fdf86432e2e9bf6f1a6466c69da863c57d290410a8
Opcode Fuzzy Hash: 13625babc66ce8b67016afff6feda551413290e79ca40fbb8271c466a71a9eab
Instruction Fuzzy Hash: 9B729221A0878285FB71AB76D4413B9E7A1EF49794FE64131CA8E026F5DFBCE465C320

Function 00007FF79157D270 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C65
Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C80

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157D2FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157D332
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157D33C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157D359
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157D36C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157D375
#22.WLDAP32 ref: 00007FF79157D386
#211.WLDAP32 ref: 00007FF79157D420
#217.WLDAP32 ref: 00007FF79157D43C
#211.WLDAP32 ref: 00007FF79157D455
#211.WLDAP32 ref: 00007FF79157D467
#60.WLDAP32 ref: 00007FF79157D497
#211.WLDAP32 ref: 00007FF79157D5B2
#60.WLDAP32 ref: 00007FF79157D5D7
#22.WLDAP32 ref: 00007FF79157D67A
#41.WLDAP32 ref: 00007FF79157DA96
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157DABE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157DAC8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157DAE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157DAFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157DB04
#46.WLDAP32 ref: 00007FF79157DB16

Strings

Microsoft Corporation., xrefs: 00007FF79157D290
LDAP remote: %s, xrefs: 00007FF79157D6F7
LDAP local: trying to establish %s connection, xrefs: 00007FF79157D3B9
;binary, xrefs: 00007FF79157D900
There are more than %d entries, xrefs: 00007FF79157DAA6
encrypted, xrefs: 00007FF79157D3CE
DN: , xrefs: 00007FF79157D772
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF79157D2A4
LDAP local: %s, xrefs: 00007FF79157D2E7
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF79157D4BB
cleartext, xrefs: 00007FF79157D3AF
LDAP local: %s, xrefs: 00007FF79157D38C
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF79157D684

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: a5ed48b24d81f4e908d087d24bba8ba3817cdfdc58985adb09e109c54026b3de
Instruction ID: 4ee65752b31af1480450cd3f6170ebbbd26544c4f1e431016ead80e45b67adca
Opcode Fuzzy Hash: a5ed48b24d81f4e908d087d24bba8ba3817cdfdc58985adb09e109c54026b3de
Instruction Fuzzy Hash: FD427075B08B4286EB20AF72D4552B9A3A1FB48B98FC24131DE0E57764DFBCE565C320

Function 00007FF7915395AD Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 978COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF791539FAD
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF791539FB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A094
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A0C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A0D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A10B

Strings

array, xrefs: 00007FF79153A1CA
object key, xrefs: 00007FF791539E3F, 00007FF79153A679
number overflow parsing ', xrefs: 00007FF791539FD0
object separator, xrefs: 00007FF791539CB3, 00007FF79153A4EA
object, xrefs: 00007FF79153A359

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 7938b585ea422cc6f3a6a7add729e8ff58aa22cf9f245d6fb80868b8fc622a11
Instruction ID: 601575cfa05fa489b999c0467a36febb82292a8f2d85cd5b8eca8e4ae01dfe33
Opcode Fuzzy Hash: 7938b585ea422cc6f3a6a7add729e8ff58aa22cf9f245d6fb80868b8fc622a11
Instruction Fuzzy Hash: 23A2B262A18B86C6FB20EB78D4443ADA361FB457A4F814235DA5D47AF9DFBCD092C310

Function 00007FF791579570 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915795BF
WSAStartup.WS2_32 ref: 00007FF791579660
FreeLibrary.KERNEL32 ref: 00007FF79157984D
GetStdHandle.KERNEL32 ref: 00007FF79157985C
GetFileType.KERNEL32 ref: 00007FF79157987D
WaitForMultipleObjects.KERNEL32 ref: 00007FF7915798C7
PeekNamedPipe.KERNEL32 ref: 00007FF79157994C
ReadFile.KERNEL32 ref: 00007FF791579973
ReadFile.KERNEL32 ref: 00007FF791579A2D
WSAGetLastError.WS2_32 ref: 00007FF791579A8E
WSAGetLastError.WS2_32 ref: 00007FF791579C8A
FreeLibrary.KERNEL32 ref: 00007FF791579CAA
GetLastError.KERNEL32 ref: 00007FF791579CB4

Part of subcall function 00007FF79157A4E0: send.WS2_32 ref: 00007FF79157A51D
Part of subcall function 00007FF79157A4E0: WSAGetLastError.WS2_32 ref: 00007FF79157A527

Strings

insufficient winsock version to support telnet, xrefs: 00007FF791579CEF
failed to find WSAEventSelect function (%u), xrefs: 00007FF791579787
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF791579CBA
WSACloseEvent failed (%d), xrefs: 00007FF791579C90
WSACreateEvent, xrefs: 00007FF7915796F5
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF7915797B0
WSACreateEvent failed (%d), xrefs: 00007FF7915797CE
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF791579AA2
failed to find WSACreateEvent function (%u), xrefs: 00007FF791579713
Time-out, xrefs: 00007FF791579C67
WSAEventSelect, xrefs: 00007FF791579761
failed to find WSACloseEvent function (%u), xrefs: 00007FF79157973C
WSAEnumNetworkEvents, xrefs: 00007FF791579790
WSAStartup failed (%d), xrefs: 00007FF79157966D
failed to load WS2_32.DLL (%u), xrefs: 00007FF7915796DB
WSACloseEvent, xrefs: 00007FF79157971C
WS2_32.DLL, xrefs: 00007FF7915796AE
, xrefs: 00007FF791579C52

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: 550f2c67cbf4eacfeb1f291bfb3308f574507ad6f4b237ccfdc5e5a888c2ce55
Instruction ID: f166369e1dc40951334891d93d61660e25d03fca595b2a3ec1c62002676cfc9c
Opcode Fuzzy Hash: 550f2c67cbf4eacfeb1f291bfb3308f574507ad6f4b237ccfdc5e5a888c2ce55
Instruction Fuzzy Hash: 8C128D71A0868281FB74AF35D4453B9A3A0FB45BA4FC64135DA4E477A8DFBCE260C721

Function 00007FF79153AC4D Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 930COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153B5E4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153B612
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153B620
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153B65A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153B6B7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153B770
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153B79E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153B7AC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153B7E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153B843

Part of subcall function 00007FF79153F000: memcmp.VCRUNTIME140 ref: 00007FF79153F08D
Part of subcall function 00007FF79153F000: memcmp.VCRUNTIME140 ref: 00007FF79153F111

Strings

array, xrefs: 00007FF79153BA59
object key, xrefs: 00007FF79153B6DC, 00007FF79153BF08
number overflow parsing ', xrefs: 00007FF79153B85F
object separator, xrefs: 00007FF79153B550, 00007FF79153BD79
object, xrefs: 00007FF79153BBE8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: b6405eb53252c832b477e2a874fc3f5117e1c1e6332d5424c1ae42ea86489818
Instruction ID: e6e553caadde70c2034c6fbab5a1d26475b2b790d5ab14156fc349234a8d1e97
Opcode Fuzzy Hash: b6405eb53252c832b477e2a874fc3f5117e1c1e6332d5424c1ae42ea86489818
Instruction Fuzzy Hash: 0492D562A18B85C6EB20EB78D4443ADA361FB457A4F814331EA6D47AF9DFBCD191C310

Function 00007FF791585B20 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF791585C8F
GetLastError.KERNEL32 ref: 00007FF791585CA2
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF791585D54
GetLastError.KERNEL32 ref: 00007FF791585D5E
CertGetCertificateChain.CRYPT32 ref: 00007FF791585DEB
GetLastError.KERNEL32 ref: 00007FF791585DF5
CertGetNameStringA.CRYPT32 ref: 00007FF791585F63
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF7915863DB
CertCloseStore.CRYPT32 ref: 00007FF7915863F0
CertFreeCertificateChain.CRYPT32 ref: 00007FF791586400
CertFreeCertificateContext.CRYPT32 ref: 00007FF791586410

Strings

schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF791585E0F
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF791585E8C
schannel: failed to create certificate store: %s, xrefs: 00007FF791585CBC
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF791585EA2
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF79158638D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF791585E75
schannel: Not enough memory to list all host names., xrefs: 00007FF79158628C
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF791585E5D
schannel: failed to create certificate chain user: %s, xrefs: 00007FF791585D78
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF791585ECA
2.5.29.17, xrefs: 00007FF791585FC3, 00007FF791585FF4, 00007FF79158615F, 00007FF79158619B
schannel: Empty DNS name., xrefs: 00007FF79158606A, 00007FF791586218
schannel: Null certificate info., xrefs: 00007FF791585FB3, 00007FF791586144
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF791585C61
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF791585EB9
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF791586309
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF7915860AD
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF79158602E, 00007FF7915861D5
schannel: CertFindExtension() returned no extension., xrefs: 00007FF791585FDB, 00007FF791586177
schannel: Null certificate context., xrefs: 00007FF791585F78, 00007FF791586127
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF7915862A3
schannel: server certificate name verification failed, xrefs: 00007FF79158634E
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF791586319
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF791586366

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$userStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain user: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: 3a24102a71b2336525493ae6322cc3c9751243c14857b0a6db1e5b77c088f834
Instruction ID: 6bac6f788b03354b5f43574af4a0046025ff4d9a5968915be2f1494ced81e022
Opcode Fuzzy Hash: 3a24102a71b2336525493ae6322cc3c9751243c14857b0a6db1e5b77c088f834
Instruction Fuzzy Hash: D042AF72A18B4281EB30AB35E4402BDB7A1FB44B94FD24175DA5E07BA4DFBCE564C720

Function 00007FF791574A40 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791574B21
getsockname.WS2_32 ref: 00007FF791574D1A
WSAGetLastError.WS2_32 ref: 00007FF791574D24
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157525B

Strings

failed to resolve the address provided to PORT: %s, xrefs: 00007FF791575249
bind(port=%hu) failed: %s, xrefs: 00007FF791574F85
socket failure: %s, xrefs: 00007FF791574E1F, 00007FF791575026
PORT, xrefs: 00007FF791575162
%s |%d|%s|%hu|, xrefs: 00007FF7915751E9
Failure sending PORT command: %s, xrefs: 00007FF79157518C
%s %s, xrefs: 00007FF791575169
Failure sending EPRT command: %s, xrefs: 00007FF79157520F
EPRT, xrefs: 00007FF7915751D2
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF791574EB4
,%d,%d, xrefs: 00007FF791575139
bind() failed, we ran out of ports!, xrefs: 00007FF791574F16
getsockname() failed: %s, xrefs: 00007FF791574D3E, 00007FF791574F4E

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: bc7f489ceed5bebf9c9863e670abb60b4cf958572d0b222b88b322ebab1f6a85
Instruction ID: abe9b653ae9ff6dfd064943a97f62d6b0ebf2121b2f8da36621bc8a763effff7
Opcode Fuzzy Hash: bc7f489ceed5bebf9c9863e670abb60b4cf958572d0b222b88b322ebab1f6a85
Instruction Fuzzy Hash: 7322F861A1C79282EB71BB31E4512BEA3A1FB45784FC64031EA4E477A5DFBCE614C720

Function 00007FF79154F130 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F196
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F1BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F218

Strings

-----BEGIN PUBLIC KEY-----, xrefs: 00007FF79154F3EA
-----END PUBLIC KEY-----, xrefs: 00007FF79154F41E
;sha256//, xrefs: 00007FF79154F290
public key hash: sha256//%s, xrefs: 00007FF79154F22E
sha256//, xrefs: 00007FF79154F18C, 00007FF79154F2DE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 5718b6b6f752219127d3f7c3aef787116c5d1319bd537024bb3abce0b2116589
Instruction ID: 6dbbf7f15ac5d028f910fac7aa47a13411fd12ccc11fcc38ac18fa5b88122270
Opcode Fuzzy Hash: 5718b6b6f752219127d3f7c3aef787116c5d1319bd537024bb3abce0b2116589
Instruction Fuzzy Hash: 0BA19321B0975282FB71AB3E9854279A690AF45BD0FDA4032DD0E077F5EEBCE4658321

Function 00007FF791586440 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF791586486

Part of subcall function 00007FF791542690: GetLastError.KERNEL32 ref: 00007FF7915426AC
Part of subcall function 00007FF791542690: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915426B4

CreateFileA.KERNEL32 ref: 00007FF7915864E0
GetLastError.KERNEL32 ref: 00007FF7915864F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158682D

Strings

schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF791586589
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF791586730
schannel: failed to open CA file '%s': %s, xrefs: 00007FF79158650B
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF791586785
-----BEGIN CERTIFICATE-----, xrefs: 00007FF79158662E
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF791586552
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7915867D1
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7915867F2
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7915867B5
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7915864A0
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF791586766
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF791586803
-----END CERTIFICATE-----, xrefs: 00007FF791586659

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: ac78859fa66405f88d6f75566aaaa946de7ed8a9283dd0255f9ad792d3f6f640
Instruction ID: bfb58853df0f1164038780102104d8a471a0b6fccb3337693939f0ebb75a5acd
Opcode Fuzzy Hash: ac78859fa66405f88d6f75566aaaa946de7ed8a9283dd0255f9ad792d3f6f640
Instruction Fuzzy Hash: 66B1D261B1875282EB30BB36E4402A9A3A1BF44B94FC24175DE4D47BB4DFBCE524CB60

Function 00007FF791553380 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7915533DA
memset.VCRUNTIME140 ref: 00007FF7915533EF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155340B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791553432
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915534A9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915534DC
strchr.VCRUNTIME140 ref: 00007FF7915535C6
strchr.VCRUNTIME140 ref: 00007FF79155360B
strchr.VCRUNTIME140 ref: 00007FF79155363B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915536E3

Part of subcall function 00007FF79156BF90: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156BFB8
Part of subcall function 00007FF79156BF90: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156BFDE
Part of subcall function 00007FF79156BF90: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156BFFF
Part of subcall function 00007FF79156BF90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156C010

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915537B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915537E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155380B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553845
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553857
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915539FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553A03

Strings

http_proxy, xrefs: 00007FF79155372D
Uses proxy env variable %s == '%s', xrefs: 00007FF79155353C, 00007FF79155379A
no_proxy, xrefs: 00007FF791553501
ALL_PROXY, xrefs: 00007FF791553780
all_proxy, xrefs: 00007FF791553769
_proxy, xrefs: 00007FF7915536F9
memory shortage, xrefs: 00007FF7915534B7
NO_PROXY, xrefs: 00007FF79155351D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 63f72fa3398d8ceef60335f8fa278a53e7f9e04807cccb105859d0ec52c817d2
Instruction ID: ac5585cace535f93e75847a3be454aea10e77ce522bf9ce68785088d79864376
Opcode Fuzzy Hash: 63f72fa3398d8ceef60335f8fa278a53e7f9e04807cccb105859d0ec52c817d2
Instruction Fuzzy Hash: 86027361B0D78185EBB1EB31A4643B9E7A4EF45788F8A0035EA4D077A5DFBCE464C720

Function 00007FF791581600 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915816B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581771
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158177F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581791

Strings

digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF7915819AB
realm, xrefs: 00007FF791581917
WDigest, xrefs: 00007FF791581641, 00007FF791581A75

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: bedccf1a70ff9c3f2b5c259966900d26fbe34891b2c4630689b9baf8c93e7900
Instruction ID: 350a9cff08847406ff0d3e15aecd8fe8b488352c63219c250390c8665323e66f
Opcode Fuzzy Hash: bedccf1a70ff9c3f2b5c259966900d26fbe34891b2c4630689b9baf8c93e7900
Instruction Fuzzy Hash: E9125232A08B4589EB20EF31D4946B9B7A4FB44B88F860075DE8E83B64DF7CD565C750

Function 00007FF791557680 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF791557752
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155776D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915577AC

Strings

Couldn't bind to interface '%s', xrefs: 00007FF7915578F0
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF791557978
getsockname() failed with errno %d: %s, xrefs: 00007FF791557AFC
Local port: %hu, xrefs: 00007FF791557B55
Bind to local port %hu failed, trying next, xrefs: 00007FF791557A60
Couldn't bind to '%s', xrefs: 00007FF791557842
Local Interface %s is ip %s using address family %i, xrefs: 00007FF791557867
bind failed with errno %d: %s, xrefs: 00007FF791557B38

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: a009f355f28fcdbed4830991bce268b31999afd17b13938416f8c2b76571fec4
Instruction ID: 477cd732e688823d738e4e83d6fb09e7b75efda6a5ec8ad88c9c786ae1b81b0a
Opcode Fuzzy Hash: a009f355f28fcdbed4830991bce268b31999afd17b13938416f8c2b76571fec4
Instruction Fuzzy Hash: 29E10522E1879285EB20EB35E4602B9A360FB89798FC25135EE4E43775DFBCE560C710

Function 00007FF79153978B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF791539FB4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A094
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A0C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A0D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A10B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A14A

Strings

array, xrefs: 00007FF79153A1CA
number overflow parsing ', xrefs: 00007FF791539FD0
object, xrefs: 00007FF79153A359

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 1a1b3e7b08e8a81959f7a818605a5613a4a02452d5d215884fc2aa604402ac4f
Instruction ID: 11b9a7c2c7d99005d4e0ed0ae3c38ee3a032f5df36292e318029755b0060c650
Opcode Fuzzy Hash: 1a1b3e7b08e8a81959f7a818605a5613a4a02452d5d215884fc2aa604402ac4f
Instruction Fuzzy Hash: 7732C262A18B86C5EF20EB78D4443EDA361FB457A4F814231DA5D47AE9DFBCE192C310

Function 00007FF7915805D0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF791580663
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79158068D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791580752
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79158075E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915807C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915807CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915808D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915808DF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7915808EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158093F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158095E

Strings

machine, xrefs: 00007FF791580821, 00007FF791580862
, xrefs: 00007FF7915806A1, 00007FF7915808A2
default, xrefs: 00007FF79158087D
login, xrefs: 00007FF7915807EE
password, xrefs: 00007FF791580809

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 472ef1703f35c10f5f2dbf96da624fa7af97885e13d21ee44607018ada29ea5b
Instruction ID: e0c0c21c4c1443c037ec5bba8ef6bcaf4713c8b80e177abba413e2265c260d8d
Opcode Fuzzy Hash: 472ef1703f35c10f5f2dbf96da624fa7af97885e13d21ee44607018ada29ea5b
Instruction Fuzzy Hash: 41A1BB21A1D68287FB71BF31955037AE690BF84794FCA0075DE4D46AB4EFBCE4A48720

Function 00007FF791567D10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567F8E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567F96
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF791567FAC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567FB5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567FBD
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567FC7

Strings

%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF791567DCE
%02d:%02d%n, xrefs: 00007FF791567F6D
GMT, xrefs: 00007FF791567E87
%02d:%02d:%02d%n, xrefs: 00007FF791567F39

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: 668185a7090efd165fcdfc5cb0ff828d1f3255aaee98c408e1fb7102ef338266
Instruction ID: 484ddf050b5eefff7bf4a93cb73239a41350b6903b96638a433b179cd045c12b
Opcode Fuzzy Hash: 668185a7090efd165fcdfc5cb0ff828d1f3255aaee98c408e1fb7102ef338266
Instruction Fuzzy Hash: 83F1D772F14A118AEB34EB74C8001BCB7A1BB54798F914236DE1E577F4DEB8A8258790

Function 00007FF791569350 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF791569390
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF7915693AF
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF7915693D9
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF7915693F1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF791569416
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF791569442
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF791569452
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF791569319), ref: 00007FF791569464

Strings

@, xrefs: 00007FF7915693A5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: 67306df46e49f998d9e297aeff22ced6ffcf112999a3d86a2419870b5b05507d
Instruction ID: 84465dc32133056880241789f23f3a88a006234dc9851dd48dfbcba34d65b143
Opcode Fuzzy Hash: 67306df46e49f998d9e297aeff22ced6ffcf112999a3d86a2419870b5b05507d
Instruction Fuzzy Hash: 79318D32708A8186EB60DF21E484A6AB764FBC4BD0F854131EE8E53B28DF7CD4258B50

Function 00007FF791542690 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7915426AC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915426B4
FormatMessageA.KERNEL32 ref: 00007FF7915426EE
strchr.VCRUNTIME140 ref: 00007FF791542703
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154274C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791542756
GetLastError.KERNEL32 ref: 00007FF79154275E
SetLastError.KERNEL32 ref: 00007FF79154276A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF79154273A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: b2cd3c313b156e4dadc1f13d62458ab67304cc37dc745d7a934235903b4d774f
Instruction ID: 1864e364e4d902c4c43928cbf7e07e80da5a7413498869618d9985a614c6f661
Opcode Fuzzy Hash: b2cd3c313b156e4dadc1f13d62458ab67304cc37dc745d7a934235903b4d774f
Instruction Fuzzy Hash: BD214162A0C79186EB31AF32B40422ABA90BF44BD0FDA4534DA4A537B5CFBCD461C661

Function 00007FF791550650 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

serially, xrefs: 00007FF79155075E
Found bundle for host %s: %p [%s], xrefs: 00007FF791550769
Server doesn't support multiplex (yet), xrefs: 00007FF7915507BF
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF791550F1A
Could multiplex, but not asked to!, xrefs: 00007FF7915507EC
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF791550891
Can not multiplex, even if we wanted to!, xrefs: 00007FF79155080A
can multiplex, xrefs: 00007FF791550752
Multiplexed connection found!, xrefs: 00007FF791550EC1
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF7915508B6
Server doesn't support multiplex yet, wait, xrefs: 00007FF79155079B

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 93af53c4d5fbc85e99a08436875279f0cb014a5722ddeba43d349e832a4efbe2
Instruction ID: 3084d251ab0719b02b86e0817dd0c26862f12b9e0636fecfdede270d178452ff
Opcode Fuzzy Hash: 93af53c4d5fbc85e99a08436875279f0cb014a5722ddeba43d349e832a4efbe2
Instruction Fuzzy Hash: F342D762A0C7C24AEF75AA3581703B9B791EB43744F9A4035EE5D072A5DFBCA870D720

Function 00007FF79156C620 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF79156C618,?,?,?,?,?,?,00007FF79158385E), ref: 00007FF79156C696
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF79156C618,?,?,?,?,?,?,00007FF79158385E), ref: 00007FF79156C7FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79156C95C

Strings

%c%c%c%c, xrefs: 00007FF79156C753
%c%c==, xrefs: 00007FF79156C7C3
%c%c%c=, xrefs: 00007FF79156C791

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: c4fc4088351705819caa032675a141e4bac6c062f06e1160b91af0015c5f2b01
Instruction ID: 428e1dd1afd2b922e96675d17bb83bdc999f19d24339772ff56e4fc5fd89d6ed
Opcode Fuzzy Hash: c4fc4088351705819caa032675a141e4bac6c062f06e1160b91af0015c5f2b01
Instruction Fuzzy Hash: 4691F532908AD185E731AB35A4003BAEBA0EB457E4F894235DAAD477E6CF7DD411C750

Function 00007FF79157B7A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157B7EF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157B84C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157B870
bind.WS2_32 ref: 00007FF79157B8EB
WSAGetLastError.WS2_32 ref: 00007FF79157B8F5

Strings

bind() failed; %s, xrefs: 00007FF79157B910

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 1f7ad452108c972423b21787ed8b4d38d2cdafae232374323f13c919f82a3405
Instruction ID: 9705a909f6407b3bcdbba543b0a008559d79a08584f874139de6d6fdf0ff6abc
Opcode Fuzzy Hash: 1f7ad452108c972423b21787ed8b4d38d2cdafae232374323f13c919f82a3405
Instruction Fuzzy Hash: A151C032A08B8686EB34AF31D4513B9B2A0FB48B84F854035DA5D477A5EFBCE5718360

Function 00007FF79157B54D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 125networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157B5BE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157B61B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157B643
bind.WS2_32 ref: 00007FF79157B6C2
WSAGetLastError.WS2_32 ref: 00007FF79157B6CC

