Play interactive tour

Edit tour

Windows Analysis Report tftpd64_svc.exe

Overview

General Information

Sample Name:	tftpd64_svc.exe
Analysis ID:	524512
MD5:	7ea3bbf84f39cc37c208945461230614
SHA1:	a2c2c0912f9632024245007083b0f75c4d520afe
SHA256:	cfc0fdbf62d6b3be3960cee3f27d19d6c81ec125b2856912f331f5413e3f12be
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sample file is different than original file name gathered from version info

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found large amount of non-executed APIs

Uses the system / local time for branch decision (may execute only at specific dates)

Contains functionality to delete services

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

tftpd64_svc.exe (PID: 2588 cmdline: "C:\Users\user\Desktop\tftpd64_svc.exe" MD5: 7EA3BBF84F39CC37C208945461230614)

conhost.exe (PID: 1544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: tftpd64_svc.exe

Virustotal: Detection: 7%

Perma Link

Source: tftpd64_svc.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA8078 FindFirstFileExW,		0_2_00007FF61DDA8078
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8F80C lstrcpynA,lstrcatA,FindFirstFileA,FileTimeToLocalFileTime,FileTimeToSystemTime,GetDateFormatA,wsprintfA,FindNextFileA,FindClose,		0_2_00007FF61DD8F80C

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DD846B0 recvfrom,SendARP,inet_ntoa,

0_2_00007FF61DD846B0

Source: tftpd64_svc.exe	Binary or memory string: OriginalFileName vs tftpd64_svc.exe
Source: tftpd64_svc.exe, 00000000.00000000.261582113.00007FF61DDCE000.00000002.00020000.sdmp	Binary or memory string: OriginalFileNametftpd32P vs tftpd64_svc.exe
Source: tftpd64_svc.exe	Binary or memory string: OriginalFileNametftpd32P vs tftpd64_svc.exe

Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9CF20	0_2_00007FF61DD9CF20
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8BE90	0_2_00007FF61DD8BE90
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDB0688	0_2_00007FF61DDB0688
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD84E90	0_2_00007FF61DD84E90
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8E68C	0_2_00007FF61DD8E68C
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA7E6C	0_2_00007FF61DDA7E6C
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD95634	0_2_00007FF61DD95634
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA1118	0_2_00007FF61DDA1118
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD95914	0_2_00007FF61DD95914
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9B0EC	0_2_00007FF61DD9B0EC
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8B080	0_2_00007FF61DD8B080
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA8078	0_2_00007FF61DDA8078
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDAD018	0_2_00007FF61DDAD018
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8D82B	0_2_00007FF61DD8D82B
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8C7A0	0_2_00007FF61DD8C7A0
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9EB00	0_2_00007FF61DD9EB00
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDAA27C	0_2_00007FF61DDAA27C
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD83A80	0_2_00007FF61DD83A80
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDAB200	0_2_00007FF61DDAB200
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8A200	0_2_00007FF61DD8A200
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA396C	0_2_00007FF61DDA396C
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9E150	0_2_00007FF61DD9E150
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD95148	0_2_00007FF61DD95148
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9D4D4	0_2_00007FF61DD9D4D4
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9E4B4	0_2_00007FF61DD9E4B4
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD9ABE0	0_2_00007FF61DD9ABE0
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8C3C0	0_2_00007FF61DD8C3C0
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8FBB8	0_2_00007FF61DD8FBB8
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD953CC	0_2_00007FF61DD953CC
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA53A0	0_2_00007FF61DDA53A0

Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: String function: 00007FF61DD8E468 appears 77 times
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: String function: 00007FF61DD81F60 appears 87 times
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: String function: 00007FF61DD9F17C appears 35 times

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DD816A0 lstrcmpiA,GetModuleFileNameA,OpenSCManagerA,CreateServiceA,GetVersionExA,ChangeServiceConfig2A,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,lstrcmpiA,OpenSCManagerA,OpenServiceA,ControlService,Sleep,QueryServiceStatus,Sleep,QueryServiceStatus,DeleteService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,lstrcmpiA,SetConsoleCtrlHandler,lstrcmpiA,RegDeleteKeyA,RegDeleteKeyA,StartServiceCtrlDispatcherA,GetLastError,

0_2_00007FF61DD816A0

Source: tftpd64_svc.exe

Virustotal: Detection: 7%

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DD8ED18 GetLastError,FormatMessageA,lstrcpynA,LocalFree,

0_2_00007FF61DD8ED18

Source: C:\Users\user\Desktop\tftpd64_svc.exe

0_2_00007FF61DD816A0

Source: tftpd64_svc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\tftpd64_svc.exe

0_2_00007FF61DD816A0

Source: unknown	Process created: C:\Users\user\Desktop\tftpd64_svc.exe "C:\Users\user\Desktop\tftpd64_svc.exe"
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1544:120:WilError_01