Strings

bind() failed; %s, xrefs: 00007FF79157B6E7

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 3a03a8b82e15973fec8229579a3ff0e8406018c67cfd6d32475717b64ebbb72d
Instruction ID: bb708388ea4df82a0f25b6380c369c1f05b44c840852f9f1a6bcdbf764b4433a
Opcode Fuzzy Hash: 3a03a8b82e15973fec8229579a3ff0e8406018c67cfd6d32475717b64ebbb72d
Instruction Fuzzy Hash: 4B51B372A0878586FB24AB35D4553ACA7A0FB48B84F894039CB4D47791EFBCE5728721

Function 00007FF791565430 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dM, xrefs: 00007FF7915654CC
%4I64dk, xrefs: 00007FF79156545E
%4I64dG, xrefs: 00007FF791565524
%2I64d.%0I64dM, xrefs: 00007FF791565479
%4I64dT, xrefs: 00007FF791565540
%5I64d, xrefs: 00007FF791565445
%4I64dP, xrefs: 00007FF79156554D
%2I64d.%0I64dG, xrefs: 00007FF7915654EA

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 1af1bb0d0e0d98739592db4711d353d8e8562c20c4bb7a1eb49d8873c58bd183
Instruction ID: d1bb993e24961f1e773359e2ea1031dea2cad0b3cfdd55d43eef3d2e0b2aee66
Opcode Fuzzy Hash: 1af1bb0d0e0d98739592db4711d353d8e8562c20c4bb7a1eb49d8873c58bd183
Instruction Fuzzy Hash: D121A1D1E69D4A87FF34E7B9E4187F582229B547C0EC60532E80E063B1DEEC6579C2A1

Function 00007FF791590138 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF7915318C0), ref: 00007FF79159014E
GetLastError.KERNEL32 ref: 00007FF791590199
IsDebuggerPresent.KERNEL32 ref: 00007FF7915901B1
OutputDebugStringW.KERNEL32 ref: 00007FF7915901C2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7915901BB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: c1f79a6cffa7702fddec966376d19884062fa61c452987c0d8b36de73eef2cfc
Instruction ID: c090a09db6b948dcff56177baa90f0f849d0596802d38774c5f1fe751ff5ea4d
Opcode Fuzzy Hash: c1f79a6cffa7702fddec966376d19884062fa61c452987c0d8b36de73eef2cfc
Instruction Fuzzy Hash: 63118F32A14B92A3E764AB32DA44379B2A4FF04751FC14539C64D82A60EFBCE474C721

Function 00007FF791569280 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7915692B1
CryptGenRandom.ADVAPI32 ref: 00007FF7915692C5
CryptReleaseContext.ADVAPI32 ref: 00007FF7915692D6
CryptReleaseContext.ADVAPI32 ref: 00007FF7915692EC

Strings

@, xrefs: 00007FF791569299

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 69f15f9a9a7c8eed39e0ad55252fea188c9025dac10a69dddba328bd9e155241
Instruction ID: 17ff108d0b4c14822f1297384ca04a963f8551e27f057e6ad3986d476b470e05
Opcode Fuzzy Hash: 69f15f9a9a7c8eed39e0ad55252fea188c9025dac10a69dddba328bd9e155241
Instruction Fuzzy Hash: 38F08661B08A8182EB209B71F444326E760EFC8BE4F854031DE8D86678DFBDC0958710

Function 00007FF791559890 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

.%ld, xrefs: 00007FF791559BF9
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF7915598D3, 00007FF791559DA4, 00007FF791559E0B
%ld, xrefs: 00007FF791559BA0
(nil), xrefs: 00007FF79155A0F6
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF791559DAB, 00007FF791559E16
(nil), xrefs: 00007FF79155A074

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: e2543ab63c006391ad31cdf878f6cac353a24e61942cf3d8081366c01b72d374
Instruction ID: 7c3b6e7ab1f599594583a988dfbcc82767b77d909675dc317379b7d167e50e69
Opcode Fuzzy Hash: e2543ab63c006391ad31cdf878f6cac353a24e61942cf3d8081366c01b72d374
Instruction Fuzzy Hash: 88422732A0CA8345E7357A389560379E791FF80794FD24230EE5E476E8DFBCE9618620

Function 00007FF79156C270 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF79156C2A0
CryptGetHashParam.ADVAPI32 ref: 00007FF79156C2C6
CryptDestroyHash.ADVAPI32 ref: 00007FF79156C2D5
CryptReleaseContext.ADVAPI32 ref: 00007FF79156C2E5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: a46e2648ee86e2c0f37e498fedcf08a1eab206583e9d07077b8b6bb761982f86
Instruction ID: 69baabab37fe4919bd9335e7b68bb0f550d3fb6d4d253e4539a8fda7aba07b26
Opcode Fuzzy Hash: a46e2648ee86e2c0f37e498fedcf08a1eab206583e9d07077b8b6bb761982f86
Instruction Fuzzy Hash: 3D017136609A8182EB20DF70E45432AF330FB85BD8F944531DA9E46A68CF7ED458CB50

Function 00007FF79156C210 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF79156C22C
CryptCreateHash.ADVAPI32 ref: 00007FF79156C24D

Strings

@, xrefs: 00007FF79156C21C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d52e61fd25a7f916a7c5133771f9c384b00007c652c18fd4c669bfa2446a9d06
Instruction ID: d9b1352c464415ff2e7d4cd8d0667f7d3a8d52eac058822f63230ae1b9c013c7
Opcode Fuzzy Hash: d52e61fd25a7f916a7c5133771f9c384b00007c652c18fd4c669bfa2446a9d06
Instruction Fuzzy Hash: 36E0D861B1469243F7305B71E401B16A350FB84788FC58030CE8C4BA28DF7DC0618B14

Function 00007FF791578B50 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF791578B8B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791578BBF

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 894d725f8ee9e73b7dadf653a1e1c9b1c15954cc7323a323571c3c5b5ae29e7b
Instruction ID: be006d704ae8b3b3c2e3a02e577c6151d3eb77429a347fd55d48aa7c677db22b
Opcode Fuzzy Hash: 894d725f8ee9e73b7dadf653a1e1c9b1c15954cc7323a323571c3c5b5ae29e7b
Instruction Fuzzy Hash: B6117C26A247D0CAD304CF35E4401AD77B0FB5CB88F44962AFB8987B18EB78D6A0C745

Function 00007FF79153D2A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction ID: 7003c8a70c7b014fc105ebf1f9820d0bbf5dec161cf0e3ddac4f2f79c91ae324
Opcode Fuzzy Hash: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction Fuzzy Hash: 67611662B09B8482DB20EB29E4442B9A3B1FB597D4F928235DF5D47798EF7CE452C310

Function 00007FF79156C260 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5c030e877256e00af56ed4cc02a429cec546e0181575966b7d8f1db798952c
Instruction ID: cab09ebc68f535b48bfbfa621617cf76abbfe8c6871e1f8449aebc9578f6d1c6
Opcode Fuzzy Hash: cc5c030e877256e00af56ed4cc02a429cec546e0181575966b7d8f1db798952c
Instruction Fuzzy Hash: 48A02431F05C45C0D3104710F1D0D105350F7CC7343C14031C40D45430CD35D041C300

Function 00007FF791569480 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 425stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7915694B3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791569503
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791569524
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79156953A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791569558
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791569576
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791569594
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915695AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915695C4

Strings

CALG_SHA1, xrefs: 00007FF7915695A5
CALG_AES_192, xrefs: 00007FF79156997D
CALG_ECDH, xrefs: 00007FF791569A2E
CALG_TEK, xrefs: 00007FF7915697BB
CALG_SHA_384, xrefs: 00007FF7915699F5
CALG_NO_SIGN, xrefs: 00007FF791569617
CALG_MD5, xrefs: 00007FF79156956F
CALG_ECMQV, xrefs: 00007FF791569A49
CALG_PCT1_MASTER, xrefs: 00007FF79156988D
CALG_AGREEDKEY_ANY, xrefs: 00007FF791569761
CALG_RC5, xrefs: 00007FF7915698E7
CALG_SSL3_MASTER, xrefs: 00007FF791569815
CALG_DH_EPHEM, xrefs: 00007FF791569743
CALG_TLS1_MASTER, xrefs: 00007FF7915698C9
CALG_RC4, xrefs: 00007FF7915696E9
CALG_AES_256, xrefs: 00007FF79156999B
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF791569833
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF79156986F
CALG_SEAL, xrefs: 00007FF791569707
CALG_DES, xrefs: 00007FF791569653
CALG_3DES_112, xrefs: 00007FF791569671
CALG_SHA_256, xrefs: 00007FF7915699D7
CALG_SKIPJACK, xrefs: 00007FF79156979D
CALG_MD2, xrefs: 00007FF791569533
CALG_SSL2_MASTER, xrefs: 00007FF7915698AB
CALG_AES, xrefs: 00007FF7915699B9
CALG_RSA_KEYX, xrefs: 00007FF791569635
CALG_RC2, xrefs: 00007FF7915696CB
CALG_3DES, xrefs: 00007FF79156968F
CALG_DSS_SIGN, xrefs: 00007FF7915695F9
CALG_DESX, xrefs: 00007FF7915696AD
CALG_SHA_512, xrefs: 00007FF791569A13
CALG_HASH_REPLACE_OWF, xrefs: 00007FF791569941
CALG_DH_SF, xrefs: 00007FF791569725
CALG_CYLINK_MEK, xrefs: 00007FF7915697D9
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF791569851
CALG_MAC, xrefs: 00007FF7915695BD
CALG_AES_128, xrefs: 00007FF79156995F
CALG_HUGHES_MD5, xrefs: 00007FF79156977F
CALG_MD4, xrefs: 00007FF791569551
CALG_HMAC, xrefs: 00007FF791569905
CALG_TLS1PRF, xrefs: 00007FF791569923
CALG_ECDSA, xrefs: 00007FF791569A64
CALG_SSL3_SHAMD5, xrefs: 00007FF7915697F7
CALG_SHA, xrefs: 00007FF79156958D
CALG_RSA_SIGN, xrefs: 00007FF7915695DB
CALG_ECDH_EPHEM, xrefs: 00007FF791569A7F

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: 6bcc64522f23e78bcfa6ba4e59cb95d37b9f069fa90228527b8c1784a677c993
Instruction ID: e416dbda5f753b96ae3c6ad9a5c4f54f3e1483a5521eae14ffe50fd5b9413d3b
Opcode Fuzzy Hash: 6bcc64522f23e78bcfa6ba4e59cb95d37b9f069fa90228527b8c1784a677c993
Instruction Fuzzy Hash: A0120B10B1C91799FF70B734D8401BD92A5AF217C8FC64432E90E865B9EEEDE525C3A2

Function 00007FF791554AA0 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79155D800: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF79154587F), ref: 00007FF79155D817

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554C2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554C41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554C55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554C69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554C7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554C91
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554CA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554CB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554CCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554CE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554CF5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D45
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D59

Part of subcall function 00007FF79155EF30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155EF6E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554DA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554DBD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554DD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554DE5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554DF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E35
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E5D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E71

Part of subcall function 00007FF7915528F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791552878), ref: 00007FF79155290B
Part of subcall function 00007FF7915528F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791552878), ref: 00007FF791552939

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554E9B

Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0B1
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0C1
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0CF
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0DD
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0EB
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0F9
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F107
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F115

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554EC7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554EDB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554EEB

Strings

Closing connection %ld, xrefs: 00007FF791554B99

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: 66c61368546927fd1359d02804c66d771c8356d5d4f876d0107812fdc61f390a
Instruction ID: db7692e5a3d354bd4467c31d06826c8d810cc8eea9eeaf5f1707ffc414d9df88
Opcode Fuzzy Hash: 66c61368546927fd1359d02804c66d771c8356d5d4f876d0107812fdc61f390a
Instruction Fuzzy Hash: 54C11135948B8182E750AF31E8502AD7374FB85F99F894131EE9E0B7A9DF78D1A5C320

Function 00007FF791570980 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915709DE
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791570A12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791570A91
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791570AAB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791570ABA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791570B07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791570B18

Strings

Mime-Version, xrefs: 00007FF791570C59
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF791570DAC
SMTPUTF8, xrefs: 00007FF791570D6A
%I64d, xrefs: 00007FF791570CCE
AUTH=, xrefs: 00007FF791570D75
SIZE=, xrefs: 00007FF791570D81
<%s@%s>, xrefs: 00007FF791570A76, 00007FF791570BBA
Mime-Version: 1.0, xrefs: 00007FF791570C74
<%s>, xrefs: 00007FF791570A99, 00007FF791570BDD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 4b1ba4ef0e754902e9302bdf50899b8d13fa6e43f69a0c1b50311882c7b3448f
Instruction ID: 785d323c974c5c7a1d550096a661a6a7e7882736dc4996d68772757d09c45a49
Opcode Fuzzy Hash: 4b1ba4ef0e754902e9302bdf50899b8d13fa6e43f69a0c1b50311882c7b3448f
Instruction Fuzzy Hash: 62D19E21A4975282FF31EB3198516BDA3A4BF46B88FC60131DD4D077A5EFBCA665C320

Function 00007FF791552600 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155261D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552633
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552647
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155265B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155266F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552683
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915526AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915526BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915526D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915526E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915526FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155270F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552723
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552737
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155274B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155275F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552773
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552787
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155279B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915527AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915527C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915527D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915527EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915527FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552813
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552827
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155283B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155284F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791552863

Part of subcall function 00007FF7915528F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791552878), ref: 00007FF79155290B
Part of subcall function 00007FF7915528F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791552878), ref: 00007FF791552939

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155288D

Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0B1
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0C1
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0CF
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0DD
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0EB
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0F9
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F107
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F115

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915528B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915528CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915528DD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c5a734ebc3141eec67d9ddda7a187d959a8a3341b828b34bb7aac0f917821ae4
Instruction ID: 07a2d3850076ef7b51c1d31e59dc136460b437455cbf6de058ba17028f753fbb
Opcode Fuzzy Hash: c5a734ebc3141eec67d9ddda7a187d959a8a3341b828b34bb7aac0f917821ae4
Instruction Fuzzy Hash: 6271CE35588B8181D750AF31E8942BD73B8FB85F99F890135DE8E467289F7891B9C321

Function 00007FF791582C00 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF791582CE9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791582D30
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791582F86
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791582F9D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791582FB8
htons.WS2_32 ref: 00007FF791583017

Strings

CNAME: %s, xrefs: 00007FF791582F13
DOH AAAA: , xrefs: 00007FF791582E32
TTL: %u seconds, xrefs: 00007FF791582DC5
%s%02x%02x, xrefs: 00007FF791582E7E
DOH: %s type %s for %s, xrefs: 00007FF791582D64
DOH Host name: %s, xrefs: 00007FF791582DB1
Could not DOH-resolve: %s, xrefs: 00007FF791582C56
DOH A: %u.%u.%u.%u, xrefs: 00007FF791582DFE
AAAA, xrefs: 00007FF791582D56
%s, xrefs: 00007FF791582ED3
bad error code, xrefs: 00007FF791582D48

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 6d7251bca27c3864009dc5819f83b51b1917a2211a130594af636cb1cef71ed5
Instruction ID: 90d661ba2cb3a7cefcff869be828a38758331ca1c95ce99e855f7b6c91b61cc4
Opcode Fuzzy Hash: 6d7251bca27c3864009dc5819f83b51b1917a2211a130594af636cb1cef71ed5
Instruction Fuzzy Hash: A9E18E32B086868AEB70AF31D4503BAB7A4FB44B84FC64135DA4D47AA4DFBCE565C710

Function 00007FF791539938 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A094
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A0C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A0D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A10B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A14A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AB3E

Strings

array, xrefs: 00007FF79153A1CA
number overflow parsing ', xrefs: 00007FF791539FD0
object, xrefs: 00007FF79153A359

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 7c1e61ec83b13dd7f40079cca3bc6a8e34c64a4870a3b8b424a60f3ed375657d
Instruction ID: 83d443111be84be980bc74c79c7ce20b01c61b596d199d5de9cc64d19dfe3e3a
Opcode Fuzzy Hash: 7c1e61ec83b13dd7f40079cca3bc6a8e34c64a4870a3b8b424a60f3ed375657d
Instruction Fuzzy Hash: F612B362A18B8685FB24EB78D4443ADA361FB457A4F814231DA6D47AF9DFBCD092C310

Function 00007FF79157DB60 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DBE6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DC0C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DC1D
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DC8B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DCBC
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DCDC
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DCEE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DD50
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DDC1
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DDD8
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DE93
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DF07
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79157D31F), ref: 00007FF79157DF10

Strings

one, xrefs: 00007FF79157DDF3
sub, xrefs: 00007FF79157DE44
onetree, xrefs: 00007FF79157DE06
base, xrefs: 00007FF79157DE19
subtree, xrefs: 00007FF79157DE57
LDAP, xrefs: 00007FF79157DBA6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: 91fa15a27f89d16a131c80c7ea3614bffe45f23341aa2a250908849b6735146f
Instruction ID: 3369ba5e4e66e3997bcd44fc840ae16088d94faade4ccb61f1b8ac0981aaf8d2
Opcode Fuzzy Hash: 91fa15a27f89d16a131c80c7ea3614bffe45f23341aa2a250908849b6735146f
Instruction Fuzzy Hash: 22B1B222A09B8286FB71AB359401279B3A4FF48780FC64535DE4D47BA4EFBCE565C720

Function 00007FF7915644D0 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791564647

Strings

%s auth using %s with user '%s', xrefs: 00007FF7915647E6
Digest, xrefs: 00007FF79156454E
Proxy-authorization, xrefs: 00007FF7915645B3
Bearer, xrefs: 00007FF791564640
NTLM, xrefs: 00007FF79156452C
CONNECT, xrefs: 00007FF7915644DE
Proxy-, xrefs: 00007FF791564756
Proxy, xrefs: 00007FF7915647F4
Authorization: Bearer %s, xrefs: 00007FF791564650
Negotiate, xrefs: 00007FF79156450A
Server, xrefs: 00007FF7915647DC
Authorization, xrefs: 00007FF79156468A
%s:%s, xrefs: 00007FF7915646D9
%sAuthorization: Basic %s, xrefs: 00007FF791564760
Basic, xrefs: 00007FF7915647A7
Authorization:, xrefs: 00007FF791564621

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: 9a5dd6769044de479a70182053e2c0233660193c77bad4688d5a90c86bd59f2e
Instruction ID: c9d80064cc09efb75bf8be96969dc6ce02d49fcf64543eab350a9c05d3a6dc16
Opcode Fuzzy Hash: 9a5dd6769044de479a70182053e2c0233660193c77bad4688d5a90c86bd59f2e
Instruction Fuzzy Hash: A9916021A0CA9281FB72AB3594503B9A390AB457D4FD64032DA4C07BB1DFACE876C761

Function 00007FF791536360 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791534360: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391

memcpy.VCRUNTIME140 ref: 00007FF7915364D6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF791536568
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7915365A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915366F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791536732
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791536780
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915367C1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153681E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915368D8

Part of subcall function 00007FF79158F240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79153443E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF79158F25A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791536919
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915369E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791536A27
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF791536A4A

Strings

rsing , xrefs: 00007FF7915364B8
syntax error , xrefs: 00007FF7915363AD
; expected , xrefs: 00007FF791536970
unexpected , xrefs: 00007FF791536863
; last read: ', xrefs: 00007FF79153662C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 884d4d64e130a3a33ebe2cb778bf15f05b6b893c67567ab1d6d0e446da3762d5
Instruction ID: 15b731af1ffc06e4d02b5721b645f166b134aad8e8b6b3f2a4e72280feb73738
Opcode Fuzzy Hash: 884d4d64e130a3a33ebe2cb778bf15f05b6b893c67567ab1d6d0e446da3762d5
Instruction Fuzzy Hash: 8012D262F08A4685FB24AB75E4403ADA761EB447E8FC14335DA6D03BE9DFBCE1958310

Function 00007FF791549A70 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79154A9C0: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF79154A43E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109), ref: 00007FF79154A9E3
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA39
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA43
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA4D
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA57
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA61
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA6B
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA75
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA7F
Part of subcall function 00007FF79154A9C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA88

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549B67
strchr.VCRUNTIME140 ref: 00007FF791549B81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549BAB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549BB8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549BE2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549BF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549C03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549C2A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549C38
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549C53
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549C6F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549C8B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549CA7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549CC3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549CDF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549CFB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549D13
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549DAB
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF791549DE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549E23

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: 42819f0de227d83307235c09ff20fa97e44c3f3a0c70684837e499fa3a50fdd4
Instruction ID: 9f014971d31633531edd767e4cb3bd220f97e2380ca02bcdc00c12785dcd93ff
Opcode Fuzzy Hash: 42819f0de227d83307235c09ff20fa97e44c3f3a0c70684837e499fa3a50fdd4
Instruction Fuzzy Hash: 45B1A425A0AB4245FF75AB329551279A7E0AF49B94F9A0134CE5E037E8DFBCE474C320

Function 00007FF79157E290 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157E2A0
strstr.VCRUNTIME140 ref: 00007FF79157E2CF
strchr.VCRUNTIME140 ref: 00007FF79157E2FB
strrchr.VCRUNTIME140 ref: 00007FF79157E315
strchr.VCRUNTIME140 ref: 00007FF79157E32A
strrchr.VCRUNTIME140 ref: 00007FF79157E38A

Strings

?, xrefs: 00007FF79157E308
/, xrefs: 00007FF79157E3A3
/, xrefs: 00007FF79157E35E
., xrefs: 00007FF79157E36A
/, xrefs: 00007FF79157E2E5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: ccdfae4e3a0ac5480a9ebe09bf72e98d54eb1acbdd30c7ab6d6d7971d1566612
Instruction ID: 15734dcf263d0ed84e2d1b326896f567f88268fa9c0a588fb0bfcf947cb0b006
Opcode Fuzzy Hash: ccdfae4e3a0ac5480a9ebe09bf72e98d54eb1acbdd30c7ab6d6d7971d1566612
Instruction Fuzzy Hash: F981D412A0C38246FB756B359606339DA92EF45784FCA8070CE4D067E2EEBCB5658321

Function 00007FF791579190 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF791579263
strchr.VCRUNTIME140 ref: 00007FF7915792BA
strchr.VCRUNTIME140 ref: 00007FF7915792D2
strchr.VCRUNTIME140 ref: 00007FF7915792ED
strchr.VCRUNTIME140 ref: 00007FF791579369
strchr.VCRUNTIME140 ref: 00007FF791579381
strchr.VCRUNTIME140 ref: 00007FF79157939C
strchr.VCRUNTIME140 ref: 00007FF7915793B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791579444

Strings

CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF791579425
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF79157934A
/LOOKUP:, xrefs: 00007FF79157924D
lookup word is missing, xrefs: 00007FF791579304, 00007FF7915793CE
/FIND:, xrefs: 00007FF791579200
/MATCH:, xrefs: 00007FF7915791CA
/DEFINE:, xrefs: 00007FF79157921B
default, xrefs: 00007FF791579313, 00007FF7915793DD
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF79157929A
/M:, xrefs: 00007FF7915791E5
Failed sending DICT request, xrefs: 00007FF791579451
/D:, xrefs: 00007FF791579236

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: e8f4a5cf3743ac80dc76b9dd15f71b43485728e1c7c409c8df704b1d45515fd7
Instruction ID: b20ffe3cedbd5756fbc8063017106325afa23cd8a111390ecb782d9b50523063
Opcode Fuzzy Hash: e8f4a5cf3743ac80dc76b9dd15f71b43485728e1c7c409c8df704b1d45515fd7
Instruction Fuzzy Hash: 3281AF21A0878240FB31BB3195112B9E296AF45BD4FCA5131DD4D077FAEEACE621C331

Function 00007FF7915551C0 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915551DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915551F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555206
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555213

Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0B1
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0C1
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0CF
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0DD
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0EB
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F0F9
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F107
Part of subcall function 00007FF79154F0A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915528A6), ref: 00007FF79154F115

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155524F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555263
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915552B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915552CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915552DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915552F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155535A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155536E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555396
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915553FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155543A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155544E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555462
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555476
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155548A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155549E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915554B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915554C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915554E8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: dbd2a01beb44ae9c484da9ddd037785085b283a78c2108060b64aeb10dd90823
Instruction ID: f0134b9a3896d37502444572e79237c4f8932a4323080deac2a4f8701975c8eb
Opcode Fuzzy Hash: dbd2a01beb44ae9c484da9ddd037785085b283a78c2108060b64aeb10dd90823
Instruction Fuzzy Hash: 6E91E236648B8193E7499F30E9902ADB368FB48F89F440135EF9D47764DF74A2B58320

Function 00007FF79155E620 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 310stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155E715
strchr.VCRUNTIME140 ref: 00007FF79155E7B5
memcpy.VCRUNTIME140 ref: 00007FF79155E7E5
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79155E811
strchr.VCRUNTIME140 ref: 00007FF79155E85C
memcpy.VCRUNTIME140 ref: 00007FF79155E8BB

Part of subcall function 00007FF79154AB70: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79154ABB4

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155E9D4

Strings

RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF79155EAFE
@, xrefs: 00007FF79155E8A6
], xrefs: 00007FF79155E895
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF79155EA5B
%255[^:]:%d, xrefs: 00007FF79155E6A1
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF79155E6B7
:%u, xrefs: 00007FF79155E729, 00007FF79155E9E8
Added %s:%d:%s to DNS cache, xrefs: 00007FF79155EACD
Resolve address '%s' found illegal!, xrefs: 00007FF79155E93B
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF79155E94A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: 6f855ceec02e5d1c5cf6e97d7d867732ca543a345b7f70c80b9cd5be2d54186d
Instruction ID: 909d207288908e991c3ce601134a32b259be9c3f93559703cfcd280b8f76ac09
Opcode Fuzzy Hash: 6f855ceec02e5d1c5cf6e97d7d867732ca543a345b7f70c80b9cd5be2d54186d
Instruction Fuzzy Hash: 9DD1D522A1868645EF71AB31D5203F9E360FB44798FC68132EA5E17AE5DFBCE415C320

Function 00007FF791573A00 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791573A4D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791573B3F
strchr.VCRUNTIME140 ref: 00007FF791573A81

Part of subcall function 00007FF79154AB70: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79154ABB4

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791573CA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791573E71
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791573E93

Part of subcall function 00007FF79155EF30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155EF6E

Strings

Weirdly formatted EPSV reply, xrefs: 00007FF791573B5F
Couldn't interpret the 227-response, xrefs: 00007FF791573BEE
Can't resolve proxy host %s:%hu, xrefs: 00007FF791573D53
%c%c%c%u%c, xrefs: 00007FF791573ABB
%u.%u.%u.%u, xrefs: 00007FF791573CB3
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF791573C7B
Can't resolve new host %s:%hu, xrefs: 00007FF791573DBE
Bad PASV/EPSV response: %03d, xrefs: 00007FF791573EBE
%u,%u,%u,%u,%u,%u, xrefs: 00007FF791573BCB
Illegal port number in EPSV reply, xrefs: 00007FF791573AFF
Connecting to %s (%s) port %d, xrefs: 00007FF791573E4A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: 88e657e133bf61caa3a5ffb93747923844effb511450c2bf531675a80efeffa8
Instruction ID: eaf30ed71e3eaebf15b82e827b9d470e2fab7e259aff14c53e56442214c94b64
Opcode Fuzzy Hash: 88e657e133bf61caa3a5ffb93747923844effb511450c2bf531675a80efeffa8
Instruction Fuzzy Hash: 1CD1B422B0C68292EBB4AB35E5512B9F7A0FB45794F810032EA4D03B65DFBCE674C711

Function 00007FF791554290 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915545B2

Strings

Unsupported proxy syntax in '%s', xrefs: 00007FF79155459A
http, xrefs: 00007FF7915543AE
socks5h, xrefs: 00007FF791554332
socks4, xrefs: 00007FF791554386
https, xrefs: 00007FF791554314
socks4a, xrefs: 00007FF79155436B
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF7915543F4
socks5, xrefs: 00007FF791554350
socks, xrefs: 00007FF79155439A
Unsupported proxy scheme for '%s', xrefs: 00007FF7915543C1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: e9fe8bcaccbab45bfa6111f1acaa2d1480d37b1e05d67242dc53f3fae66d293c
Instruction ID: 7b54c68a1c351a27d79c61c49be27a9cee93fe8a6666d678e75651841551fd3f
Opcode Fuzzy Hash: e9fe8bcaccbab45bfa6111f1acaa2d1480d37b1e05d67242dc53f3fae66d293c
Instruction Fuzzy Hash: ABA1BD22E0C65285FB21FB31E4505BDA7A5BB44798FC64431EE0D53AA5EFBCE9648320

Function 00007FF79154A3F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A453
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A4CD
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A4F1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A540
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A57A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A58C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A59F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A5BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A5D0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154A5D9

Strings

%s.%s.tmp, xrefs: 00007FF79154A48A
## Fatal libcurl error, xrefs: 00007FF79154A607
%s, xrefs: 00007FF79154A56B
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF79154A4C6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 0848c39e1e35fc6b94b29dfdee7cce67205fe9ab1c0595f78b98a1fc77592385
Instruction ID: bd2ced17d59ffe66315fdafec48d30bf3269c3051ca572f6581418d53847951a
Opcode Fuzzy Hash: 0848c39e1e35fc6b94b29dfdee7cce67205fe9ab1c0595f78b98a1fc77592385
Instruction Fuzzy Hash: 39516321A0D64245FFB5BB3299942BAA2A0BF45BD4FD64431DD0F477B0EFBCE4258260

Function 00007FF791566490 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF7915666FA
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF7915668EA
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF79156677B
[, xrefs: 00007FF791566A24
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF7915669FD
SOCKS4 connection to %s not supported, xrefs: 00007FF79156675C
Failed to send SOCKS4 connect request., xrefs: 00007FF79156683D
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF791566556
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF791566996
SOCKS4%s request granted., xrefs: 00007FF791566A56
Too long SOCKS proxy name, can't use!, xrefs: 00007FF791566657
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF7915665FB
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF7915669C3
SOCKS4 communication to %s:%d, xrefs: 00007FF79156656F
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF791566A34
SOCKS4: too long host name, xrefs: 00007FF791566856
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF791566931

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: 33a5bea1ac593d9cd732afc852774ccc744dd55d3b203ab22b10a6d70a5f732d
Instruction ID: eab4f2c02d56032ad51cae1570dbd6b1d848ea0cf0d673352da0cf6341857fb1
Opcode Fuzzy Hash: 33a5bea1ac593d9cd732afc852774ccc744dd55d3b203ab22b10a6d70a5f732d
Instruction Fuzzy Hash: B3E1E2A190CA8189EB74AF35D050379BBA0EB45784FC58136EA4D077B5CFBCE464CB60

Function 00007FF7915354C0 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153561E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153564C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153565A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791535694
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915356E5
memset.VCRUNTIME140 ref: 00007FF791535513

Part of subcall function 00007FF791534360: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391

Part of subcall function 00007FF791536360: memcpy.VCRUNTIME140 ref: 00007FF7915364D6

Part of subcall function 00007FF791532000: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532171

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791535852
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153587E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153588C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915358C7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153591A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791535A01
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF791535A19
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF791535A26

Strings

value, xrefs: 00007FF791535586, 00007FF7915357BE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 69eea14589571b447657b7d147a33fd280fb5a3c08a5820789b19d2ce2bc6e59
Instruction ID: 77e6442d9a9f4411a54c96b839b0749fc237f16232a6c58ddbfc39958fdeb221
Opcode Fuzzy Hash: 69eea14589571b447657b7d147a33fd280fb5a3c08a5820789b19d2ce2bc6e59
Instruction Fuzzy Hash: 62F1F962A18B8185FB20EB74E4403ADA760FB857B4F915231EA9D43AF9DFBCD195C310

Function 00007FF79156B230 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF79156B517
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF79156B587
CertFreeCertificateContext.CRYPT32 ref: 00007FF79156B5C5
CertFreeCertificateContext.CRYPT32 ref: 00007FF79156B5D8

Strings

schannel: failed to setup replay detection, xrefs: 00007FF79156B2A6
schannel: failed to setup confidentiality, xrefs: 00007FF79156B2C2
schannel: failed to setup stream orientation, xrefs: 00007FF79156B300
ALPN, server did not agree to a protocol, xrefs: 00007FF79156B3A5
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF79156B378
http/1.1, xrefs: 00007FF79156B38B
schannel: failed to retrieve ALPN result, xrefs: 00007FF79156B34B
schannel: failed to setup memory allocation, xrefs: 00007FF79156B2E1
schannel: failed to store credential handle, xrefs: 00007FF79156B47C
schannel: failed to retrieve remote cert context, xrefs: 00007FF79156B5F7
schannel: failed to setup sequence detection, xrefs: 00007FF79156B28A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 84a0a7e78fd404ba2a119c487caa6af3f86973d57e28830e8e7364884e293f92
Instruction ID: 7d8515c60d940c0c1f41787aa34a455b890a74fc76cad29d82d687c3895641cd
Opcode Fuzzy Hash: 84a0a7e78fd404ba2a119c487caa6af3f86973d57e28830e8e7364884e293f92
Instruction Fuzzy Hash: 25B1B161B08E8282EB70AB35D8103B9A3A1EF84BD5FC64132D94D477A4DFBCE455C7A0

Function 00007FF791561A50 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF791561B08
strchr.VCRUNTIME140 ref: 00007FF791561B1F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791561B6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561D37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561D86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561D8F

Strings

Host:, xrefs: 00007FF791561BE9
Connection:, xrefs: 00007FF791561C81
1.1, xrefs: 00007FF791561A6B
Content-Type:, xrefs: 00007FF791561C0F, 00007FF791561C35
Content-Length:, xrefs: 00007FF791561C5B
%s, xrefs: 00007FF791561D1C
Transfer-Encoding:, xrefs: 00007FF791561CA8
Cookie:, xrefs: 00007FF791561CDB
Authorization:, xrefs: 00007FF791561CC1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 55d68476e77e030ead976d7ce9c390be74ab7be76865675c77030afcc710caa6
Instruction ID: ffd7ad6a707e7260b38804b15101336a0f114af7eaf0d9ebef3b855a6299c484
Opcode Fuzzy Hash: 55d68476e77e030ead976d7ce9c390be74ab7be76865675c77030afcc710caa6
Instruction Fuzzy Hash: D7919A21A08A4245FB71BB31D49037DA7A0AF91BC4FC64031CE4E8B6B5EEBCE525C361

Function 00007FF79154F520 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F584
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F5B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F5C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F69F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F6AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F6E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F6F1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F76F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F790
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F7B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154F7D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F869
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154F872

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: a147aac26919b0f1c38b59227e6e8f7bc4977919d8996d7f10e718cdd5e66146
Instruction ID: 9c8cbf332c9b4e5be5e300e9adbb4cffc3c08f24f3c8b62735b209f323961ae5
Opcode Fuzzy Hash: a147aac26919b0f1c38b59227e6e8f7bc4977919d8996d7f10e718cdd5e66146
Instruction Fuzzy Hash: 2CB13B32A0AB8196FB65EF29E554369B3A0FB44B54F950136CB8D47BA0DF7CE0748360

Function 00007FF791587C51 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791587C82
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588149
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158819C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915882FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588338

Strings

Signature: %s, xrefs: 00007FF791588137
Cert, xrefs: 00007FF79158830E
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7915881DC
FALSE, xrefs: 00007FF791587C6D
-----END CERTIFICATE-----, xrefs: 00007FF791588287
TRUE, xrefs: 00007FF791587C74
%s, xrefs: 00007FF791588326
Signature, xrefs: 00007FF79158811F

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 37e8d70bddd260822cb3e5423af062e5691996698d2b4960dbb5117c7c7aab1b
Instruction ID: c2420dd327bbe7c413ed2809d0c41cace01c2e2a96b20ae4a43f4eeb67449964
Opcode Fuzzy Hash: 37e8d70bddd260822cb3e5423af062e5691996698d2b4960dbb5117c7c7aab1b
Instruction Fuzzy Hash: 2071DA66E0D7C285FB21AB3594042B9FBA1EF45748FDA4072CA8E03772DE6CE165C321

Function 00007FF791581CC0 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581D82
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581DBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581DCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581E01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581E0C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581EC2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581ECB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581ED6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581FC1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581FCA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791581FD5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158204B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791582054
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158205F

Part of subcall function 00007FF791582450: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79158433A,?,?,00000000,00007FF791580D75), ref: 00007FF791582460
Part of subcall function 00007FF791582450: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79158433A,?,?,00000000,00007FF791580D75), ref: 00007FF791582471
Part of subcall function 00007FF791582450: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79158433A,?,?,00000000,00007FF791580D75), ref: 00007FF791582483

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF79158206C
WDigest, xrefs: 00007FF791581D6C, 00007FF791581E84

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: 6fe04d466f9de332a77138c64db72be395503f3e81040d299b23a551850e43aa
Instruction ID: b482e07ddf3f90512d54f817ee92c3b5159cd70212cf7f4b58b7ec74d751c25b
Opcode Fuzzy Hash: 6fe04d466f9de332a77138c64db72be395503f3e81040d299b23a551850e43aa
Instruction Fuzzy Hash: 70B12132A08B468AEB20AF75E8902ADB7B4FB48B94F810035DE4E47B64DF7CD565C750

Function 00007FF791588A10 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588B23

Strings

dsa(q), xrefs: 00007FF791588BEC
RSA Public Key, xrefs: 00007FF791588B0F
dsa(p), xrefs: 00007FF791588BBD
dh(p), xrefs: 00007FF791588C7F
dhpublicnumber, xrefs: 00007FF791588C46
rsaEncryption, xrefs: 00007FF791588A55
RSA Public Key (%lu bits), xrefs: 00007FF791588ADE
rsa(n), xrefs: 00007FF791588B30
%lu, xrefs: 00007FF791588AF8
dh(pub_key), xrefs: 00007FF791588CC6
dsa(pub_key), xrefs: 00007FF791588C32
dsa, xrefs: 00007FF791588B85
dh(g), xrefs: 00007FF791588CB0
rsa(e), xrefs: 00007FF791588B5B
dsa(g), xrefs: 00007FF791588C1C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 35af8839f0ad4e13f6ccc940b75cc49f4155902fa16ea1e5167c3a1ddd2ec708
Instruction ID: 26fbba892d3ae57e3f098799d2063b3c8794f69c81d77f8682d44dfb2718f2bf
Opcode Fuzzy Hash: 35af8839f0ad4e13f6ccc940b75cc49f4155902fa16ea1e5167c3a1ddd2ec708
Instruction Fuzzy Hash: 64715C61A0C74682EB34FB7195401B9A351FF89B80FC54072EE8D07BA9EFBCE521C660

Function 00007FF791568900 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF791568BB6), ref: 00007FF79156891B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79156893B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156895C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791568965

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: a220ef980d97c336bb61ed3e073871ae36a0110a5c128f20a6c0c3245b06c8c1
Instruction ID: 449040c0d379cb4cc19e22ee6b582ff4d19e4f1edd1621683a4133545de4b7a6
Opcode Fuzzy Hash: a220ef980d97c336bb61ed3e073871ae36a0110a5c128f20a6c0c3245b06c8c1
Instruction Fuzzy Hash: DE616C76A45B4182EB25EF26E44452DB3A4FB48B95F864035CF8D43B60EFBCE4A5C360

Function 00007FF791571A20 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791571B40

Strings

No data was received!, xrefs: 00007FF791571E7C
control connection looks dead, xrefs: 00007FF791571D32
Received only partial file: %I64d bytes, xrefs: 00007FF791571E4E
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF791571E16
Failure sending ABOR command: %s, xrefs: 00007FF791571C61
partial download completed, closing connection, xrefs: 00007FF791571D73
server did not report OK, got %d, xrefs: 00007FF791571DAE
ABOR, xrefs: 00007FF791571C3B
Remembering we are in dir "%s", xrefs: 00007FF791571BD8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: e42146504e070dac4c609b6460658906fe02d1a0aca4d53f740276dafcef5f16
Instruction ID: 03d88aec8c68b34ceeee4e90aa587cd2e5a9267a8b2b8e3f56c944a5198add1a
Opcode Fuzzy Hash: e42146504e070dac4c609b6460658906fe02d1a0aca4d53f740276dafcef5f16
Instruction Fuzzy Hash: 7BD1C461A0C78245EB74BB3195913B9A791FB413A4FC20631DA6F837E2DFBCE5648321

Function 00007FF79153A7F2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791534360: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391

Part of subcall function 00007FF791536360: memcpy.VCRUNTIME140 ref: 00007FF7915364D6

Part of subcall function 00007FF791532000: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532171

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A8A1
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A8CF
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153A8DD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A917
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153A974
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AA2D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153AA5B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153AA69
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AAA3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AAF4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AB3E

Strings

value, xrefs: 00007FF79153A810, 00007FF79153A999

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: b86305704a2081543833dd945491b022b734e9d019d359bb9389a3b0748bd819
Instruction ID: 4a9c2966acfa684c25a355299176af630e00f06bcc12206a1dd7a136ffdd351c
Opcode Fuzzy Hash: b86305704a2081543833dd945491b022b734e9d019d359bb9389a3b0748bd819
Instruction Fuzzy Hash: FCA19222A18A4586FB20EB78E4443ADA361FB457B4F910731DA6D43AF9DFBCD092C710

Function 00007FF791542550 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF791542572
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154257A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791542599
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915425A5
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915425B4
strrchr.VCRUNTIME140 ref: 00007FF791542605
strrchr.VCRUNTIME140 ref: 00007FF791542626
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154263F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79154264A
GetLastError.KERNEL32 ref: 00007FF791542653
SetLastError.KERNEL32 ref: 00007FF79154265F

Strings

Unknown error %d (%#x), xrefs: 00007FF7915425E7

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 07a3e6cbba628c85def731112674b20e539a41a9152effcbd6561618a3fe6171
Instruction ID: 1a0c7f67424394a1f85988ffa0c82173bfc094ab5c07b0489895c8754c7d44ff
Opcode Fuzzy Hash: 07a3e6cbba628c85def731112674b20e539a41a9152effcbd6561618a3fe6171
Instruction Fuzzy Hash: 6431AF21A0866285EF257F31B810279E691AF84F90FDA4435CE4E4BBE5DEBCE421C361

Function 00007FF791584980 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915849F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584A16
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584A31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584A3F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584AC6
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584B15
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584B76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584CFC

Strings

CompleteAuthToken failed: %s, xrefs: 00007FF791584D57
Negotiate, xrefs: 00007FF791584984, 00007FF791584A8C, 00007FF791584B33
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF791584BC6
InitializeSecurityContext failed: %s, xrefs: 00007FF791584D1A
HTTP, xrefs: 00007FF791584980

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: be202954af5afef578d3fda2cf1742c2465f7f1582f3dceee6ea873e827d8603
Instruction ID: 4863b157b1f984bfd97d6a81e8dcd85d99d4bb291b19162faf73165433f717f8
Opcode Fuzzy Hash: be202954af5afef578d3fda2cf1742c2465f7f1582f3dceee6ea873e827d8603
Instruction Fuzzy Hash: 04C17072A05B4186EB21EF75E4402ADB7B4FB44B88F810076DE4D47B68DFB8D865C790

Function 00007FF791586860 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586913
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586979
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158699C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915869FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586A6C

Strings

Version, xrefs: 00007FF791586A57
%2d Subject: %s, xrefs: 00007FF791586964
Version: %lu (0x%lx), xrefs: 00007FF791586A7E
%lx, xrefs: 00007FF791586A3C
Subject, xrefs: 00007FF79158694A
Issuer, xrefs: 00007FF7915869D0
Issuer: %s, xrefs: 00007FF7915869EA
TRUE, xrefs: 00007FF791586AD1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: 90c683ed628edd05eee638d2d473ada20245a5175e9331b5212fab1e1c23a4b5
Instruction ID: 32cf8b8a61a85db6b43fa60176644ac7ccf9f135ae973a9812493cfd522ba5eb
Opcode Fuzzy Hash: 90c683ed628edd05eee638d2d473ada20245a5175e9331b5212fab1e1c23a4b5
Instruction Fuzzy Hash: B661E161A0878285EB31AB31E8447FAB3A1BB45794FC54575CD4E07BA5EFBCE164C320

Function 00007FF79157C5F3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157C6F3

Strings

tsize, xrefs: 00007FF79157C802
blksize, xrefs: 00007FF79157C8C8
%s%c%s%c, xrefs: 00007FF79157C70A
%I64d, xrefs: 00007FF79157C786
TFTP file name too long, xrefs: 00007FF79157C6DF
TFTP buffer too small for options, xrefs: 00007FF79157C7EF, 00007FF79157C938
timeout, xrefs: 00007FF79157C9B5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: 1820f4d42e87d89d51ca5d45a598d15fe1c3d8f54c2fe123ad055be94eb0b458
Instruction ID: a6a41f0ea12a555db328514e0c5bd84a38c2b3fe3a56f8f4987d43c932fa2af9
Opcode Fuzzy Hash: 1820f4d42e87d89d51ca5d45a598d15fe1c3d8f54c2fe123ad055be94eb0b458
Instruction Fuzzy Hash: EDD1B362A08AC285EB21DF34D0403B9B7A1FB45B98FC68132CA5D477A5DFBCD655C320

Function 00007FF79157A8A0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF79157AA9C
WSAGetLastError.WS2_32 ref: 00007FF79157AAAE
send.WS2_32 ref: 00007FF79157ABA6
WSAGetLastError.WS2_32 ref: 00007FF79157ABB0

Strings

#, xrefs: 00007FF79157AB1E
%127[^,],%127s, xrefs: 00007FF79157AA08
%c%c%c%c, xrefs: 00007FF79157A97D
%c%c, xrefs: 00007FF79157AA78
Sending data failed (%d), xrefs: 00007FF79157AAB4, 00007FF79157ABB6
%c%c%c%c%s%c%c, xrefs: 00007FF79157AB7F
%c%s%c%s, xrefs: 00007FF79157AA40

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: c9d7d531f4bda765586f201d62c922e680e0a503d9d61c691f3087e0ef080336
Instruction ID: a0fd13e5bcfab22b50f19db085d02902a1c4ccbc36e469eddde275b49cdbf086
Opcode Fuzzy Hash: c9d7d531f4bda765586f201d62c922e680e0a503d9d61c691f3087e0ef080336
Instruction Fuzzy Hash: 5191A222608AC185F731AF24E4457EAA3A1FB447A8F890231EE4D07BA5DFBCD255C750

Function 00007FF79157C250 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF79157C3C8
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79157C3E3
sendto.WS2_32 ref: 00007FF79157C44A
sendto.WS2_32 ref: 00007FF79157C501
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79157C539

Strings

Received last DATA packet block %d again., xrefs: 00007FF79157C495
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF79157C541
tftp_rx: internal error, xrefs: 00007FF79157C29E
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF79157C2C2

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 4dfb3d0c330fb7bae6d336b1dfb1b7d74036dc2250991759a54dc6b0462ee2eb
Instruction ID: a61b8e6f13db370b3d5220915b6c4dc0782deba84e61681772b1719a57eb91fc
Opcode Fuzzy Hash: 4dfb3d0c330fb7bae6d336b1dfb1b7d74036dc2250991759a54dc6b0462ee2eb
Instruction Fuzzy Hash: DD91AA72608782C6D721DF39D4503A9BBA0FB88B88F858132DA4D8B768DF79D516C720

Function 00007FF79155BA20 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79155BDB6