Source: tftpd64_svc.exe	String found in binary or memory: %s -install to install the service
Source: tftpd64_svc.exe	String found in binary or memory: -install
Source: tftpd64_svc.exe	String found in binary or memory: %s -install to install the service
Source: tftpd64_svc.exe	String found in binary or memory: -install
Source: tftpd64_svc.exe	String found in binary or memory: %s -install to install the service
Source: tftpd64_svc.exe	String found in binary or memory: %s (0x%x)%s error: %d-install-remove-debug-uninstallTftpd32%s -install to install the service

Source: classification engine

Classification label: mal48.winEXE@2/1@0/0

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: lstrcmpiA,GetModuleFileNameA,OpenSCManagerA,CreateServiceA,GetVersionExA,ChangeServiceConfig2A,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,lstrcmpiA,OpenSCManagerA,OpenServiceA,ControlService,Sleep,QueryServiceStatus,Sleep,QueryServiceStatus,DeleteService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,lstrcmpiA,SetConsoleCtrlHandler,lstrcmpiA,RegDeleteKeyA,RegDeleteKeyA,StartServiceCtrlDispatcherA,GetLastError,

0_2_00007FF61DD816A0

Source: tftpd64_svc.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: tftpd64_svc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: tftpd64_svc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: tftpd64_svc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: tftpd64_svc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: tftpd64_svc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: tftpd64_svc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: tftpd64_svc.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: tftpd64_svc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: tftpd64_svc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: tftpd64_svc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: tftpd64_svc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: tftpd64_svc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: tftpd64_svc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: tftpd64_svc.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\tftpd64_svc.exe

0_2_00007FF61DD816A0

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\tftpd64_svc.exe

API coverage: 3.4 %

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DD885F0 GetSystemTime followed by cmp: cmp al, 18h and CTI: jbe 00007FF61DD8876Ch

0_2_00007FF61DD885F0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA8078 FindFirstFileExW,		0_2_00007FF61DDA8078
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8F80C lstrcpynA,lstrcatA,FindFirstFileA,FileTimeToLocalFileTime,FileTimeToSystemTime,GetDateFormatA,wsprintfA,FindNextFileA,FindClose,		0_2_00007FF61DD8F80C

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DD91130 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF61DD91130

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DDA9EF0 GetProcessHeap,

0_2_00007FF61DDA9EF0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD90B68 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	0_2_00007FF61DD90B68
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD91130 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF61DD91130
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD90804 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF61DD90804
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD912D8 SetUnhandledExceptionFilter,	0_2_00007FF61DD912D8
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DDA19B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF61DDA19B8

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DDB04D0 cpuid

0_2_00007FF61DDB04D0

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DDA55A8 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF61DDA55A8

Source: C:\Users\user\Desktop\tftpd64_svc.exe

0_2_00007FF61DD816A0

Source: C:\Users\user\Desktop\tftpd64_svc.exe

Code function: 0_2_00007FF61DD885F0 gethostname,gethostbyname,recvfrom,GetLastError,Sleep,GetSystemTime,htonl,htonl,sendto,GetLastError,

0_2_00007FF61DD885F0

Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8DE20 getaddrinfo,wsprintfA,getaddrinfo,socket,bind,listen,htons,freeaddrinfo,	0_2_00007FF61DD8DE20
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD888B0 wsprintfA,getaddrinfo,GetLastError,socket,setsockopt,setsockopt,bind,GetLastError,getnameinfo,SetLastError,GetLastError,GetLastError,GetLastError,GetLastError,closesocket,freeaddrinfo,	0_2_00007FF61DD888B0
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD8C7A0 WaitForSingleObject,GetLastError,SetThreadPriority,socket,GetLastError,htons,bind,GetLastError,GetLastError,connect,GetLastError,Sleep,getsockname,getnameinfo,MessageBoxA,closesocket,CloseHandle,GetCurrentThreadId,SetEvent,Sleep,	0_2_00007FF61DD8C7A0
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD84A10 socket,WSAGetLastError,setsockopt,getservbyname,htons,bind,setsockopt,htonl,sendto,GetCurrentThreadId,GetLastError,htonl,htonl,getservbyname,htons,sendto,closesocket,WSAGetLastError,closesocket,	0_2_00007FF61DD84A10
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD90450 wsprintfA,getaddrinfo,socket,setsockopt,bind,freeaddrinfo,GetLastError,sendto,closesocket,	0_2_00007FF61DD90450
Source: C:\Users\user\Desktop\tftpd64_svc.exe	Code function: 0_2_00007FF61DD89C00 wsprintfA,GetAdaptersAddresses,GetAdaptersAddresses,wsprintfA,lstrcmpA,inet_ntoa,lstrcpyA,getaddrinfo,socket,GetLastError,freeaddrinfo,getaddrinfo,GetLastError,GetLastError,