Strings

Successfully compiled trailers., xrefs: 00007FF79155BAFA
%zx%s, xrefs: 00007FF79155BCD7
Read callback asked for PAUSE when not supported!, xrefs: 00007FF79155BC19
Signaling end of chunked upload after trailers., xrefs: 00007FF79155BE00
Unable to allocate trailing headers buffer !, xrefs: 00007FF79155BA93
read function returned funny value, xrefs: 00007FF79155BC5B
Moving trailers state machine from initialized to sending., xrefs: 00007FF79155BA61
operation aborted by trailing headers callback, xrefs: 00007FF79155BBAD
operation aborted by callback, xrefs: 00007FF79155BB8D
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF79155BD4A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: e47f53414ed1b213568cc64cf61c9f89f4be9add219a6ef7daa0ce3f09731cfe
Instruction ID: 7b0b807d5dd9464ed05fee0f398d7c2e82b2ebbfaa7e0f57675a1a38f084710b
Opcode Fuzzy Hash: e47f53414ed1b213568cc64cf61c9f89f4be9add219a6ef7daa0ce3f09731cfe
Instruction Fuzzy Hash: 45A18171A18A8281E770AF30D4643F9B351EB85B94FDA0131ED4E4B2A5EFBCE465C321

Function 00007FF79156DA30 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156DB60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156DB76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156DBD9

Strings

Mime-Version, xrefs: 00007FF79156DC66
Cannot APPEND without a mailbox., xrefs: 00007FF79156DC04
Cannot APPEND with unknown input file size, xrefs: 00007FF79156DCD7
Cannot SELECT without a mailbox., xrefs: 00007FF79156DB8F
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF79156DA48
SELECT %s, xrefs: 00007FF79156DBC5
Mime-Version: 1.0, xrefs: 00007FF79156DC81
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF79156DD0D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 39d108f7ef6bee2c7c75311daece297296a6f6b8611281b7dd85ef189c69a579
Instruction ID: 70cc5d5f788fdcf2dc4093fdbafc3ad1a1d611339c6e4773e0811545158d61d6
Opcode Fuzzy Hash: 39d108f7ef6bee2c7c75311daece297296a6f6b8611281b7dd85ef189c69a579
Instruction Fuzzy Hash: 5F916E21A0CE4285FB74BB3195503B9A2A0FF457C4F864835DA9D476A5EFFCE461C3A0

Function 00007FF7915545E0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF7915555D4
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF7915555EA
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF7915555FE
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF791555612
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF791555626
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79155563A
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79155564E
Part of subcall function 00007FF7915555C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF791555662

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791554662

Part of subcall function 00007FF79157E590: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5A5
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5BF
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5DA
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5F6
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E612
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E62A
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E642
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E65A
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E672
Part of subcall function 00007FF79157E590: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E68A
Part of subcall function 00007FF79157E590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E6A4

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791554866
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915548A9
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7915549EE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791554A6B

Strings

Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF7915547AF
file, xrefs: 00007FF791554953, 00007FF7915549CC
%s://%s, xrefs: 00007FF79155466F

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 8dc1ee1bd944df6d93852fd348251f1ddf18e2558975760cbf580229279dbdaa
Instruction ID: 26270ac1e73eba9e8c3955b8b7cc5ca55b55ea3e35813b9079b025bbaab35a2b
Opcode Fuzzy Hash: 8dc1ee1bd944df6d93852fd348251f1ddf18e2558975760cbf580229279dbdaa
Instruction Fuzzy Hash: FAC1A431A0C68286EB7AAB31D5613F9A390FB45744F854031EA0D4B6A5EFBCF975C320

Function 00007FF79155E1B0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155E241
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155E288
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155E324
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155E33A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155E35B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155E3AA
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79155E3FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155E42F

Strings

Shuffling %i addresses, xrefs: 00007FF79155E22A
:%u, xrefs: 00007FF79155E3BE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 533c27ae44850a2ed3ff981f35d7db46656ead4ac9f49beca8792eb01a1426fd
Instruction ID: f8c2742299331bf243a4ed9a8a0c8e0ad7931069de736f9f21446ecb488d4f6c
Opcode Fuzzy Hash: 533c27ae44850a2ed3ff981f35d7db46656ead4ac9f49beca8792eb01a1426fd
Instruction Fuzzy Hash: CC71A272A08A4281EB20AF21E5107A9E761FB48B94FC68531DE4E077A5EFBCE455D710

Function 00007FF79158B6D0 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158BB9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158BBF3

Strings

CRAM-MD5, xrefs: 00007FF79158B922
PLAIN, xrefs: 00007FF79158BAAA
XOAUTH2, xrefs: 00007FF79158BA55
DIGEST-MD5, xrefs: 00007FF79158B903
GSSAPI, xrefs: 00007FF79158B866
LOGIN, xrefs: 00007FF79158BB13
EXTERNAL, xrefs: 00007FF79158B7EB
OAUTHBEARER, xrefs: 00007FF79158B9E2
NTLM, xrefs: 00007FF79158B959

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: d736805c5c88d0744446b6d40205f69f1f7ebc070f4f0a308762f5cdb5e4a9bd
Instruction ID: 79da9047486a7a32debf83b667ad798375bccb663db2e9e80eab53cab9f7386b
Opcode Fuzzy Hash: d736805c5c88d0744446b6d40205f69f1f7ebc070f4f0a308762f5cdb5e4a9bd
Instruction Fuzzy Hash: B6D19172A0978286EB70EF20E4403A9B7A4FB84754F860176DE8C07BA8DFBCD555C725

Function 00007FF79156D700 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79156C0D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF79155345F), ref: 00007FF79156C0FE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156D99E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156D9A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156DA03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156DA0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156DA1A

Strings

MAILINDEX, xrefs: 00007FF79156D8D7
UIDVALIDITY, xrefs: 00007FF79156D855
PARTIAL, xrefs: 00007FF79156D956
UID, xrefs: 00007FF79156D896
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF79156D708
SECTION, xrefs: 00007FF79156D918

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 0463735639b977c753d8d2a3a11af8177f0cd73d3052a1dbbd747a58cf5a7cd0
Instruction ID: c4af43ba8ec34b70970e6f6e89da6d149690480fef9b0ef09bd7c8d266d739c8
Opcode Fuzzy Hash: 0463735639b977c753d8d2a3a11af8177f0cd73d3052a1dbbd747a58cf5a7cd0
Instruction Fuzzy Hash: 74A17522908E8285EB71AF31D4443B8A790FB447D8F851431EACE47AA5DFBDD4A5C3A1

Function 00007FF79157F241 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F14B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F1B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F1BF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F2BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F326
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F33E

Part of subcall function 00007FF79157E290: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157E2A0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F366
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F37D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F3A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F3EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157F404

Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F54C
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F556
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F560
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F56A
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F574
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F57E
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F588
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F592
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F59C
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F5A6
Part of subcall function 00007FF79157F540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F5B0

Strings

,, xrefs: 00007FF79157F284
:, xrefs: 00007FF79157F267

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 5075bd5def5fdaba7dde46dc608fff5f5a6b59d6e4ebdcca4be625b992156916
Instruction ID: be6cad6926b410301b45aa55fc95022446ddd7cc956e78ddbb9b4c4c283d8a67
Opcode Fuzzy Hash: 5075bd5def5fdaba7dde46dc608fff5f5a6b59d6e4ebdcca4be625b992156916
Instruction Fuzzy Hash: 88519512E0CB8643F731EB3599152B9A361BF55B84F859231CE9D12762EFACF2E48310

Function 00007FF79154C980 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF79154C9C7
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF79154C9D7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154C9EE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154CA6A
strrchr.VCRUNTIME140 ref: 00007FF79154CA87
strrchr.VCRUNTIME140 ref: 00007FF79154CA97
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154CAC7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154CAD3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154CAE2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154CAF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154CB09

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: cc4b452e149309618ec8c3712edcd5cb9bf37e33a6947b0d1c5560d217043fe1
Instruction ID: 70f54ab6dd701b0dbf5c8f15ddcee3eafe9740cd650b0b37be1e92bfc13f9c50
Opcode Fuzzy Hash: cc4b452e149309618ec8c3712edcd5cb9bf37e33a6947b0d1c5560d217043fe1
Instruction Fuzzy Hash: 5D416721B09B4286FB34BB22A450279A2A0FF84B90FD94134CE5D477E4EFBCE4759320

Function 00007FF79157E590 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5A5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5BF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5DA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E5F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E612
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E62A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E642
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E65A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E672
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E68A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791554605,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79157E6A4

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: e8f427a333ce762d7badb517e59f7dcc838bae5e2cdd9ab2595d001bfb5aa8f8
Instruction ID: 995ff11c34b039073540d89b0ae759d5ccbb91c1e6cc4aa86ba89515409139cd
Opcode Fuzzy Hash: e8f427a333ce762d7badb517e59f7dcc838bae5e2cdd9ab2595d001bfb5aa8f8
Instruction Fuzzy Hash: 32311C61A4AB0282EF79EF75B155138A3E4FF48B51B8A4539CA0E06760EF7CF5748360

Function 00007FF791551CB0 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF791551CE8
strchr.VCRUNTIME140 ref: 00007FF791551D0F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551DC4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551DEA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551E0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551E1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551E25
memcpy.VCRUNTIME140 ref: 00007FF791551E43
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551E57
memcpy.VCRUNTIME140 ref: 00007FF791551E74
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551E89
memcpy.VCRUNTIME140 ref: 00007FF791551EA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791551EB6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: a1c8201b6f3bee42d03bc2cddec8e108a6debc594936fa0ea32eb25cad6b4c42
Instruction ID: a8c54ad8171ac43141a8de9bd06a8a7d098281f10f27c21f15dda4326623e240
Opcode Fuzzy Hash: a1c8201b6f3bee42d03bc2cddec8e108a6debc594936fa0ea32eb25cad6b4c42
Instruction Fuzzy Hash: 0D51B021B09B8545EF75BF25E564279EAA1BF44BC0F894430EE4E87764EF7CE4258320

Function 00007FF791553B79 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553C14
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553C28
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553C4C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791553C59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553C82
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791553C8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791553CC0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791553CCD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF791553D59

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 1d04505e495145950235f57996710238a2d0b300f5824eb49bbb70f89b12f21d
Instruction ID: 319ef6aa9665fb7115aa8a10712164f66286c0ebc0e7416a5bfcfe0d61f6bc10
Opcode Fuzzy Hash: 1d04505e495145950235f57996710238a2d0b300f5824eb49bbb70f89b12f21d
Instruction Fuzzy Hash: C5619162A08B8286E7B59B35D46436EBBB0FB44B84F8A4035DB8D47761DF7CE465C320

Function 00007FF7915745E0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 00007FF791574620
NLST, xrefs: 00007FF7915746DB
Couldn't set desired mode, xrefs: 00007FF7915745FE
%s%s%s, xrefs: 00007FF791574705
LIST, xrefs: 00007FF7915746E2

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 05ecc57f50b54b6a61a3d957fe0d199e0b50a32a6b995c18ca7873081ea11a20
Instruction ID: cd1dc19c89f36eafee245d80f543b75d104bea2b6da38c17742d2ba9b2dbb4f3
Opcode Fuzzy Hash: 05ecc57f50b54b6a61a3d957fe0d199e0b50a32a6b995c18ca7873081ea11a20
Instruction Fuzzy Hash: 8B41B026B08682C6EB32BB75E4411BDE360EF41B90FC64031DA4D07765EFBCEA648760

Function 00007FF7915584F0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79156455A), ref: 00007FF79155856F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79156455A), ref: 00007FF7915585C1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79156455A), ref: 00007FF7915585E5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79156455A), ref: 00007FF791558635
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79156455A), ref: 00007FF791558678

Strings

Proxy-, xrefs: 00007FF79155864B
Digest, xrefs: 00007FF7915584FB
%.*s, xrefs: 00007FF7915585CE
%sAuthorization: Digest %s, xrefs: 00007FF791558655

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: d6103e72cbcc8da1c03c811d2a32d5e7c51357ccb556e916a0c4d7afa04c659c
Instruction ID: ff0c45b13c15d8f0c5c2354bd8a48d0ed93d5bfb7bf759425c38389387eabcc8
Opcode Fuzzy Hash: d6103e72cbcc8da1c03c811d2a32d5e7c51357ccb556e916a0c4d7afa04c659c
Instruction Fuzzy Hash: F4418422608B8596EB31AF22E4403AAB7A0FB45B84FD50435EE8D477A4DF7CD566C720

Function 00007FF79158761E Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791587652
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

FALSE, xrefs: 00007FF791587647
TRUE, xrefs: 00007FF791587640
Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 5f6cd9eea9399512c4b55156c81aa350a10a22d77529dec60b8d559df1f0e6c4
Instruction ID: ffd60b7e4fa836b43eed981eb9b6ead406fc5d4cf0ccaa71e3c5011133943910
Opcode Fuzzy Hash: 5f6cd9eea9399512c4b55156c81aa350a10a22d77529dec60b8d559df1f0e6c4
Instruction Fuzzy Hash: 2E418B61B0878285EB71AB71E8142F9A762FB05788FC50875CE4D1BB75EFBCE1648320

Function 00007FF791577800 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791577A58

Part of subcall function 00007FF791555890: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7915616A5,?,?,00000000,00007FF791561A05), ref: 00007FF7915558A5
Part of subcall function 00007FF791555890: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7915616A5,?,?,00000000,00007FF791561A05), ref: 00007FF7915558BB

memcpy.VCRUNTIME140 ref: 00007FF791577878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915779C9
memcpy.VCRUNTIME140 ref: 00007FF791577A92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791577A9E

Strings

Failed writing RTP data, xrefs: 00007FF791577993
Cannot pause RTP, xrefs: 00007FF79157799C
Got an error writing an RTP packet, xrefs: 00007FF7915779AB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: 9bfac1b8935d38e05f7c8cc7b36c632f584987af3c1d6f6e04fd8e0473ac4191
Instruction ID: fd3912964892afc43288d7ab9549a22fe90ecd2305784d9680885005842c0085
Opcode Fuzzy Hash: 9bfac1b8935d38e05f7c8cc7b36c632f584987af3c1d6f6e04fd8e0473ac4191
Instruction Fuzzy Hash: 7F717E22B09B8596E768EB35E8047A9B7E4FB45B90F864031EA9D47B60DF7CE570C310

Function 00007FF79154A9C0 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF79154A43E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF791551109), ref: 00007FF79154A9E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA43
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA61
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA75
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA7F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154AA88

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 86c66ed6b67c00c6454814930aa6bca85f803e729afe4de3d907f376009a996e
Instruction ID: fef2d6efb834b795b89175cedb3b1f3fdf526e80a2901a716ba9fb8342be950e
Opcode Fuzzy Hash: 86c66ed6b67c00c6454814930aa6bca85f803e729afe4de3d907f376009a996e
Instruction Fuzzy Hash: CF213036A48A4281EB61AF32E94012DB370FB48FD5F960431CE8E03B64DEBCD4A5C350

Function 00007FF79158E290 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158E35A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158E3A8
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158E40B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158E549

Part of subcall function 00007FF7915822F0: strchr.VCRUNTIME140(00000000,?,?,00007FF7915818AF), ref: 00007FF791582336
Part of subcall function 00007FF7915822F0: strchr.VCRUNTIME140(00000000,?,?,00007FF7915818AF), ref: 00007FF791582346
Part of subcall function 00007FF7915822F0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7915818AF), ref: 00007FF791582370
Part of subcall function 00007FF7915822F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915823A5
Part of subcall function 00007FF7915822F0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915823CA
Part of subcall function 00007FF7915822F0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915823EC

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79158E5D4

Strings

GSSAPI handshake failure (empty challenge message), xrefs: 00007FF79158E453
Kerberos, xrefs: 00007FF79158E323, 00007FF79158E3C5
GSSAPI, xrefs: 00007FF79158E293

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: e08d8f20e358e8bf9012f0280b8371e18ffbfdb4ce6c661bcb27ea5806dce58a
Instruction ID: 9e316a42505f0db73797e010dadc1c5e83ef033a29bd9653837b66a0fe7c1143
Opcode Fuzzy Hash: e08d8f20e358e8bf9012f0280b8371e18ffbfdb4ce6c661bcb27ea5806dce58a
Instruction Fuzzy Hash: A7A17F32A08B458AEB60EF35E44026DB7B5FB44B88F814036DE4D53B68EF78E465C760

Function 00007FF791537449 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF7915377E7
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF791537997

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 67ce05d3a95ab737e48459ce580bc1aa4f779d63d5c69efeefdcd26c81937c2d
Instruction ID: 18d38942b1330651098f88ff78cdc94d6c1e0dfe607107521d6f0209757d4728
Opcode Fuzzy Hash: 67ce05d3a95ab737e48459ce580bc1aa4f779d63d5c69efeefdcd26c81937c2d
Instruction Fuzzy Hash: 39B15E62908A81C1E7399F38D08026CB771FB15B58FE54635C65E432F4EFB8D8A6C360

Function 00007FF791549205 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154924A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154926A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915492BB

Part of subcall function 00007FF79154AAD0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154AAD6

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915493C1

Strings

Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
FALSE, xrefs: 00007FF79154939B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 8cc22d32718874c21a7d418b4ad9da824bd132e612db29a526d222bbaa5b249c
Instruction ID: 1175c7b50ca83b5469b3fb6d8a499dc2a44c0b71e645a27a34094f42e29d8683
Opcode Fuzzy Hash: 8cc22d32718874c21a7d418b4ad9da824bd132e612db29a526d222bbaa5b249c
Instruction Fuzzy Hash: FB91742190D78285FF71A73290453B9F7E0AF49744FA64035CA8E026F5DEBCE464C360

Function 00007FF791562500 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915625CC

Strings

Negotiate, xrefs: 00007FF791562576
Authentication problem. Ignoring this., xrefs: 00007FF79156270D
Digest, xrefs: 00007FF791562664
Bearer, xrefs: 00007FF7915626E8
Basic, xrefs: 00007FF7915626C1
Ignoring duplicate digest auth header., xrefs: 00007FF79156267D
NTLM, xrefs: 00007FF7915625FC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: dba1c758155741f3a2c88d7f8b7215087e224d077ced5c74a72c254be93440b6
Instruction ID: df6883ed89092a9a51187bd2351dee95a7b0feba8e2f2d555735536aca3c9460
Opcode Fuzzy Hash: dba1c758155741f3a2c88d7f8b7215087e224d077ced5c74a72c254be93440b6
Instruction Fuzzy Hash: 1871F77190C68286FB35AA3295502BAFAD1AF417C4FC68034DE4A4B6E1DFBCE534C761

Function 00007FF791549313 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791549316
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915493C1

Strings

Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
FALSE, xrefs: 00007FF79154939B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667
__Secure-, xrefs: 00007FF791549330
__Host-, xrefs: 00007FF79154934D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: a9478a25be66726728ea2433b1dd63cef6bfb16a974eec38186dccfc39064001
Instruction ID: 2d17632abc11dfaedd01fb143306aa283725108fb8e726327379debfb0f03de0
Opcode Fuzzy Hash: a9478a25be66726728ea2433b1dd63cef6bfb16a974eec38186dccfc39064001
Instruction Fuzzy Hash: 98716421A0878245FF71A732D0453B9E7A1AF49754FA64035DA8D026F9EFBCE464C361

Function 00007FF7915706F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915707AF
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915707F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915708B0

Strings

HELP, xrefs: 00007FF7915708E5
VRFY %s%s%s%s, xrefs: 00007FF79157087E
SMTPUTF8, xrefs: 00007FF79157075D, 00007FF791570865
%s %s%s, xrefs: 00007FF791570779
EXPN, xrefs: 00007FF791570737

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: 74c95ef7909cc5841fbc3fa6afd5fb9e3b9a205694a213baf88eed23ca3261a1
Instruction ID: 25d4e2530bb61c4fdfae2eeef3d18d9df270d9e13cafd159fbb3677096ce621a
Opcode Fuzzy Hash: 74c95ef7909cc5841fbc3fa6afd5fb9e3b9a205694a213baf88eed23ca3261a1
Instruction Fuzzy Hash: 2B51B322E0CB8182EF21EB31E4507B9E7A0EB46B84FC64131DA4D037A5DFACE565C751

Function 00007FF7915763C1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF7915763D3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915763EE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157641A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157643F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157651C

Strings

Wildcard - Parsing started, xrefs: 00007FF7915764B7

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 508b81d76580ef62e4baf86a27f13d83f9d73a20277ae6bf7d054a26362ad4b1
Instruction ID: e5cf1180959dac9807e89c30edb3f773b350faf1528d3ac3b551363210dc9782
Opcode Fuzzy Hash: 508b81d76580ef62e4baf86a27f13d83f9d73a20277ae6bf7d054a26362ad4b1
Instruction Fuzzy Hash: 5A517E32A09B42C5FB25EF21E4411B8B7A5FB84B40FCA4035CA4E4B364EFB8E565D320

Function 00007FF791586AEC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791586B13
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586FCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587073

Strings

Signature Algorithm: %s, xrefs: 00007FF791587061
Signature Algorithm, xrefs: 00007FF791587047
FALSE, xrefs: 00007FF791586B08
Serial Number, xrefs: 00007FF791586FA2
Serial Number: %s, xrefs: 00007FF791586FBC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: 9e8c7cb284f0028178b84ab1b6bc8ef46dedb1954ce2fc9b2faa65e2c34104c4
Instruction ID: 9cdce4938bcff0df3a0259f97f2cc3b12859e3c4c1c5acd5f3ce8744103b864a
Opcode Fuzzy Hash: 9e8c7cb284f0028178b84ab1b6bc8ef46dedb1954ce2fc9b2faa65e2c34104c4
Instruction Fuzzy Hash: 81419F65B0878285EB31AB71D8542BAA761BB05788FC90475DE0D17B75DFBCE0648320

Function 00007FF7915496F0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154971D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF791549747
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF791549751
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154975B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF791549765
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154976F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF791549779
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF791549783
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF79154978D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF791549796
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF791551109,?,?,00000000,00007FF791551645), ref: 00007FF7915497B1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 85a0ece5a1cb627e6c5854e9dd059bec88cd1f9df4bd14cbe80c763bb3444665
Instruction ID: b6290199130611a1196ccdfd8a39199517026c21b132cdd5a91943711ec9cf8a
Opcode Fuzzy Hash: 85a0ece5a1cb627e6c5854e9dd059bec88cd1f9df4bd14cbe80c763bb3444665
Instruction Fuzzy Hash: 1521BE36694A4182DB64AF22E854139A370FB89F95F951031DE8E43B78DF7CD4A9C710

Function 00007FF79157F540 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F54C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F556
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F560
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F56A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F574
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F57E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F588
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F592
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F59C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F5A6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79157E572,?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157F5B0

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9a343c8d7024df49f697057c0738095d55ab41f5ed69fe6863ea838b53293162
Instruction ID: f04308097a2a2171f7b5bcc148950215442680a1daaca81e97db54eb2e6a5eea
Opcode Fuzzy Hash: 9a343c8d7024df49f697057c0738095d55ab41f5ed69fe6863ea838b53293162
Instruction Fuzzy Hash: 7201B526A94901C2D724AF36EC540396330FF88F5AB951031CE4E46634EE78D8B9C350

Function 00007FF79157E930 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157EA85
memcpy.VCRUNTIME140 ref: 00007FF79157EAA2

Strings

file://%s%s%s, xrefs: 00007FF79157E97E
file, xrefs: 00007FF79157E94B
%ld, xrefs: 00007FF79157E9EE
%%25%s], xrefs: 00007FF79157EAB2
https, xrefs: 00007FF79157E9C0
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF79157EC72

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: b655ed286801db7dc1d0c06a4f80f13fc68f7bfd8fd7af095c0a61b3f8b1c9e0
Instruction ID: f6c4108c7d2d5224db2b27469bfca7a77ea02a6b89dbc933e7b1d16b3d5fec88
Opcode Fuzzy Hash: b655ed286801db7dc1d0c06a4f80f13fc68f7bfd8fd7af095c0a61b3f8b1c9e0
Instruction Fuzzy Hash: 12A17362A09B8285EB75AF21E5013B9B7A4FF44B84F858135DE4D037A4DFBCE560C720

Function 00007FF79158A550 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79158A5F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158A609
memcpy.VCRUNTIME140 ref: 00007FF79158A749
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158A7A4
memcpy.VCRUNTIME140 ref: 00007FF79158A7C1

Strings

Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF79158A721
8, xrefs: 00007FF79158A7F3
cached response data too big to handle, xrefs: 00007FF79158A841
response reading failed, xrefs: 00007FF79158A7E1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: 38e50bf829b32b88b1b7dd66f86ae9a29274d4b73ef7732c7255e475e1a306da
Instruction ID: 834e1a7bd2e073f2553d9d0dbd7851f65004b2a2bc2dc9ea319e5692a87956ea
Opcode Fuzzy Hash: 38e50bf829b32b88b1b7dd66f86ae9a29274d4b73ef7732c7255e475e1a306da
Instruction Fuzzy Hash: 2181B222A18B8181EB64BB36D0443A9A3A0FB45B84FC65475DF4E47B51EFBCE4B1C760

Function 00007FF79158799C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915879DF
memcpy.VCRUNTIME140 ref: 00007FF791587A05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587AD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: eddf96903877b2e5322b609f5b0ca4e83f8c568e716df63a8e25b4df7966a020
Instruction ID: b92ee1538bff1a0dac6e83c78a8d5d8cbc4638a77d5c5297b3e0be2008d4431e
Opcode Fuzzy Hash: eddf96903877b2e5322b609f5b0ca4e83f8c568e716df63a8e25b4df7966a020
Instruction Fuzzy Hash: 11613461A0838245EB38AB7184142B9EB92FB05794FC54575CE1F0BBF5EEBCE1648320

Function 00007FF791577B60 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79154AB70: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79154ABB4

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791577C7D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791577CD5
memcpy.VCRUNTIME140 ref: 00007FF791577CFA

Strings

CSeq:, xrefs: 00007FF791577B7D
: %ld, xrefs: 00007FF791577BA1
Got a blank Session ID, xrefs: 00007FF791577C27
Unable to read the CSeq header: [%s], xrefs: 00007FF791577BD2
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF791577C8E
Session:, xrefs: 00007FF791577BEE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: c47aee06e4013a834c931363b7a2c703749fb8a99fefb27afd7b3cb79d891225
Instruction ID: 7b18e2cedfa5c3a031c076ff734497981eb641d6a48a9b66b35e589ec6b8f3ac
Opcode Fuzzy Hash: c47aee06e4013a834c931363b7a2c703749fb8a99fefb27afd7b3cb79d891225
Instruction Fuzzy Hash: 3341C761A0868282FB30AB35E4452B9A7E0EF49B84FC64131EA5E473F5DF6CE521C370

Function 00007FF7915765DE Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF791576667

Part of subcall function 00007FF791576C10: strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576C46
Part of subcall function 00007FF791576C10: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576C9B

Strings

Content-Length: %I64d, xrefs: 00007FF7915766C3
Accept-ranges: bytes, xrefs: 00007FF7915766FE
Can't get the size of file., xrefs: 00007FF791576849
failed to resume file:// transfer, xrefs: 00007FF7915769C6
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FF7915767CB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _fstat64_openstrchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 3410096895-1509146019
Opcode ID: 7378ed73dcb21346ded22b2d9b556c6f081946663b416f6b4ef74019bbd210c1
Instruction ID: c78b00d57a33c0de404e687379d6f2806bb10a2dc7483abef3631f76a99f9c20
Opcode Fuzzy Hash: 7378ed73dcb21346ded22b2d9b556c6f081946663b416f6b4ef74019bbd210c1
Instruction Fuzzy Hash: C5B19172A08A8286FB31AB3195513FAA391FB847C8FD54035DE4D87765EF7CE5208760

Function 00007FF79158BC70 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158BD08
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158BD64
strchr.VCRUNTIME140 ref: 00007FF79158BF4C
strchr.VCRUNTIME140 ref: 00007FF79158BFBA

Strings

APM0123456789:, xrefs: 00007FF79158BF45
<DIR>, xrefs: 00007FF79158BE90
0123456789-, xrefs: 00007FF79158BFB3

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 18443deb897c80c836ead0c27180152972d5a4da435ae98ade4956657e2cbdb4
Instruction ID: f16052b1c6956a84f1e6866691ef5055387ab7fd15ce05f194ffbd487eef23fb
Opcode Fuzzy Hash: 18443deb897c80c836ead0c27180152972d5a4da435ae98ade4956657e2cbdb4
Instruction Fuzzy Hash: 23B18036A087468AEB34AF35D050379A7A4FB04B48F964079CB5E47BB4CFB8E461C761

Function 00007FF79155D3C0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155D41A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155D51E
WSAIoctl.WS2_32 ref: 00007FF79155D677
setsockopt.WS2_32 ref: 00007FF79155D69F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155D796

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF79155D530
We are completely uploaded and fine, xrefs: 00007FF79155D70A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: 7275afcc4e03cfce6516acd4f452592d5d0be564c78c03bc4de6e5775ede35c3
Instruction ID: 7589802e62e3a6f7ec7ec40fb6cadfc1277375022fa86e3c4203e4f399262927
Opcode Fuzzy Hash: 7275afcc4e03cfce6516acd4f452592d5d0be564c78c03bc4de6e5775ede35c3
Instruction Fuzzy Hash: 0BB16133A18AC685EB75AF34D0543F9A790EB44B9CF890135DE4D0A7A9DFBC94A5C320

Function 00007FF791539520 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AA2D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153AA5B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79153AA69
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AAA3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153AAF4

Strings

value, xrefs: 00007FF79153A999

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: b0962a8400d41584cdb4da4ec1ab0a5144be87e245b3d2cfdff2005283219c4b
Instruction ID: 34d9862b05b40b0f04a5e0f6bab781201ba5272c3e0574a400418e6fa75e55a8
Opcode Fuzzy Hash: b0962a8400d41584cdb4da4ec1ab0a5144be87e245b3d2cfdff2005283219c4b
Instruction Fuzzy Hash: 2461A432A18A8585EB20EB74D8453EDB361EB457A4F914331DAAD47AE9DFBCD092C310

Function 00007FF791589805 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791589848
memcpy.VCRUNTIME140 ref: 00007FF79158986D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158993F
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

TRUE, xrefs: 00007FF79158995D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: dfec693e745822342e9c6ab3755d1cb7e16c56c66eb0dcf3ac3e4d9c68e03cf8
Instruction ID: c7c5d2097c5bca04b377119885aec00774795ef7c1a15d315b71834ee1347fef
Opcode Fuzzy Hash: dfec693e745822342e9c6ab3755d1cb7e16c56c66eb0dcf3ac3e4d9c68e03cf8
Instruction Fuzzy Hash: 55515A11E0D29345FB3AA6358554338FB91EB81790F8642B5C79F42EE9DFAC9065C321

Function 00007FF791576C10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576C46
_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576C9B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576D0C
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576D19
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF791576E2B

Strings

Can't open %s for writing, xrefs: 00007FF791576CAB
Can't get the size of %s, xrefs: 00007FF791576D22

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 3abd29cad80e39f2595736619c7c174b79c0ef8f974aed0c264f30db40406598
Instruction ID: f9a9a720765da7a4d4240e598a21d3fce25df6afd480215f12476b84b4bb8413
Opcode Fuzzy Hash: 3abd29cad80e39f2595736619c7c174b79c0ef8f974aed0c264f30db40406598
Instruction Fuzzy Hash: 9951E962B08A4285FB34AB35E4113BAA391FF84BD4FC64435DE4E873A4DEBCE5518320

Function 00007FF79157A6F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF79157A75C
htons.WS2_32 ref: 00007FF79157A772
send.WS2_32 ref: 00007FF79157A818
WSAGetLastError.WS2_32 ref: 00007FF79157A82C
send.WS2_32 ref: 00007FF79157A86E
WSAGetLastError.WS2_32 ref: 00007FF79157A878

Strings

Sending data failed (%d), xrefs: 00007FF79157A832, 00007FF79157A87E

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: 8f5b853d9e29d315e642986a5f4e4137993beea80c1a90e7413e487de17ad2a7
Instruction ID: b9cc6e3bcc2544be3d9d9a58cfec259e0ee597173f33bfde468b2f51d8f1c471
Opcode Fuzzy Hash: 8f5b853d9e29d315e642986a5f4e4137993beea80c1a90e7413e487de17ad2a7
Instruction Fuzzy Hash: 4641CE36608A8681EB246F75D450AACB730F754F99FC94532EB8A43764DFBCE126C321

Function 00007FF79158770E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791587718
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Part of subcall function 00007FF791550290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915502E2

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: cf7cdcf1af8fc5f3891e0b4e9c3aedad7954b003f935ee06fde832c409d8492d
Instruction ID: a1b7ceed556b4cbc0132e3b93d3e5a299dbe627fe82f8169aaeaf3c5c20bc0f7
Opcode Fuzzy Hash: cf7cdcf1af8fc5f3891e0b4e9c3aedad7954b003f935ee06fde832c409d8492d
Instruction Fuzzy Hash: 7B31A261A0878245FB71AB71D8141F9A7A2BF05788FC60875DE4E1BB75EFBCE1248320

Function 00007FF79158780D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

GMT, xrefs: 00007FF7915878CE
Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF791587941

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: 8d42fae184b4440de9f01b9aff8907addfd4940576fcc8e34f609a7710b1076c
Instruction ID: 535afe482e89e030d6b954e8085574ab548de48ce0704385a93970fb8aaca56d
Opcode Fuzzy Hash: 8d42fae184b4440de9f01b9aff8907addfd4940576fcc8e34f609a7710b1076c
Instruction Fuzzy Hash: 0E71CD61A1879284EB30EB3199041B9EBA1FB05784FC644B6CA8D07BB5DFBCE164C720

Function 00007FF791586CAD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586FCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587073

Strings

Signature Algorithm: %s, xrefs: 00007FF791587061
Signature Algorithm, xrefs: 00007FF791587047
GMT, xrefs: 00007FF791586D5E
Serial Number, xrefs: 00007FF791586FA2
Serial Number: %s, xrefs: 00007FF791586FBC
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF791586DD1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 03c7f5d1ef15c74faf8be90d268e7b7bd3b3d9348250c60332d7fe915484ba69
Instruction ID: 548875d873c359b66449d3b4c02d934499778d145a439a2565ba5c45a5ad09b1
Opcode Fuzzy Hash: 03c7f5d1ef15c74faf8be90d268e7b7bd3b3d9348250c60332d7fe915484ba69
Instruction Fuzzy Hash: AB61EE61A097D284EB30AB31D9041B9EBA1FB01784FC64476DA4D07BB9DFBCE5A5C321

Function 00007FF791587744 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7915877F9
GMT, xrefs: 00007FF7915877A6
Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 986c12c6eaa79313bafa2d781029450541fb2713f2c0ab419600bd736bf16b40
Instruction ID: 9405948bba7433a4693d9f552b517d2a063081a94e910455bdbee5ef0e45a984
Opcode Fuzzy Hash: 986c12c6eaa79313bafa2d781029450541fb2713f2c0ab419600bd736bf16b40
Instruction Fuzzy Hash: A8518E61A08B8285EB30EB71D4001E9E7A2FB45784FCA4475DA4D1BB75DFBCE564C321

Function 00007FF7915879A4 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915879DF
memcpy.VCRUNTIME140 ref: 00007FF791587A05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 4c2a392396a60d41c2b9f77c6155b2e078ba7430b296a8fdd3334a55da7192e8
Instruction ID: fa45dbfdb76d2f8092db563241507a54d030df8d8e5b7cb1ee944595c8345ed5
Opcode Fuzzy Hash: 4c2a392396a60d41c2b9f77c6155b2e078ba7430b296a8fdd3334a55da7192e8
Instruction Fuzzy Hash: 3441C161A0878245EB35EB7199141F9A7A2BF05794FC64875CE0D0BBB5EEBCE1248320

Function 00007FF791575806 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157582D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915758E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915758F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791575928
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157599C

Strings

SYST, xrefs: 00007FF7915758C6
Entry path is '%s', xrefs: 00007FF7915758FE, 00007FF791575935
Failed to figure out path, xrefs: 00007FF7915759A2

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: b56b0fb31ca6b249a82b89f34ca90b65510ceb9ac7bc31f538290324307e5f9e
Instruction ID: 4ea5a657a65b15bf54b1d547a298becebca3444e8ee7d166f2e9cb866f33d09b
Opcode Fuzzy Hash: b56b0fb31ca6b249a82b89f34ca90b65510ceb9ac7bc31f538290324307e5f9e
Instruction Fuzzy Hash: CD41A2B1A186C282EB31AB35E4153B8A7A0FB45794FD64031CA8D077B5DFBCE566C320

Function 00007FF79156C980 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CA4C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CA5A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CA68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CA76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CA84
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CA92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CAA0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CAAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156CABC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 44ba6ddfbc606770554a1c70159e410cc495aabf77cc1ebcfa696ffefd9f368c
Instruction ID: 2a5b7bd9fe03149088a18437f55f05f7f8c36175ae4d0abd02d4b315d12fe809
Opcode Fuzzy Hash: 44ba6ddfbc606770554a1c70159e410cc495aabf77cc1ebcfa696ffefd9f368c
Instruction Fuzzy Hash: 90412D32948B4282E771EF31E44023DB7A4FB48B94F868135DA8D53764DFB9D8A0C3A0

Function 00007FF7915498C0 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154993A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549944
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154994E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549958
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549962
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154996C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549976
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549980
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549989

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f3c88d784ce6539cd34ea569bb48ec2ebc8462fd64a563aa0832e8aac031a015
Instruction ID: 67767662b3daf5e7b7468ef623f0f75a77a27c328a8064615924856519462ac5
Opcode Fuzzy Hash: f3c88d784ce6539cd34ea569bb48ec2ebc8462fd64a563aa0832e8aac031a015
Instruction Fuzzy Hash: 1F312D36648A52C6E720AF22E844229B774FB88FD5F990031DE8D07B68DFBCD465C710

Function 00007FF7915497E0 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549827
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549831
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154983B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549845
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154984F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549859
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154986D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549876

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d20b14bb01e48b098ba3e8aa61b539b3530b32810483289b6e3ad828a8c2d138
Instruction ID: aef28772ee8b74b43680c69a337c02d56e8119f584078ee69ba9bde103ef68a9
Opcode Fuzzy Hash: d20b14bb01e48b098ba3e8aa61b539b3530b32810483289b6e3ad828a8c2d138
Instruction Fuzzy Hash: C221A936A48A41C2E720AF22E85402AB374FB88F95F950531DE8D43B78DF7CD8A9C750

Function 00007FF7915499E0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915499F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A17
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A2B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A35
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791549A48

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 45cfdc64d72271e08c4956cc3b07651a9a339b54b6f225ebb05eccb4156cdd5a
Instruction ID: 199e67643a4fba59ebdbd2e2f0c1d506827cc33ac5c90b487b975e9ffcda36d4
Opcode Fuzzy Hash: 45cfdc64d72271e08c4956cc3b07651a9a339b54b6f225ebb05eccb4156cdd5a
Instruction Fuzzy Hash: 1F017526694A4182DB24AF32ED54029A330FF88F96B851031CD8E43B78DF7CD8B9C350

Function 00007FF7915836F0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF791582B03), ref: 00007FF791583798
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF791582B03), ref: 00007FF7915837DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF791582B03), ref: 00007FF79158387F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF791582B03), ref: 00007FF791583892
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791583D77

Strings

Failed to encode DOH packet [%d], xrefs: 00007FF7915838D1
%s?dns=%s, xrefs: 00007FF791583868

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: 30231bb317e84fc7e98d8613c5ac5a13d7cb8ad3d65f3fcd1963505e3dc6deca
Instruction ID: bfa1758c9fddfd1809065aba021d812aa1b24ab5fe2461b4090648647784ecdc
Opcode Fuzzy Hash: 30231bb317e84fc7e98d8613c5ac5a13d7cb8ad3d65f3fcd1963505e3dc6deca
Instruction Fuzzy Hash: AA020661B187C346F7B1BAB2A8403B9A795EF41798F820075DE0C87BE6DEF8D4148360

Function 00007FF791567950 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF79154A97A,?,?,?,?,?,?,?,00007FF79154A747), ref: 00007FF791567961
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF791567B03
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF791567B20

Strings

0123456789abcdef, xrefs: 00007FF791567AF2, 00007FF791567AFC
TRUE, xrefs: 00007FF791567A8C
0123456789ABCDEF, xrefs: 00007FF791567B12, 00007FF791567B19

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: e17fdedd08ec8e3fcf0c3857282685dbc0d08f1091a9028c2ad4d52edea48d86
Instruction ID: 5c30fd60b6f70a0c2dc4724878d49b91542061802efc5ec2096ad406f563720d
Opcode Fuzzy Hash: e17fdedd08ec8e3fcf0c3857282685dbc0d08f1091a9028c2ad4d52edea48d86
Instruction Fuzzy Hash: 15512612A0DB8A41FF35AB35D00017AE390EB55BC4FDA4131DA4D067B8EEBCE561C361

Function 00007FF7915491CC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915491D2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915493C1

Strings

Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
FALSE, xrefs: 00007FF79154939B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: b110449c8ed7c2403f8f5feb9aa6ba8bb36de53f222672ca70420cff21918a71
Instruction ID: fdb05aad8fdd91fdcd53128a7e57886770ea470e2eb21b3106d2cd9c3cdeb0d2
Opcode Fuzzy Hash: b110449c8ed7c2403f8f5feb9aa6ba8bb36de53f222672ca70420cff21918a71
Instruction Fuzzy Hash: 0A616461A0978245FF71AB32E0463B9E7A1EF48754FA64035DA8D026F9DFBCE464C360

Function 00007FF79158967A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

GMT, xrefs: 00007FF79158972E
TRUE, xrefs: 00007FF79158995D
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7915897A1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: c05426ea74762394f10fd7bd49ed2c18a541350ece3eb43416b99f882381862d
Instruction ID: 72cc150c40d8a95986691e2d563a678df79ec6f8aa6fbc6fcd0bfb0e102e13e0
Opcode Fuzzy Hash: c05426ea74762394f10fd7bd49ed2c18a541350ece3eb43416b99f882381862d
Instruction Fuzzy Hash: 7C61D261A0C6E784FB31AB359544279FBA5EB81784FD64071C78E42EA8CFBCD561C321

Function 00007FF791549369 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79154936C

Part of subcall function 00007FF791567740: strchr.VCRUNTIME140 ref: 00007FF791567776

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915493C1

Strings

Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
FALSE, xrefs: 00007FF79154939B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 36c86af3f712c25ff24da92b8d3b12df536c6fe54e2b2f43b45ef366ad41ed6e
Instruction ID: 22f86d4d5c2b41da76e5f13510bf526774785bb9c6a3fc18b22ed4da5855af45
Opcode Fuzzy Hash: 36c86af3f712c25ff24da92b8d3b12df536c6fe54e2b2f43b45ef366ad41ed6e
Instruction Fuzzy Hash: 8D616361A0878245FF71AB32E0453B9E7A1AF48754FA64035DA8E026F9DEBCE464C360

Function 00007FF791570310 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157035A
memcpy.VCRUNTIME140 ref: 00007FF791570471
memcpy.VCRUNTIME140 ref: 00007FF7915704E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157050E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791570520

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF791570370

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 59b1506d615432053a037ba251dde9c0fbf304f3513c922dd98c30b466a838e1
Instruction ID: 1eb05167f8d5458ba0727d39fada45af3ec6ecc8a1ccdf9b7f04f19ef977b12a
Opcode Fuzzy Hash: 59b1506d615432053a037ba251dde9c0fbf304f3513c922dd98c30b466a838e1
Instruction Fuzzy Hash: 83516A62A187C19BEB35AB75E1006AAB7A4FB09784F850535DF8D07761DF7CE264C320

Function 00007FF791573450 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF791573513

Strings

RETR response: %03d, xrefs: 00007FF7915734A8
Maxdownload = %I64d, xrefs: 00007FF7915735AC, 00007FF79157364B
, xrefs: 00007FF7915734B7
bytes, xrefs: 00007FF791573509
Getting file with size: %I64d, xrefs: 00007FF7915735C5
Data conn was not available immediately, xrefs: 00007FF791573607

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: c7f62addd4e627b32525035210bd5a455ee2eb4cd31bec68a1edccb778b7b010
Instruction ID: ad3a973e9611c2562f58698e4f80b91d6724366b419d0184cb7fff37b272f1bb
Opcode Fuzzy Hash: c7f62addd4e627b32525035210bd5a455ee2eb4cd31bec68a1edccb778b7b010
Instruction Fuzzy Hash: 8551C762B0878581EB75AB34A4452B8F791AB45774FC60231DA5C067E1DFFCE7A28720

Function 00007FF791573220 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF7915733C6

Part of subcall function 00007FF79158A550: memcpy.VCRUNTIME140 ref: 00007FF79158A5F8
Part of subcall function 00007FF79158A550: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158A609

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF7915733D4
*, xrefs: 00007FF791573394
FTP response timeout, xrefs: 00007FF791573433
We got a 421 - timeout!, xrefs: 00007FF791573405
QUOT string not accepted: %s, xrefs: 00007FF7915733EF

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 8773dfc368e1a268cab936aa2f053949687facc79998b17a9464761e5d5552a8
Instruction ID: a1835ff5365ea058e75ee4783546b616c65ef6cffe6a9c95d726ed57c7ca4b29
Opcode Fuzzy Hash: 8773dfc368e1a268cab936aa2f053949687facc79998b17a9464761e5d5552a8
Instruction Fuzzy Hash: 3151F361B0C68281FBB4BA3598017B9A390AF457A4FC64135DE4D877E1EFBCE665C320

Function 00007FF791558470 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791582194
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915821BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915821C8

Strings

stale, xrefs: 00007FF79158211F
Digest, xrefs: 00007FF791558498
true, xrefs: 00007FF791582134

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 4b57f2dbe0b2fd15b0ccd8f458f750311f8e2330ed38b68e37d5f47516fc7e9e
Instruction ID: 8ac1eeff0b71fe50098d40d6fc1e6341a0392b295b8efa329c6fb0e462f26e4e
Opcode Fuzzy Hash: 4b57f2dbe0b2fd15b0ccd8f458f750311f8e2330ed38b68e37d5f47516fc7e9e
Instruction Fuzzy Hash: 2E518221A08A4282EB30AB35E9503B9B7A0FF44B84FD54171EA9D47AE1DF7CE575C720

Function 00007FF7915323C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791536E20: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF79153241B), ref: 00007FF791536E9E
Part of subcall function 00007FF791536E20: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF79153241B), ref: 00007FF791536EAC
Part of subcall function 00007FF791536E20: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF79153241B), ref: 00007FF791536EC2

Part of subcall function 00007FF791533C00: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF791531DDB), ref: 00007FF791533C46

Part of subcall function 00007FF791535E20: memcpy.VCRUNTIME140(?,?,?,00007FF791531E0A), ref: 00007FF791535EB1

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915324B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7915324F8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532546
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532594

Strings

, column , xrefs: 00007FF791532449
at line , xrefs: 00007FF79153240C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: 40e2edd129a8d3e628dd87717cc78c744957ab28e274330f9d88c642cb273730
Instruction ID: 9bbb98c14e35b4be6204dd2b15595596b67822f10ff65203db2738ee2674835d
Opcode Fuzzy Hash: 40e2edd129a8d3e628dd87717cc78c744957ab28e274330f9d88c642cb273730
Instruction Fuzzy Hash: 2551B262F08B4185FB20EB78D4443AC7322EB447E8F815235DA6D13BE9DE78D5A6D350

Function 00007FF791534A50 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534AE3
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534B37
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534B5E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534B86
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534BCC
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534BD3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF79153319B,?,?,?,00007FF791533154), ref: 00007FF791534BE0

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: b6cd1e8c01f3bf41d4679c4e09378afca79845054d5d10cb18157a6136c9a573
Instruction ID: 859cbba64389f716799883d9118e58af5e2799edbc268778d53477b79a622694
Opcode Fuzzy Hash: b6cd1e8c01f3bf41d4679c4e09378afca79845054d5d10cb18157a6136c9a573
Instruction Fuzzy Hash: 3D513422608641C1EF359F2AD590238E7A1EB85F95F96C631CA5E437B0CFB9D8578314

Function 00007FF791580B80 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF791564516), ref: 00007FF791580CDD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF791564516), ref: 00007FF791580CF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791580D05

Strings

Proxy-, xrefs: 00007FF791580CAD
Negotiate, xrefs: 00007FF791580B86, 00007FF791580C62
%sAuthorization: Negotiate %s, xrefs: 00007FF791580CBE
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF791580C31

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: 3fcd198ad9f128fee229caa6f2c548f91b56f287f4a465edbd8e14dc108afd23
Instruction ID: a8d4d341654563e199e842166838bdb524c4e11055b0896bb3964b8af6b6899e
Opcode Fuzzy Hash: 3fcd198ad9f128fee229caa6f2c548f91b56f287f4a465edbd8e14dc108afd23
Instruction Fuzzy Hash: D151D122A0868296FB71EF35D4802BDAB90FB40794FC60071DA4D47AA1DFBCE475C720

Function 00007FF79157CB50 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79157CB68
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79157CCD1

Strings

set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF79157CCAC
Connection time-out, xrefs: 00007FF79157CB8B
gfff, xrefs: 00007FF79157CC48
gfff, xrefs: 00007FF79157CBDC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: d6f4e6cd651ca8ddbfcbb8eebc46c1f789483de65e92877cee023f85f4940ec1
Instruction ID: e2008d5f6749ae5c31930d3a84309483e62c594dc5394687013fd31e5f66b347
Opcode Fuzzy Hash: d6f4e6cd651ca8ddbfcbb8eebc46c1f789483de65e92877cee023f85f4940ec1
Instruction Fuzzy Hash: 0D412A76B2461686DB30DF3AE040568B7A4F788F88FD15032DE1C8B764DE79E661C700

Function 00007FF79155C3B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79155C4FA

Strings

necessary data rewind wasn't possible, xrefs: 00007FF79155C505
seek callback returned error %d, xrefs: 00007FF79155C44E
Cannot rewind mime/post data, xrefs: 00007FF79155C530
ioctl callback returned error %d, xrefs: 00007FF79155C4BF
the ioctl callback returned %d, xrefs: 00007FF79155C4A5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: ba81ea258c733253544232ad77cd54e1544ced2eafcddb05c2e0cd2645770749
Instruction ID: a244d7c473cc5d1a5974e218d1edff662217fdc2bc3586aa9d37715ae5cb1c7c
Opcode Fuzzy Hash: ba81ea258c733253544232ad77cd54e1544ced2eafcddb05c2e0cd2645770749
Instruction Fuzzy Hash: C141C861B1874141EB60AB7994903B86391EF85B98FCD1031ED1E4B7A9DFBDE4A0C724

Function 00007FF791587660 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

%s%lx, xrefs: 00007FF7915876BD
Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: e1404798ec204a1f08dfa34859130285b854384ee4b2bdf1abffe2b319845c46
Instruction ID: 97b9dc98c55f3d0224193284ef215fc558607fcf00773046483eab500991ad95
Opcode Fuzzy Hash: e1404798ec204a1f08dfa34859130285b854384ee4b2bdf1abffe2b319845c46
Instruction Fuzzy Hash: 7A418261B0878245EB31AB75D8141F9A762BF05788FC64875DE4E0BB76EEBCE1248321

Function 00007FF791586B21 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586FCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587073

Strings

Signature Algorithm: %s, xrefs: 00007FF791587061
%s%lx, xrefs: 00007FF791586B76
Signature Algorithm, xrefs: 00007FF791587047
Serial Number, xrefs: 00007FF791586FA2
Serial Number: %s, xrefs: 00007FF791586FBC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: f937b6e53e7feb29d18646a697fe84cabf20e4f5067821ed2ed3503b14201dde
Instruction ID: c59ca093728c9a057db1a6fa58a3961f86dfa133e1d828d6cf675cee30e316f2
Opcode Fuzzy Hash: f937b6e53e7feb29d18646a697fe84cabf20e4f5067821ed2ed3503b14201dde
Instruction Fuzzy Hash: 0041B351B0978285FF30B77195141B9A7A1AF05784FC648B5DD0E0BB76DEBDE0648320

Function 00007FF79158980D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791589848
memcpy.VCRUNTIME140 ref: 00007FF79158986D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

TRUE, xrefs: 00007FF79158995D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: 797108affdb01d4f9068d586920d5b79b2544d3eb3f582b93815dfb2d58ee6ff
Instruction ID: 9774c86b64e96d4af3ee3d2f08d1dc666c1fb3fbfcc9efed368150bfb363cf27
Opcode Fuzzy Hash: 797108affdb01d4f9068d586920d5b79b2544d3eb3f582b93815dfb2d58ee6ff
Instruction Fuzzy Hash: F031E611E0D69345FB36EB358544338FB919B91B90FC606B1CA9E42EE9DFACA461C321

Function 00007FF791580480 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79156BF90: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156BFB8
Part of subcall function 00007FF79156BF90: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156BFDE
Part of subcall function 00007FF79156BF90: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156BFFF
Part of subcall function 00007FF79156BF90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791550509,?,?,?,?,00007FF79154F8AB), ref: 00007FF79156C010

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158051F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791580568
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791580571

Strings

%s%s.netrc, xrefs: 00007FF7915804DF
HOME, xrefs: 00007FF7915804B9
%s%s_netrc, xrefs: 00007FF791580534

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: 11678300f3a65e2ebe7dd327e7b62063b0fdb97fd59900a9b8865251fc3ba6fc
Instruction ID: a2abad9c8ec25b6d1ef7fb5b25b1c74de1e7697b2de06e1e8ce418151027f8ab
Opcode Fuzzy Hash: 11678300f3a65e2ebe7dd327e7b62063b0fdb97fd59900a9b8865251fc3ba6fc
Instruction Fuzzy Hash: 69316221A09B4186EB30EB36B80016AE2A0BF84BD4FC90531ED9C47B75EE7CE5658730

Function 00007FF79156E986 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79154AB70: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79154ABB4

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156E9C4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79156E9D6

Strings

OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF79156E9A8
Select failed, xrefs: 00007FF79156EA68
Mailbox UIDVALIDITY has changed, xrefs: 00007FF79156EA0E

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 35f01e764a00a63fdd80c7edf4d65bd4adb7ef4f57062dd272d495f881a3f536
Instruction ID: e885ad332db4e3584971fdadddf1843aa044ab3e52235909ad48038ca8c85bbb
Opcode Fuzzy Hash: 35f01e764a00a63fdd80c7edf4d65bd4adb7ef4f57062dd272d495f881a3f536
Instruction Fuzzy Hash: 63311C22A0AA4281EB74FB30D64017EA260FF45BD4FD68431DA0E07675DFBCE86183A1

Function 00007FF791555690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF791552A0C), ref: 00007FF7915556C5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF791552A0C), ref: 00007FF7915556F1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF791552A0C), ref: 00007FF7915556F9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF791552A0C), ref: 00007FF79155571B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF791552A0C), ref: 00007FF791555732

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF791555704

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 7d8c82fc3443e1c5fe112937d62e5dbd682e4438b59a71d9c0582465ea641deb
Instruction ID: c0264affedf975a3d3d487cbbb0d6ac887e9439921f515708fc7eb5a2a27f851
Opcode Fuzzy Hash: 7d8c82fc3443e1c5fe112937d62e5dbd682e4438b59a71d9c0582465ea641deb
Instruction Fuzzy Hash: 6B116072A2964282EB20AB71E850279B360EF85B94FD60031DA0D43674DF7CD8A4CB20

Function 00007FF7915555C0 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF7915555D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF7915555EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF7915555FE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF791555612
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF791555626
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79155563A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79155564E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF791555662

Part of subcall function 00007FF79157E560: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79155567B,?,?,00000000,00007FF7915510C3,?,?,00000000,00007FF791551645), ref: 00007FF79157E575

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1a30f36b69fe1244b92a04a05d2ee0cb853c9f4f7a991a359fa701792e32e937
Instruction ID: caa79ab948a71f96706a0742af414039ee728e52209634139e24be8fdc066010
Opcode Fuzzy Hash: 1a30f36b69fe1244b92a04a05d2ee0cb853c9f4f7a991a359fa701792e32e937
Instruction Fuzzy Hash: DB115636548F81C1D7109F31ED940ED73B4FBC9F9AB990135DE4E4F664AF7490A58220

Function 00007FF79154A800 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A80D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A817
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A821
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A82B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A835
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A83F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A849
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154A853

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ae8141b37bd11375d94014df823949d19714f6fedba8869df557bea043aa866b
Instruction ID: 3f2200af0f36213b30294761ff4b8fc0bc894b3088bac4e30716c8418ea3c213
Opcode Fuzzy Hash: ae8141b37bd11375d94014df823949d19714f6fedba8869df557bea043aa866b
Instruction Fuzzy Hash: 93F0F926AD4901C2D724AF32EC540396330FB88F56B951031CD4E46734DE7CD8B9C350

Function 00007FF791552170 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7915529EB), ref: 00007FF791552187
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7915529EB), ref: 00007FF7915521B8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: db86a635e11080c5c1ab062bf3df706a8b265d8341c3dd92645d930b89413c27
Instruction ID: 97f079e21e24de1857d32155d238f3848554ffd927a22d9c54b22bf51cfba883
Opcode Fuzzy Hash: db86a635e11080c5c1ab062bf3df706a8b265d8341c3dd92645d930b89413c27
Instruction Fuzzy Hash: 0E919C26609BC1C9E7259F3494503E97BA0FB55B28F480235DFAC0B3E6DF79A1A4C721

Function 00007FF79158742C Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158746F
memcpy.VCRUNTIME140 ref: 00007FF791587495
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587568
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915875D9

Strings

Start Date: %s, xrefs: 00007FF7915875C7
Start Date, xrefs: 00007FF7915875AD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: e1f34b3e4c8775197c01e2e21828fdb8f5951c05569b637eae09db5797127e21
Instruction ID: 0e9833eb3a2435f53d94ed63a43a7ca88846a1f6c1783f2163b9e9f6956ef555
Opcode Fuzzy Hash: e1f34b3e4c8775197c01e2e21828fdb8f5951c05569b637eae09db5797127e21
Instruction Fuzzy Hash: 54415851A092C206FF38E63585142B9AB92FB067A0FC94275CA1F07FF1DEACE1658331

Function 00007FF79153C650 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79153C73A
memcpy.VCRUNTIME140 ref: 00007FF79153C749
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153C77D
memcpy.VCRUNTIME140 ref: 00007FF79153C784
memcpy.VCRUNTIME140 ref: 00007FF79153C793
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79153C7B8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: f4946f941e4c17ddfb1f100160175e899db4a10eb8282197510e30b0fdd30d9f
Instruction ID: 5c90d19308fc7544f17bc288c900ffdf10c1215025572c199dd000cc39605b28
Opcode Fuzzy Hash: f4946f941e4c17ddfb1f100160175e899db4a10eb8282197510e30b0fdd30d9f
Instruction Fuzzy Hash: A831B32271864585EF25AB36A5041A9E355AB04BE0FC50636DE7E07BE5DFBCE062C350

Function 00007FF791558850 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF791558935
VerSetConditionMask.KERNEL32 ref: 00007FF791558944
VerSetConditionMask.KERNEL32 ref: 00007FF791558956
VerSetConditionMask.KERNEL32 ref: 00007FF791558968
VerSetConditionMask.KERNEL32 ref: 00007FF79155897E
VerifyVersionInfoA.KERNEL32 ref: 00007FF791558991

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: f69341c057864ed04e6336271137f050eaba8f7dd1844b03facb8b24132df4dc
Instruction ID: 12b3f92857cfbeef9d70633cd8505dc9e3222e43afee869ffbb45090644aaf54
Opcode Fuzzy Hash: f69341c057864ed04e6336271137f050eaba8f7dd1844b03facb8b24132df4dc
Instruction Fuzzy Hash: 4C41D932E1C69186F3709B22B4247BAF360FBD5300F465235E9C902B64DF7DE4959B10

Function 00007FF79158795F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: d1c7aa22a3ebaa90cfb47ca1aed17a22c6573e906b6e029a11cb94b8002c73e6
Instruction ID: 26a7e397e0dd97dc7571eee216916ed34bc519409c99640d01486317c33bc63a
Opcode Fuzzy Hash: d1c7aa22a3ebaa90cfb47ca1aed17a22c6573e906b6e029a11cb94b8002c73e6
Instruction Fuzzy Hash: 9441B361B087C249EB20AB71D8041F9B762FB05798FC94975DE4D0BBA5EFBCE1648320

Function 00007FF7915822F0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF7915818AF), ref: 00007FF791582336
strchr.VCRUNTIME140(00000000,?,?,00007FF7915818AF), ref: 00007FF791582346
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7915818AF), ref: 00007FF791582370
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915823A5
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915823CA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915823EC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 1677f491da56c31d9bc27dad521c033c8ef2337b3f349c1f4848790553d3eaf1
Instruction ID: 2433fb43476d9d4c8ee67449d3f4d5624e5af633b11e2a7437fbf66ba6787cad
Opcode Fuzzy Hash: 1677f491da56c31d9bc27dad521c033c8ef2337b3f349c1f4848790553d3eaf1
Instruction Fuzzy Hash: 85318631A0978186EB75FF32A550279BAA0EF45B90F8A4674DE4E07BA5DF7CE061C310

Function 00007FF79158D8A0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158D949
memcpy.VCRUNTIME140 ref: 00007FF79158D965
memcpy.VCRUNTIME140 ref: 00007FF79158D97C
memcpy.VCRUNTIME140 ref: 00007FF79158D997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158D9CA

Strings

PLAIN, xrefs: 00007FF79158D8AB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: d491e20f71187af9eb1b778267a24f4ac6441dc72d2dbbad8917bb7425889afd
Instruction ID: d43919ed6077f50f42cabe6daa373d7043dc63f6eae086b51cc97ba249d7ea37
Opcode Fuzzy Hash: d491e20f71187af9eb1b778267a24f4ac6441dc72d2dbbad8917bb7425889afd
Instruction Fuzzy Hash: 7431F466A08B8182EB20AF25E4402BAE790FB45BE4FC58631DE9D47BE6DF7CD055C310

Function 00007FF7915876D5 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: a47490ab04a1024b6540fdcf0903e2dd3ce6b307e849c0c07af588718565efd8
Instruction ID: 8e4a2fae97aa46037d6b57d547cf485b3079347a374ac5e6ce41f534305137f8
Opcode Fuzzy Hash: a47490ab04a1024b6540fdcf0903e2dd3ce6b307e849c0c07af588718565efd8
Instruction Fuzzy Hash: E6318261A0878245EB71BB71D8101F9A762BF45788FC64875DE4E1BB76EFBCE1248320

Function 00007FF79156F981 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156FA06
memcpy.VCRUNTIME140 ref: 00007FF79156FA21
strchr.VCRUNTIME140 ref: 00007FF79156FA3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156FA4E

Strings

Got unexpected pop3-server response, xrefs: 00007FF79156F9A1
CAPA, xrefs: 00007FF79156FA64

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: a0ae662054a5e8a79fe7307aa7c92a9a5a8539b4314879c13f6d2ffa87668e3c
Instruction ID: a1d353031e2a811fbb7473f2e88ce26e1d071876c81464f5bb7ea9fe91804ef3
Opcode Fuzzy Hash: a0ae662054a5e8a79fe7307aa7c92a9a5a8539b4314879c13f6d2ffa87668e3c
Instruction Fuzzy Hash: 45319162F0DB8292FB25AB31D020279A690BB01794FC64536CA1E037A5DFBCE5B5C361

Function 00007FF791587726 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791588850: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158889C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Part of subcall function 00007FF791550290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915502E2

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 6db36f68a94632dfa6742778fc218651626241952eba7d484c6fb128a2df3631
Instruction ID: 6ac49daba81f4e8228b473b23c06042214643518c6beb1db8d37e945b5c8db11
Opcode Fuzzy Hash: 6db36f68a94632dfa6742778fc218651626241952eba7d484c6fb128a2df3631
Instruction Fuzzy Hash: 6931B361A0878245EB70AB71D8101F9A762FF05788FC64875DE4D1BB76EFBCE1248320

Function 00007FF7915876F3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79158A360: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158A395

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587B49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587C12

Part of subcall function 00007FF791550290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915502E2

Strings

Expire Date, xrefs: 00007FF791587B1D
Public Key Algorithm: %s, xrefs: 00007FF791587BE2
Public Key Algorithm, xrefs: 00007FF791587BC8
Expire Date: %s, xrefs: 00007FF791587B37

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 5b7011ea32cdbfdc32a94f7bcf5d0a16212c0ea1e64ccec39d49c5aeaf9aef24
Instruction ID: 3af2c29e66847972bf2c29db510aaa7a7ae564b2cfb12976ee0a8ed465ca743f
Opcode Fuzzy Hash: 5b7011ea32cdbfdc32a94f7bcf5d0a16212c0ea1e64ccec39d49c5aeaf9aef24
Instruction Fuzzy Hash: 0631A361A0878245EB70AB71D8101F9A762BF45788FC54875DE4D1BB75EFBCE1248320

Function 00007FF791587C90 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588149
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158819C

Strings

%s%lx, xrefs: 00007FF791587CED
Signature: %s, xrefs: 00007FF791588137
Signature, xrefs: 00007FF79158811F

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 5a10c59e12b139048f74a5d902ad0d20fb8b764092e03cdd59b3bb008492b819
Instruction ID: bcafce561a27f562d2b0bc2f1e83c151b8fdb6f2a154b106dc5d7a600c56d56d
Opcode Fuzzy Hash: 5a10c59e12b139048f74a5d902ad0d20fb8b764092e03cdd59b3bb008492b819
Instruction Fuzzy Hash: CE31A562B0868286EF30AB35E8442B9A3A1FB85BC4FD50472DE4D07B75EE7CE0118750

Function 00007FF791586B91 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791586FCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791587073

Strings

Signature Algorithm: %s, xrefs: 00007FF791587061
Signature Algorithm, xrefs: 00007FF791587047
Serial Number, xrefs: 00007FF791586FA2
Serial Number: %s, xrefs: 00007FF791586FBC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 03e8a4887868519fec95eb8e985398e0d92366e3d37bd73ee15f631fe437f075
Instruction ID: fb0993461a330ece2937a3e22b2001518c4ede049f6717f373eae1c877362504
Opcode Fuzzy Hash: 03e8a4887868519fec95eb8e985398e0d92366e3d37bd73ee15f631fe437f075
Instruction Fuzzy Hash: 61319051A0978285FB30BB71D8141F9A7A1AF05788FCA48B5DD0E0BB76DEBCE0648320

Function 00007FF7915759B3 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915759CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791575A4B

Strings

OS/400, xrefs: 00007FF791575A19
SITE NAMEFMT 1, xrefs: 00007FF791575A2C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 339976b47e4f5bd8a11752ac04a3e2dbe4015902d4f9326f450148596bcc9325
Instruction ID: 6e5b7fc0f81afe81246004fe05c0a75fe8c4ac2520641794f85f55b6f36cd6ed
Opcode Fuzzy Hash: 339976b47e4f5bd8a11752ac04a3e2dbe4015902d4f9326f450148596bcc9325
Instruction Fuzzy Hash: AB31F461A1C6C385F771AB3594513B9A3A0BB45794FC10031CE8D53BA5EFBCE6A6C320

Function 00007FF7915492F8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7915677F0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567811

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915493C1

Strings

Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
FALSE, xrefs: 00007FF79154939B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 16d92533ed94cc6be2cfafb21bf420aefde2c13394e1be7ca7b1b029f3acb6e1
Instruction ID: 74d0cdb965d4e14369ef08442ab812c007ae1cc143e0fda16f253311f7adb778
Opcode Fuzzy Hash: 16d92533ed94cc6be2cfafb21bf420aefde2c13394e1be7ca7b1b029f3acb6e1
Instruction Fuzzy Hash: 9B616461A0878645FF71AB32D0463B9E7A1EF48754FAA4035DB8D026F9DEBCE854C360

Function 00007FF7915491ED Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791567740: strchr.VCRUNTIME140 ref: 00007FF791567776

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915493C1

Strings

Added, xrefs: 00007FF79154965D
Replaced, xrefs: 00007FF791549651
FALSE, xrefs: 00007FF79154939B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF791549667

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: 7f613c9187ffd283597d18c173bc281dc25db3830c38ef076151ae38b9b06164
Instruction ID: d56928e920ecdfa60ebe1a8fe312baf9b0447c34680ced7e274ca47465574f81
Opcode Fuzzy Hash: 7f613c9187ffd283597d18c173bc281dc25db3830c38ef076151ae38b9b06164
Instruction Fuzzy Hash: B5617461A0878245FF71AB32D0463B9E7A1AF48754FA64035DB8D026F9DFBCE454C361

Function 00007FF7915621F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915623FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791562415

Strings

The requested URL returned error: %d, xrefs: 00007FF79156239E
Forcing HTTP/1.1 for NTLM, xrefs: 00007FF7915622B9

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: f96d8a384c648aa43f7340c33562d14107f509cc3114149196f2db844e24ed54
Instruction ID: a27d90efd0c113faac3698256fe9d3ddbc2aa291f945ae073a9ffa1292312e33
Opcode Fuzzy Hash: f96d8a384c648aa43f7340c33562d14107f509cc3114149196f2db844e24ed54
Instruction Fuzzy Hash: FA51A232B0CA8381FB75AA3490402BDB791EB517D4FD90135DA4D8A6A5CFACE470C7B0

Function 00007FF791532660 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791534360: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391

Part of subcall function 00007FF791533C80: memcpy.VCRUNTIME140 ref: 00007FF791533CD3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532732
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791532780
__std_exception_copy.VCRUNTIME140 ref: 00007FF7915327D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79153281D

Strings

out_of_range, xrefs: 00007FF7915326A6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: cf0025d20a196b533ec9758bf7b5687e1eaeaacf6ec75d2422ac06fe393b2d3a
Instruction ID: 1d0387b500d212b4c8ea066d096e38298e8864a91d391fa7f5d26532b9f19ae1
Opcode Fuzzy Hash: cf0025d20a196b533ec9758bf7b5687e1eaeaacf6ec75d2422ac06fe393b2d3a
Instruction Fuzzy Hash: F5517D22A18B42D9FB10EF74D4803AC7365FB487A8F814235EA5D43AE9DFB8D1A5C350

Function 00007FF79157F5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157F648
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157F67A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157F6EA

Part of subcall function 00007FF791567950: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF79154A97A,?,?,?,?,?,?,?,00007FF79154A747), ref: 00007FF791567961

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157F765

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF79157F63E

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 29ea01a4979f949b750ea44df9b1ca1ae3a8a8fb8b9e2afb513441852c786f98
Instruction ID: 7896de884b793247fb7203146efe3a18f9ba8048fb4dd5313522f7889e6fdd00
Opcode Fuzzy Hash: 29ea01a4979f949b750ea44df9b1ca1ae3a8a8fb8b9e2afb513441852c786f98
Instruction Fuzzy Hash: 1841E112A0CA8645FB31EB3498013B9FB90EB05754FCA0136CAAD877A1CFACE565C721

Function 00007FF7915895B8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF791589666
GMT, xrefs: 00007FF791589614

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 899afc9ec5bf0135a55d34022ee5cb3ddc18d012a7ebd8148d52db109e92a3be
Instruction ID: 16603a16786b21ecfad0b2ecddcdeac80e61206aa4a03b9d9052ac9c135da594
Opcode Fuzzy Hash: 899afc9ec5bf0135a55d34022ee5cb3ddc18d012a7ebd8148d52db109e92a3be
Instruction Fuzzy Hash: C941D321A0CAD685F7319B35914427CFB91EB81780FDA41B1C78E12EA9DFACE561C321

Function 00007FF791534360 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534391
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF791534456
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF7915344AA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7915344B1

Part of subcall function 00007FF79158F240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79153443E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF79158F25A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF791534362

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: c9098aa0f132876052a05daecb5826b5a126c3d849c815ea43358e726910f6a4
Instruction ID: 4b3afa04d48ce6877ecd34fbc58e648fd05a0e24018afcf67bbc3cd69513bae1
Opcode Fuzzy Hash: c9098aa0f132876052a05daecb5826b5a126c3d849c815ea43358e726910f6a4
Instruction Fuzzy Hash: AE31F522B0568584FF2AEA7595442789245DB04FF4F860631CE2D07BE9DEBCE8E38350

Function 00007FF7915406D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF791531205), ref: 00007FF7915407AF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF791531205), ref: 00007FF7915407EC
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF791531205), ref: 00007FF7915407F6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF791540829

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7915406D2

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: a92a7fdf1f37a9b18442440697b212602e5573c353e28f5fc24c134ffdd46036
Instruction ID: 03a737ae0acba9e5d7a1ca9a40d0e204b600aacdd47ecfd2146b8b174787ceb2
Opcode Fuzzy Hash: a92a7fdf1f37a9b18442440697b212602e5573c353e28f5fc24c134ffdd46036
Instruction Fuzzy Hash: AA312721B0974186FF24EB31E5403B9E355AB04BD0FA50635DE5E07BE5DEBCE0618351

Function 00007FF791576A60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79156C0D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF79155345F), ref: 00007FF79156C0FE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791576B1F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791576B6B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791576B82
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791576B9B

Strings

Couldn't open file %s, xrefs: 00007FF791576B49

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 70df7cfdb300e0ef419b1c4a81927150578117380e0dca2887bdbdf90ba0c024
Instruction ID: fe0f9a76445439f4a8f42acdee240eb10c9079a491080cbe5e71687aeb131276
Opcode Fuzzy Hash: 70df7cfdb300e0ef419b1c4a81927150578117380e0dca2887bdbdf90ba0c024
Instruction Fuzzy Hash: A6418131608A8181EB24AF35E40127AF7A1FB45BD4FC98131DA9D877A4DFBCE561C710

Function 00007FF79155A560 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155A5E9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155A67F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155A6A7

Strings

identity, xrefs: 00007FF79155A5A3, 00007FF79155A613, 00007FF79155A678
Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF79155A695

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: e8e9e23f53167017a8f6870da19c5f8ffb6a538d0ab06303ae6017882bfb1956
Instruction ID: b8907cdebaadce75294f42764826756381fa921dc592da415b2f5c8426d5c4b0
Opcode Fuzzy Hash: e8e9e23f53167017a8f6870da19c5f8ffb6a538d0ab06303ae6017882bfb1956
Instruction Fuzzy Hash: 1741A161E09A4281EF21AF21D510278E7A0EF85FE4FC64231DE5D077A4EFBCE4628320

Function 00007FF79155C860 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155C955
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155C9B4

Strings

Connection died, tried %d times before giving up, xrefs: 00007FF79155C918
Connection died, retrying a fresh connect, xrefs: 00007FF79155C93F
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF79155C8EB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: fcc544f16851bc73d858e57f6f7ba6db9c671d4a8a1d05bd96e88d17b5b17faa
Instruction ID: e1bdf3292b485e241b5f8154ec52281cba5cfdf0338f242f16f8b8040b9764a8
Opcode Fuzzy Hash: fcc544f16851bc73d858e57f6f7ba6db9c671d4a8a1d05bd96e88d17b5b17faa
Instruction Fuzzy Hash: 3341A432B0868681E7659B35E0603B9A7A4EB44B88F894031EB5D07765CFBDE4B0C710

Function 00007FF7915894A9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915894D0
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

FALSE, xrefs: 00007FF7915894C5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: a04c7c05110be40352b00791634eea04e9bb9383216d3d638ec084eafd063cd1
Instruction ID: ea2587d102114797b2c19020400eadb5918f47c7866f256dcc7a2ef4952180e7
Opcode Fuzzy Hash: a04c7c05110be40352b00791634eea04e9bb9383216d3d638ec084eafd063cd1
Instruction Fuzzy Hash: CD31C422E0D59745FB32DB39944433CFB909B81764FC606B1C69E41DE9CFAC94A1C321

Function 00007FF791540830 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791533DC0: memcpy.VCRUNTIME140(?,?,0000000100000000,00007FF79154088D), ref: 00007FF791533E72
Part of subcall function 00007FF791533DC0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF791533E97

Part of subcall function 00007FF791533DC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0000000100000000,00007FF79154088D), ref: 00007FF791533E54

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791540AA0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791540AA7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791540AAE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791540AB5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791540ABC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: c7b33724828ad5913de813b61021c837115092824466ceea439c2b3ebe092784
Instruction ID: 3a17b60493cc359e437a902f82d5987b380bc931c35cfaada9cc19ef38540407
Opcode Fuzzy Hash: c7b33724828ad5913de813b61021c837115092824466ceea439c2b3ebe092784
Instruction Fuzzy Hash: 87619372A0478186EB20EF35E4987BDB361EB55BC4FA24035DA8D07AA5DFBCD4A0C350

Function 00007FF791566A9D Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF791566B61

Strings

warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu, xrefs: 00007FF791566C39
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu], xrefs: 00007FF791566C19
unknown, xrefs: 00007FF791566B2A
SOCKS5: connecting to HTTP proxy %s port %d, xrefs: 00007FF791566BF0

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memset
String ID: SOCKS5: connecting to HTTP proxy %s port %d$SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]$unknown$warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %lu
API String ID: 2221118986-3012371547
Opcode ID: e1ef38b987f7c886a3e5d23ef69143fd2acd9eaf80384948b99344f75d2025ee
Instruction ID: 1962347ea26511acfca1bc03f99d59a1cbc57f901f2cc3a104994ac8c875285e
Opcode Fuzzy Hash: e1ef38b987f7c886a3e5d23ef69143fd2acd9eaf80384948b99344f75d2025ee
Instruction Fuzzy Hash: 8E61C273A08A818BEB21DB34E4413ADBBA0F791B98FC48535DA59877A5DF7CE051CB10

Function 00007FF791584380 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7915842E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584306
Part of subcall function 00007FF7915842E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584327
Part of subcall function 00007FF7915842E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584342
Part of subcall function 00007FF7915842E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584350
Part of subcall function 00007FF7915842E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584362

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791584406

Strings

HTTP, xrefs: 00007FF79158438A
NTLM, xrefs: 00007FF7915843BE, 00007FF791584470

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: f13010c06005385fa2c38c8bc62cac4d61d4add9b92614968997d4a39fb32610
Instruction ID: 5b77b7ab00a2c4589d118b32555fe8eb1fa3d42dfcb03f2923a1b892805c7213
Opcode Fuzzy Hash: f13010c06005385fa2c38c8bc62cac4d61d4add9b92614968997d4a39fb32610
Instruction Fuzzy Hash: 2F613B36609B8582EB709F25E44076EB7A4FB88B84F954035DE8D43B68EF7CD864CB50

Function 00007FF791571A8B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791571B40

Strings

control connection looks dead, xrefs: 00007FF791571D32
Failure sending ABOR command: %s, xrefs: 00007FF791571C61
ABOR, xrefs: 00007FF791571C3B
Remembering we are in dir "%s", xrefs: 00007FF791571BD8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: d7144038f99b8f4fdb663460d3a916383155e9212e71fab8f310bfecfc70b84e
Instruction ID: 4e5f96abf29288f33054f1401b41a2ad7b414400abdc1b0ce6d870ba41f3b7fa
Opcode Fuzzy Hash: d7144038f99b8f4fdb663460d3a916383155e9212e71fab8f310bfecfc70b84e
Instruction Fuzzy Hash: D951D66190C68241EB74F77090923B9E794EB413A4FC20235DA6E477E2DFFCE5658361

Function 00007FF79158D630 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF79158D5F0), ref: 00007FF79158D69F

Part of subcall function 00007FF791567950: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF79154A97A,?,?,?,?,?,?,?,00007FF79154A747), ref: 00007FF791567961

Part of subcall function 00007FF791567950: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF791567B03
Part of subcall function 00007FF791567950: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF791567B20

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF79158D5F0), ref: 00007FF79158D70E
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF79158D5F0), ref: 00007FF79158D728
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF79158D5F0), ref: 00007FF79158D75E

Strings

xn--, xrefs: 00007FF79158D745

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: ba45f873b2e2cea54c9e497a3bdb6003d2559a391a5387adfe09830db2b5c053
Instruction ID: 66c1782bcfc8c232984cb09f7047ef80ba33fd116fb2756fb69776a5849946d7
Opcode Fuzzy Hash: ba45f873b2e2cea54c9e497a3bdb6003d2559a391a5387adfe09830db2b5c053
Instruction Fuzzy Hash: 5F41A151B0D6C206FB74BA31951537996C19F45FC0FCA8174DE4E87BE2EEADE4618320

Function 00007FF79155B720 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF79155B7C8
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155B848
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155B8F2

Strings

allocate connect buffer!, xrefs: 00007FF79155B86F
CONNECT phase completed!, xrefs: 00007FF79155B933

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 4b69e7b74066c9d373d9dcad0cdaa0325d0bbb9eff9b2c6c5768e42057e4fdf3
Instruction ID: 85c4da2d4b067663c75487764f7f976d99c52c4e4a52d6428655151a05dd38c7
Opcode Fuzzy Hash: 4b69e7b74066c9d373d9dcad0cdaa0325d0bbb9eff9b2c6c5768e42057e4fdf3
Instruction Fuzzy Hash: A3519232F0868686E739AB35D5583B9B3A1FB44748F894035EB5C072A1DFB8E575C310

Function 00007FF7915872A3 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915875D9

Strings

Start Date: %s, xrefs: 00007FF7915875C7
Start Date, xrefs: 00007FF7915875AD
GMT, xrefs: 00007FF79158735E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7915873D1

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 4ae200d608718c9141bd5620d1ebce739c46edf00a8121cf181d00ffb641913f
Instruction ID: 4a4c8c966722d03ac0f28dfa92ea675ed4b229dcd2300f5d528134fba9a1b426
Opcode Fuzzy Hash: 4ae200d608718c9141bd5620d1ebce739c46edf00a8121cf181d00ffb641913f
Instruction Fuzzy Hash: 9251D361A0C6D285EB30EB3499041B9FBA5FB01780FD684B1DA8D06A74CFBCE665C321

Function 00007FF79156E4A0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7915677F0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF791567811

memcpy.VCRUNTIME140 ref: 00007FF79156E611
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79156E61F

Strings

Failed to parse FETCH response., xrefs: 00007FF79156E4FE
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF79156E5DD
Found %I64d bytes to download, xrefs: 00007FF79156E572

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 637d9d91b84d883651ba78f8bd67d6fc13e0c300ea87d372d29132a2da1077df
Instruction ID: c6eab7b014392e8a51c02d92f25fd77365bf90d47789c676fa70b32ea52dd20d
Opcode Fuzzy Hash: 637d9d91b84d883651ba78f8bd67d6fc13e0c300ea87d372d29132a2da1077df
Instruction Fuzzy Hash: D5519122A0CB8682EB34EA75D5102EDE360FB45BD4F858031EA9D036A5EFBCE4658751

Function 00007FF7915871E0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915875D9

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF79158728F
Start Date: %s, xrefs: 00007FF7915875C7
Start Date, xrefs: 00007FF7915875AD
GMT, xrefs: 00007FF79158723C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: 683ee78d1b68b9e223be132289566ca981066a74fe3e5bff9baaf7a65c0b56bd
Instruction ID: 93badde92f1404682290f796d84d35f616c32263f28a112d281eed306623c3ec
Opcode Fuzzy Hash: 683ee78d1b68b9e223be132289566ca981066a74fe3e5bff9baaf7a65c0b56bd
Instruction Fuzzy Hash: E9317E61A0CB8285EB30EB30A5401F9E791FB05B84FDA4471D64E1BAB5DFBCE565C321

Function 00007FF791587434 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158746F
memcpy.VCRUNTIME140 ref: 00007FF791587495
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915875D9

Strings

Start Date: %s, xrefs: 00007FF7915875C7
Start Date, xrefs: 00007FF7915875AD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: d217930c3833a622d26a54e2cb1d6b45b8cef9a0b45b0d452578392151e7ea81
Instruction ID: f3e5bad82a0160ca2b63e9b79c0fa05d76fa8a14b5f6c052aec8b2645b02adeb
Opcode Fuzzy Hash: d217930c3833a622d26a54e2cb1d6b45b8cef9a0b45b0d452578392151e7ea81
Instruction Fuzzy Hash: 6821AC50A093C242EF35EB3699042B9A752BF15BE4FCA4571C90E07BF1EEBCA1648321

Function 00007FF791587D08 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588149
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791588189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158819C

Strings

Signature: %s, xrefs: 00007FF791588137
Signature, xrefs: 00007FF79158811F

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 669e0853c614df204427bf6a0c54b858da688f40652f90c3cf2fe78feb91b896
Instruction ID: 61f964c92bc2c9c388d37140295d770c9878c8d9b66de8ea5b8ea6967ed0545b
Opcode Fuzzy Hash: 669e0853c614df204427bf6a0c54b858da688f40652f90c3cf2fe78feb91b896
Instruction Fuzzy Hash: F5216262A08A8686EB70AB75E8442BAA360FF857C4FC50432DE4E17B65EE7CD0618750

Function 00007FF791542C90 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7915425C9), ref: 00007FF791542F2F

Strings

Unrecoverable error in call to nameserver, xrefs: 00007FF791542F1C
Host not found, xrefs: 00007FF791542EF8
Host not found, try again, xrefs: 00007FF791542F25
No data record of requested type, xrefs: 00007FF791542F13

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 8b711adde57631c56a38b82b1329e3b13cead0ff2e0d4e272cc8a1744a76445f
Instruction ID: 8bf26629115839f6fa9c80287476d89a90132034666b543f8c676d4a59995e5c
Opcode Fuzzy Hash: 8b711adde57631c56a38b82b1329e3b13cead0ff2e0d4e272cc8a1744a76445f
Instruction Fuzzy Hash: D9112962E0C24291EB7DA738F994278A290AF05380FEB5071C61E066F5DEFCE4B0D631

Function 00007FF79154AC50 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF79154B0F3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF79154B107
CloseHandle.KERNEL32 ref: 00007FF79154B114
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF79154B136
closesocket.WS2_32 ref: 00007FF79154B154
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF79154B16D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 55ef4f75ae426a7d2932eb0e3e79e76d48fe59f16d8dc10ebdd339e272a43add
Instruction ID: e05b30cdf29f39179cd6b9155d89cea1e382bdb1e14dcf1f4f8d781a9e9824f3
Opcode Fuzzy Hash: 55ef4f75ae426a7d2932eb0e3e79e76d48fe59f16d8dc10ebdd339e272a43add
Instruction Fuzzy Hash: C3110076A08B4196E724AF22E544229B370FB49B90F954131DF8E43B64DF79E4758720

Function 00007FF7915657E0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF791565B32

Strings

%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF79156587B
** Resuming transfer from byte position %I64d, xrefs: 00007FF791565868
%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF791565AC5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: e35c377f891361ef5da9e041a94235e5a588d00ac08ec145806df9b12a25e4e7
Instruction ID: 702c82de9dd980ad54d2c8a28f0efd6de9aaed53c07205a8c5eeb6e4fc3a0839
Opcode Fuzzy Hash: e35c377f891361ef5da9e041a94235e5a588d00ac08ec145806df9b12a25e4e7
Instruction Fuzzy Hash: 1291AF62716B8685DB30EB26E4487AAB364FB84BC0FC21032DE4D47BA5EF78D015D740

Function 00007FF791572800 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79158A550: memcpy.VCRUNTIME140 ref: 00007FF79158A5F8
Part of subcall function 00007FF79158A550: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158A609

WSAGetLastError.WS2_32 ref: 00007FF79157296A

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF791572978
We got a 421 - timeout!, xrefs: 00007FF79157298E
FTP response timeout, xrefs: 00007FF7915729B7

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: 4af3f1651e03d74e10e6b9007a6219dba507e4555323ed1e664332546866e9bb
Instruction ID: b23a3158907f8f6ea222af481815a91f625b367929624ec43a21d6cec9820e73
Opcode Fuzzy Hash: 4af3f1651e03d74e10e6b9007a6219dba507e4555323ed1e664332546866e9bb
Instruction Fuzzy Hash: 3041C522A0978285F770AE3694013B9A390BB487D4F8A4131DE9D877E1EFBCE595C720

Function 00007FF791589A45 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589A6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791589F0F

Strings

FALSE, xrefs: 00007FF791589A60
TRUE, xrefs: 00007FF791589F19

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: 680989814d6a7f606f4f870cf9c673e6e20c909bbbf138a01244968e94ac3bdb
Instruction ID: 8cd4d9a0b5b9f0211d1d9f591b757f0efad8af6c7d59fa743d70ee86d46997bc
Opcode Fuzzy Hash: 680989814d6a7f606f4f870cf9c673e6e20c909bbbf138a01244968e94ac3bdb
Instruction Fuzzy Hash: 66410662B0935584FF359AB6904027CB791AB41794F8A45B6DF9D46FE8DEACE050C320

Function 00007FF79157BA90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79157BAD1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79157BB10
WSAGetLastError.WS2_32 ref: 00007FF79157BB68

Strings

TFTP response timeout, xrefs: 00007FF79157BB2A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: 69b331398db41112391a096ce9fca5556a4e3829955a2e49ce8a242d2e2dc4c0
Instruction ID: 6a4037637fd7065f50e8989d417b0638eb171cdf51cc264d28bcb9896608b266
Opcode Fuzzy Hash: 69b331398db41112391a096ce9fca5556a4e3829955a2e49ce8a242d2e2dc4c0
Instruction Fuzzy Hash: EA41B132608A4282EB70AF35D4522B9A760EB48BA4FD64231DE2D477E9DFBCD511C720

Function 00007FF7915894DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

%s%lx, xrefs: 00007FF791589548

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: 48b358b9a7832e780bd63da4bdcfca21b5e7029b0a50c728bb37141f682c80ea
Instruction ID: 97fac5581089c1ef321e6cd535e68c243b1f61f630af5ebb63954c49be40c646
Opcode Fuzzy Hash: 48b358b9a7832e780bd63da4bdcfca21b5e7029b0a50c728bb37141f682c80ea
Instruction Fuzzy Hash: 5131F311E0D5E785FB32AB34808427CFB919B81B84FD645B1C78E41EA9DFACA061C321

Function 00007FF7915897BF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Strings

TRUE, xrefs: 00007FF79158995D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: ddb15eb4e4bbacf428898f0f7aa068e1884f7718dbae2cd5ca24ba528def7b40
Instruction ID: 84e0162c9d3973790723e9ede5d536c114cb059087669a11d74da4a3fed96b5f
Opcode Fuzzy Hash: ddb15eb4e4bbacf428898f0f7aa068e1884f7718dbae2cd5ca24ba528def7b40
Instruction Fuzzy Hash: 8231D521A0C69385FB26DB35954437CFB91AB41B94FCA0671C79E42EE9CFACD151C320

Function 00007FF791555B40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C65
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C80

Strings

..., xrefs: 00007FF791555BD2
..., xrefs: 00007FF791555BE8

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: f0d588bf4c62bcbfd88a697f2125b6822b67db133afc161a8effd4e896ad2c1a
Instruction ID: 869f573c9a5b5adc492d8c1f7bbad220086713f5080261aaaf19940c44a3685e
Opcode Fuzzy Hash: f0d588bf4c62bcbfd88a697f2125b6822b67db133afc161a8effd4e896ad2c1a
Instruction Fuzzy Hash: 7B310261A1CA8581EB30EB21E4147F9B391FB84B94FC24231DA5E037A4CFBDE465C791

Function 00007FF7915725E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF791572632
accept.WS2_32 ref: 00007FF791572651

Part of subcall function 00007FF791564CE0: ioctlsocket.WS2_32 ref: 00007FF791564CF9

Strings

Connection accepted from server, xrefs: 00007FF79157267F
Error accept()ing server connect, xrefs: 00007FF79157266E

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 25db17007e4fcc1513bde8dc7f426adc79ef3f95fa1d37740abd9650b46eeb17
Instruction ID: 11fce106081440e11946654739b57ed3da5ecacdcc4ffdd603cd4b0a89134e65
Opcode Fuzzy Hash: 25db17007e4fcc1513bde8dc7f426adc79ef3f95fa1d37740abd9650b46eeb17
Instruction Fuzzy Hash: 52318D6160968186EB64AB32E4043AAB3A0FB48BE4FC50231DA6D477E5CFBDE125C710

Function 00007FF791564180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791563BB9), ref: 00007FF79156420D

Strings

Rejected %zu bytes header (max is %d)!, xrefs: 00007FF7915641AB
Failed to alloc memory for big header!, xrefs: 00007FF791564218

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 776be89de7e3b97c2c7a29af63bd073ab042ce0f00c1f2414de4247fd7b9e8de
Instruction ID: baf8be2c3df25fd55bbb152cdd34cefaa7095cf52799282b52adc1645a2edf82
Opcode Fuzzy Hash: 776be89de7e3b97c2c7a29af63bd073ab042ce0f00c1f2414de4247fd7b9e8de
Instruction Fuzzy Hash: A3216D32B08A8486DB14AB25E5802ADA7A1FB49FC4F944031EF8D07B69CF7CD4A1C740

Function 00007FF791544363 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915443F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154440E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154442B

Strings

:, xrefs: 00007FF7915443E6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 175a6e2993857331db5a4524ab3f58ef6685a1c5ee0984c2120de727a9479954
Instruction ID: 1bc5389246f7b75e94f3170a9d07e46421fcf34ff3d258f26b0aa497b0dd9e39
Opcode Fuzzy Hash: 175a6e2993857331db5a4524ab3f58ef6685a1c5ee0984c2120de727a9479954
Instruction Fuzzy Hash: AA219022649B8685EB76AF24E5403A9B3A0FB44B90FD94131DF9D437E4EF7CD8648720

Function 00007FF7915444E8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915443F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154440E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154442B

Strings

:, xrefs: 00007FF7915443E6

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: be32b5014d369bc73295dcf837881aff1f758748a3d96c39236650a8449bdd12
Instruction ID: ac083b5a5b03f938a52dc5e9c51a1bc6039d38b262317ecd363fdf460350db53
Opcode Fuzzy Hash: be32b5014d369bc73295dcf837881aff1f758748a3d96c39236650a8449bdd12
Instruction Fuzzy Hash: 95118122649B8581EF769F24E5003A9B3A0BB44BA0FE54131CF9C437E4EF7CD8658720

Function 00007FF79157A4E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF79157A51D
WSAGetLastError.WS2_32 ref: 00007FF79157A527

Strings

Sending data failed (%d), xrefs: 00007FF79157A52D
SENT, xrefs: 00007FF79157A542

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 3c9f7f12b86643e721f4c048074ebf3d72efc8223da87b6a7dd9f586703e095d
Instruction ID: 8db961a647838fe646993e9d995f3ab937b60a3d51619319239c089be8043b57
Opcode Fuzzy Hash: 3c9f7f12b86643e721f4c048074ebf3d72efc8223da87b6a7dd9f586703e095d
Instruction Fuzzy Hash: 5401D222704A9281EB20AB36E841459BB20FB84FD4B8A4131CB4D43721DF7CD511C790

Function 00007FF7915871B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915871B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915875D9

Part of subcall function 00007FF791550290: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915502E2

Strings

Start Date: %s, xrefs: 00007FF7915875C7
Start Date, xrefs: 00007FF7915875AD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 4db77c46102cf595f7eaa52d45e37b5d4f48110c1cb8f7415c2056f72cb31595
Instruction ID: 7c62bd39d3b7dd2a7744d16339f5bd1b043454a272983a8699169696ea8726b1
Opcode Fuzzy Hash: 4db77c46102cf595f7eaa52d45e37b5d4f48110c1cb8f7415c2056f72cb31595
Instruction Fuzzy Hash: 7801D491A0C3C242FB30AB3199146B9A752BF06784FCA4870D90E0BA71DFBCA1658331

Function 00007FF7915615F0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791561A05), ref: 00007FF791561628
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791561A05), ref: 00007FF791561631
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791561A05), ref: 00007FF7915616AA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791561A05), ref: 00007FF7915616BB
memcpy.VCRUNTIME140(?,?,00000000,00007FF791561A05), ref: 00007FF7915616E4

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 9b337a02fca5ee296b1ac04b059498f48879f76631f86f4956c034c2df049f6d
Instruction ID: fa87ce1c379ec957e5f9f6a5d0a0cc26c79e85282e77cf810fc7f8594c77955c
Opcode Fuzzy Hash: 9b337a02fca5ee296b1ac04b059498f48879f76631f86f4956c034c2df049f6d
Instruction Fuzzy Hash: A0318425A08F4581EB60AF21E58027DA3A5FB45FD4F890631DE6E87BE5DFBCD8608350

Function 00007FF7915842E0 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584306
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584327
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584342
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584350
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791580D75), ref: 00007FF791584362

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6a6a77d98efcada27af8cec906da128cbe951bad8ba45de8207a6caf2487e23b
Instruction ID: 97423c3829dbdac9beed670605a105d774dd982a95a984cffda090a456734eee
Opcode Fuzzy Hash: 6a6a77d98efcada27af8cec906da128cbe951bad8ba45de8207a6caf2487e23b
Instruction Fuzzy Hash: 82118336644B4182DB14AF35E99013DB3B4FB84F897854125CE4E47B78DF78D8A5C350

Function 00007FF79155A800 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155A920
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155A966
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155A9C8

Strings

chunked, xrefs: 00007FF79155A87E

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: 538d7051d2c70fbc938fbb0a2f8250d3f489b72bef55e67d2d570cf30864fa8f
Instruction ID: a6a068a14c2965c43c8d4c6443694ef1b47c951381e22e4829e6529110f6b565
Opcode Fuzzy Hash: 538d7051d2c70fbc938fbb0a2f8250d3f489b72bef55e67d2d570cf30864fa8f
Instruction Fuzzy Hash: 17518821A0969645FB75BB329520379E7A1AF04BC4FCB4031EE5D477A5EFBCE4628320

Function 00007FF791589BFF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791589F0F

Strings

GMT, xrefs: 00007FF791589CAE
TRUE, xrefs: 00007FF791589F19
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF791589D21

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 14976289f3b9005e1f5860059425a6beb8717aaac2c186ae0b75cf46d6573ef7
Instruction ID: 09544c94273109d1ef58952eb79ddeabc52b340903b623376fcc3725cfae64d4
Opcode Fuzzy Hash: 14976289f3b9005e1f5860059425a6beb8717aaac2c186ae0b75cf46d6573ef7
Instruction Fuzzy Hash: B351E361B0869684EB219B35E6041B9FBA5EB81784FD64072DB4D03BA8CFBDE461C320

Function 00007FF79153D520 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79153D1E8), ref: 00007FF79153D5FE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79153D1E8), ref: 00007FF79153D62C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79153D1E8), ref: 00007FF79153D695

Part of subcall function 00007FF79158F240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79153443E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF791531B99), ref: 00007FF79158F25A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79153D6A2

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: b3988258efe183e24b57d6eecce6c4b788a80eed897667fb314e802d95d40c03
Instruction ID: da5db61b30a8bac8e971f6bda35eb30db3902b4af0a5f25483796f973bd4d3e9
Opcode Fuzzy Hash: b3988258efe183e24b57d6eecce6c4b788a80eed897667fb314e802d95d40c03
Instruction Fuzzy Hash: 2641AC72B05A4186EF24BF35D1442B9A360BB04BA4FD68631CA6D477E4DFBCE0628310

Function 00007FF79158A880 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF79156CA2B), ref: 00007FF79158A8DE

Strings

%s, xrefs: 00007FF79158A8B4

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: e451349c48c8d08e9e196415945413dea411d57df709bac9ef75b314883bddb0
Instruction ID: a4ad3d9bc0161b3f6a2fc581fa0bbb6d30c4a2dcca8fc28e17a6b8a7b6265c94
Opcode Fuzzy Hash: e451349c48c8d08e9e196415945413dea411d57df709bac9ef75b314883bddb0
Instruction Fuzzy Hash: B8416632A18B4582E761EB25B44016AB3A4FB84BD0F950135DF9E03B75DF7CE5A5C310

Function 00007FF79158ACC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF79156E270,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF79158AD13
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158AD9C

Strings

%s, xrefs: 00007FF79158ACE5

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: e9b89c39f856a5c8a9ad15eec70c1ff84f22c74bc4c3145f005487050e101875
Instruction ID: d74799ecb3b7089cf6cee0f4445a3e23379d363c59492d3ff2d8e7a5ea7109ed
Opcode Fuzzy Hash: e9b89c39f856a5c8a9ad15eec70c1ff84f22c74bc4c3145f005487050e101875
Instruction Fuzzy Hash: 32416532A18B4582E761AF26F5401AAB3A0FB45B94F854135DF8D47BB5EF7CE0A58310

Function 00007FF791589B45 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791589F0F

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF791589BEB
GMT, xrefs: 00007FF791589B99
TRUE, xrefs: 00007FF791589F19

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 61b507c128d45ded0ed49714172254701308272c932cd60181d082c1e58646fb
Instruction ID: a5d88a3d384f4d3426b01ac2ff3c1608ace7f1f8e6026fc9ab06da915320bdb2
Opcode Fuzzy Hash: 61b507c128d45ded0ed49714172254701308272c932cd60181d082c1e58646fb
Instruction Fuzzy Hash: 8331A062A0DB8588EB219B35D5401A9B762FB847D4FD640B2CB4D17AA8DFBCE561C320

Function 00007FF79157621D Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791576254

Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C65
Part of subcall function 00007FF791555B40: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF791555C80

Strings

Wildcard - START of "%s", xrefs: 00007FF79157625D
Wildcard - "%s" skipped by user, xrefs: 00007FF7915762BD
%s%s, xrefs: 00007FF791576224

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 1fbc18a41d1a3ed3bd65e18b5aadff381fc65846ca41af88232ca3afd5d8ed55
Instruction ID: 476dd4648c94602606a3ac3d6344961a0bf83625c25292bd8fb0e9152deee6c6
Opcode Fuzzy Hash: 1fbc18a41d1a3ed3bd65e18b5aadff381fc65846ca41af88232ca3afd5d8ed55
Instruction Fuzzy Hash: 33416136A08A42C5FB30EF35D4451ADB7A0EB84B85FCA4036DE4E8B3A5DEB8D555C360

Function 00007FF7915405D0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF791531205), ref: 00007FF791540608
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF791531205), ref: 00007FF7915406A9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7915406C7

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: e1af6881af5f3e4c00050ae4788b4fe4e8b214fd33d74720cf3c6d1a5e77fedd
Instruction ID: a3ce003e24886f47ce18e262106458f907bab4f5c0ab05eaefba869e990c376d
Opcode Fuzzy Hash: e1af6881af5f3e4c00050ae4788b4fe4e8b214fd33d74720cf3c6d1a5e77fedd
Instruction Fuzzy Hash: 94212E22B0974546FB34BB71A54037952549B44BF4FB60A30DE6E0BBE1DEFCA0A28350

Function 00007FF791550290 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915502E2
memcpy.VCRUNTIME140 ref: 00007FF79155031D

Part of subcall function 00007FF791545670: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791545685

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791550352

Part of subcall function 00007FF791545780: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79154FD80,?,?,?,?,?,?,?,?,?,?,00000000,00007FF791541BB1), ref: 00007FF7915457A7
Part of subcall function 00007FF791545780: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79154FD80,?,?,?,?,?,?,?,?,?,?,00000000,00007FF791541BB1), ref: 00007FF7915457B3

Strings

%s:, xrefs: 00007FF7915502FC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 9516adf01490b49f10acba8f7c231fd89690dbff1325a00545b0275a5eff4f36
Instruction ID: 6dc5c31fa6bd3c0a23436e7c2190ae6d6c25de27f3541b29ef3427965e0d3370
Opcode Fuzzy Hash: 9516adf01490b49f10acba8f7c231fd89690dbff1325a00545b0275a5eff4f36
Instruction Fuzzy Hash: 1821E522A08A8592DB20DF22E9501AAB3A4FB84FE4F8A0132EE5D077A5DF7CD455C350

Function 00007FF79158958A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589591
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589983
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589997
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7915899FE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: d55fb0e371b828d4263d1b692f20da97774bb4adc62638c8f72deefdfae3283b
Instruction ID: 5f8c720d35c45a0b7a9bac775e537ac7309ddfc8aabec00a4759f48a6f740cae
Opcode Fuzzy Hash: d55fb0e371b828d4263d1b692f20da97774bb4adc62638c8f72deefdfae3283b
Instruction Fuzzy Hash: 1421BC21E0D5A785FB32EB34848433CFB908B91B40FDA05B1C6CA41DA9CFACA5A1C321

Function 00007FF79155932D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF791558FF8), ref: 00007FF791559145
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF791558FF8), ref: 00007FF79155915F

Strings

I64, xrefs: 00007FF791559155
I32, xrefs: 00007FF791559135

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 8e751c8bfe898bb27ff1d697120fc1faf0731f976f8d22b7627950edb40120f3
Instruction ID: e56c4d80673b72bc21d195183b3352dbfe7fa71a5b82f9f8fb7a10bc63634378
Opcode Fuzzy Hash: 8e751c8bfe898bb27ff1d697120fc1faf0731f976f8d22b7627950edb40120f3
Instruction Fuzzy Hash: 5C21D422A0D56382EB306B30D4A02BCBB949B44B88FCB5171DB4A422E9DFBCD524C761

Function 00007FF791583180 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791583EE9,00000000,?,?,00007FF7915834A6), ref: 00007FF7915831A9
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791583EE9,00000000,?,?,00007FF7915834A6), ref: 00007FF7915831E0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF791583EE9,00000000,?,?,00007FF7915834A6), ref: 00007FF7915831F2
memcpy.VCRUNTIME140(?,?,?,00007FF791583EE9,00000000,?,?,00007FF7915834A6), ref: 00007FF79158321A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: 008602ec6e908811db213d7dbe04a7c6b8817e5f137df226a56a28326b5c719a
Instruction ID: 9f772deaee25f796ff65dc2ff49fefe109149fae6779332b123cbe867a6cccd6
Opcode Fuzzy Hash: 008602ec6e908811db213d7dbe04a7c6b8817e5f137df226a56a28326b5c719a
Instruction Fuzzy Hash: CC215126B09B8182DB54DF65E45022DA3A0FB48FC8B898471DE5E47769EF7CD4A1C710

Function 00007FF791572500 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157251D
strstr.VCRUNTIME140 ref: 00007FF79157255C
strstr.VCRUNTIME140 ref: 00007FF791572574

Strings

;type=, xrefs: 00007FF79157254F, 00007FF79157256D

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 811040f233e0a97c3a24d7e3bb3bc3a1351c76e80b528bf1a8aec7d8cf2d614a
Instruction ID: 89f9b649cc60f475520bca84c816b65d45141b4b8dffacd89a6a897d88a6fdd7
Opcode Fuzzy Hash: 811040f233e0a97c3a24d7e3bb3bc3a1351c76e80b528bf1a8aec7d8cf2d614a
Instruction Fuzzy Hash: ED21D6319096C282EB259B35E0513A8B7A0FB58784FC94131DB9E4B7E5DFBCE1A1C360

Function 00007FF79158D370 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF79158D3AD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158D3BD
WideCharToMultiByte.KERNEL32 ref: 00007FF79158D3EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158D3F9

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: c10528ef4c738abbc8077291e4c9fdcefbb0b388c6087abf3c9d595c73769fbd
Instruction ID: d569a3823515638c5a057283eff3f705fa7a6b8e7a41514424677635c6071d64
Opcode Fuzzy Hash: c10528ef4c738abbc8077291e4c9fdcefbb0b388c6087abf3c9d595c73769fbd
Instruction Fuzzy Hash: 1F118231B09B4187E7609F66B84416DBBA0FB88FD0B894038DB4E43B24DFBCE9218754

Function 00007FF7915619B0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791561A33

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF7915619C0

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 479d2bfe2f55f23ed073b86a81743c629f6cf7c7eb30205fa508a36cc4b626fa
Instruction ID: a9d54924c9cd88ee39e185e46bbcb36999994c12f6fb94fe70dbf23fc130dbb7
Opcode Fuzzy Hash: 479d2bfe2f55f23ed073b86a81743c629f6cf7c7eb30205fa508a36cc4b626fa
Instruction Fuzzy Hash: 3001FE21B04B4142FB256B65B9403BDE290AF84BF1F494230DEAE477E4DFBCD8A58390

Function 00007FF79158D5A0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79158D5C6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79158D5D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158D606

Part of subcall function 00007FF79158D630: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF79158D5F0), ref: 00007FF79158D69F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79158D5FD

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 74dcc107a4db5e5eacd702fc4e5117abfa6dcb817347b636e833a125e261670b
Instruction ID: 766856a1608cb9ef7c034f60289d79049e12c946388b1b10c8d85afefea1572b
Opcode Fuzzy Hash: 74dcc107a4db5e5eacd702fc4e5117abfa6dcb817347b636e833a125e261670b
Instruction Fuzzy Hash: 7C019251F0D68542EF79BB276550039D2D0AF48BC4FC90075DD4E03F65DE6CD8A58320

Function 00007FF79154B180 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF79154B132,?,?,?,00000000), ref: 00007FF79154B191
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B132,?,?,?,00000000), ref: 00007FF79154B19A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79154B132,?,?,?,00000000), ref: 00007FF79154B1A4
closesocket.WS2_32 ref: 00007FF79154B1C2

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 9eb0b8f88539e4023edf3225b4eebe3bc86ae2d2a30f915f43d34615c8db5f94
Instruction ID: 2b03cd4efdc2bcde3d71c4f7ec107220bc73f604e67c30f67e75f634aae6b8f8
Opcode Fuzzy Hash: 9eb0b8f88539e4023edf3225b4eebe3bc86ae2d2a30f915f43d34615c8db5f94
Instruction Fuzzy Hash: BB011212D18B8183EB24EF71C9601786320FFE9F68F566325DD5D411B5AFB8A5E48210

Function 00007FF79155921A Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF791558FF8), ref: 00007FF791559145
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF791558FF8), ref: 00007FF79155915F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915591A2

Strings

I64, xrefs: 00007FF791559155
I32, xrefs: 00007FF791559135

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: de67e7e0a2a649706839e3d7781dc7386b0f4e61f50036b717385dd3c57d0e3a
Instruction ID: 6f97403fb078e912dfbb9048ec3ed185af3326e39412e2413e1a880bb6a7774d
Opcode Fuzzy Hash: de67e7e0a2a649706839e3d7781dc7386b0f4e61f50036b717385dd3c57d0e3a
Instruction Fuzzy Hash: 17F05E21B2D51341EB205B3598A4679A798AF45B94FCA4136DA1F862A8CEBCD224C321

Function 00007FF791559222 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF791558FF8), ref: 00007FF791559145
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF791558FF8), ref: 00007FF79155915F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7915591A2

Strings

I64, xrefs: 00007FF791559155
I32, xrefs: 00007FF791559135

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 8e2efbe2dc36c2f304f4daf226fac6a456fa9e2aa0e22ef4985db8c7c8934ee2
Instruction ID: ecbc2f078289aa028458e67839cd89f094c19eb9768ca2ed4a01917dc787db2a
Opcode Fuzzy Hash: 8e2efbe2dc36c2f304f4daf226fac6a456fa9e2aa0e22ef4985db8c7c8934ee2
Instruction Fuzzy Hash: 61F05E21B2951381EB305B3598A4679A798AF45B94FCA4136DA1F862A8CEBCD224C321

Function 00007FF791581210 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7915565C6), ref: 00007FF791581224

Strings

%lx, xrefs: 00007FF79158150A

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: c5f9ad7cbecb279396b20793d6ff8f3a0ad16f17c928caf43dceee749b8ae422
Instruction ID: 6782a438b2799cb8315f2f53f245a012cd247cc5a8ff95d1b56fa4098dff1381
Opcode Fuzzy Hash: c5f9ad7cbecb279396b20793d6ff8f3a0ad16f17c928caf43dceee749b8ae422
Instruction Fuzzy Hash: D881B062A1C1D149E7789B39949023DBBD0F785790F4A4275EA9FC2AF0DEBCD451CB20

Function 00007FF79157E7AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79157E8A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79157E907

Strings

%ld, xrefs: 00007FF79157E7DC

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: 9cab93023acf38a75293a06d8281f40a99b56ac28cab9c4c3c04a1f662d08d3a
Instruction ID: 6d0cd28e6f90ca20544251fbb8eaa6ea85f6033d5d1bd494968e9b3a3d607a68
Opcode Fuzzy Hash: 9cab93023acf38a75293a06d8281f40a99b56ac28cab9c4c3c04a1f662d08d3a
Instruction Fuzzy Hash: 3831A522A09B4281FB75EB71926237AA390EF44754FCA8031DE4D137A5EFBCE564C720

Function 00007FF79155A6D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79155A749
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155A7E2

Strings

identity, xrefs: 00007FF79155A704, 00007FF79155A773, 00007FF79155A7DB

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: 8336b4210b4004b155cbc089c43f1e53d3414ade01267eb7b6197acee1bc4750
Instruction ID: ef476d6eda5e8a388f929839058462bacc33fcb5db66579156c5fb4e0bf307d1
Opcode Fuzzy Hash: 8336b4210b4004b155cbc089c43f1e53d3414ade01267eb7b6197acee1bc4750
Instruction Fuzzy Hash: DC31C961E19A4681EB21AF25D550379E7A0EF44FE4F8A4231DE2E037E4EFBCD4618310

Function 00007FF791555510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791555555
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79155557C

Strings

%I64d-, xrefs: 00007FF791555567

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: 4d3daeb6377bbac071d955606a3681fb7a5c368577e255ec3f27eeb489a10530
Instruction ID: 6e6bd2605114de63e2a1df3861d2981e665fd9c33f16bca3b35450cfcf180e52
Opcode Fuzzy Hash: 4d3daeb6377bbac071d955606a3681fb7a5c368577e255ec3f27eeb489a10530
Instruction Fuzzy Hash: 0F11E1B2A1AA82C1EB21AB7484153F963E2FB54B4DF9D4035C90C8E275DF7D94A68330

Function 00007FF791589B18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF791589B1F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791589F0F

Strings

TRUE, xrefs: 00007FF791589F19

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: 3ea0fbb5b320cd8986fd5c62dbaf42462ff963e792932f504dad5627c0e15222
Instruction ID: 7b04b4a39fd9a11330849238e6f6d5b3dc22f25505d442392aaf76b6613e9483
Opcode Fuzzy Hash: 3ea0fbb5b320cd8986fd5c62dbaf42462ff963e792932f504dad5627c0e15222
Instruction Fuzzy Hash: F0019666B0965584EB229B35D500278B761BB44BE4FC64472DF4E07BA8DEBCD0918320

Function 00007FF791548570 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154883A
memcpy.VCRUNTIME140 ref: 00007FF79154896C
memcpy.VCRUNTIME140 ref: 00007FF791548988

Part of subcall function 00007FF79155DE20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791546743,?,?,00000000,00007FF791551012,?,?,00000000,00007FF791551645), ref: 00007FF79155DE5C

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: 30c99f82218bf2dd412b0626ce0fe34ede466061719036dbfe30e355c3ff1c85
Instruction ID: e8130a4714d4aa4b6316bbf676b4984262fc8d79ce8a643ed3223c746c43be20
Opcode Fuzzy Hash: 30c99f82218bf2dd412b0626ce0fe34ede466061719036dbfe30e355c3ff1c85
Instruction Fuzzy Hash: 35C18032B04B0286EB64EBB5D4003AD73A1BB44BA8F964635CE2D177E8DF78D466C750

Function 00007FF79158D2C0 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7915803F8), ref: 00007FF79158D2F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7915803F8), ref: 00007FF79158D304
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7915803F8), ref: 00007FF79158D32B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7915803F8), ref: 00007FF79158D338

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: f1a5407237db9153808d918461231376cc166afeba206ffd9ba44e21888b6f4d
Instruction ID: 16b5d7bf7fcb8ed2dda04b7d9efd7845b052b00199aebc9272c0db5712cd058f
Opcode Fuzzy Hash: f1a5407237db9153808d918461231376cc166afeba206ffd9ba44e21888b6f4d
Instruction Fuzzy Hash: 59117031B08B4282E720AB2AF44002AE6A0FF88BD5B890535DB5D47B68EF7CD4508710

Function 00007FF79154BC50 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF791545780: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79154FD80,?,?,?,?,?,?,?,?,?,?,00000000,00007FF791541BB1), ref: 00007FF7915457A7
Part of subcall function 00007FF791545780: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79154FD80,?,?,?,?,?,?,?,?,?,?,00000000,00007FF791541BB1), ref: 00007FF7915457B3

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154BC86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154BC96
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79154BCA4
memset.VCRUNTIME140 ref: 00007FF79154BCDF

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 195ff57605982ef926e7049359a2d90fe74d1c56ba92557821cb0204ba2d8eb5
Instruction ID: e40e62ff4f18ab5ea388e0a78fda740e673c63bc4d319db8434860e860fc5b87
Opcode Fuzzy Hash: 195ff57605982ef926e7049359a2d90fe74d1c56ba92557821cb0204ba2d8eb5
Instruction Fuzzy Hash: EF211D32E14B81A3E714DB32D6802A9B360F799744F559225EB8C43A61DF74F1F1C300

Function 00007FF791572C50 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791572C88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791572CAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791572CCA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF791572CDE

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6aeb9b4ee373119086df89d849c003284edb578b2afdea0e21a0ea61ebf53732
Instruction ID: 6a4f84cd83fa79c9faf840f7a93c8ca74bac642dbca4889203cddee562a55bde
Opcode Fuzzy Hash: 6aeb9b4ee373119086df89d849c003284edb578b2afdea0e21a0ea61ebf53732
Instruction Fuzzy Hash: 82112536614B81C6D7509F75E580269B3A4F784F84F884036DE8E57728CF38E8A9C760

Function 00007FF791584890 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79158098E), ref: 00007FF7915848B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79158098E), ref: 00007FF7915848D7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79158098E), ref: 00007FF7915848F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79158098E), ref: 00007FF791584900

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 846d7ab3ed71c38c6c2539536b014053c6e70e2da4ef8ea2d8c4f2e83be237c1
Instruction ID: 08f7cf56fe1b6ed74057cf7253328ab06bd129b4c8b0f52d428d947b8a1c4a4d
Opcode Fuzzy Hash: 846d7ab3ed71c38c6c2539536b014053c6e70e2da4ef8ea2d8c4f2e83be237c1
Instruction Fuzzy Hash: C511A536A54B4182DB14AF36E99012DB7B4FF94F897914026CE4E43B78CF78D8A5C790

Function 00007FF791582230 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791558455,?,?,00000000,00007FF791551111,?,?,00000000,00007FF791551645), ref: 00007FF791582240
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791558455,?,?,00000000,00007FF791551111,?,?,00000000,00007FF791551645), ref: 00007FF791582266
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791558455,?,?,00000000,00007FF791551111,?,?,00000000,00007FF791551645), ref: 00007FF791582274
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF791558455,?,?,00000000,00007FF791551111,?,?,00000000,00007FF791551645), ref: 00007FF791582282

Memory Dump Source

Source File: 00000000.00000002.2311676086.00007FF791531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF791530000, based on PE: true

Associated: 00000000.00000002.2311663171.00007FF791530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311715531.00007FF791591000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311733905.00007FF7915A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2311747549.00007FF7915A9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff791530000_flX5YA1C09.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8559a7478e8577689d50fb75d693bd9ac3cfe55f82774f29ec76e8cfb518f45c
Instruction ID: d01bd5fc6060cc99de5be22845dc88cfd5e7c7b95fc199c0b079202f4f4cb01f
Opcode Fuzzy Hash: 8559a7478e8577689d50fb75d693bd9ac3cfe55f82774f29ec76e8cfb518f45c
Instruction Fuzzy Hash: BBF0C936644B0182DB149F31E994029B3B4FB98F997924121CE9E43B74CF78C8B8C350

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report flX5YA1C09.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_flX5YA1C09.exe_6193f6e47d768fb07ef4e778aeb03f9f2b24ff_41b9c7aa_8ba48ea0-4bd8-4fb0-9fd2-b26a74e926a9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCC0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDEA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE1A.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
flX5YA1C09.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre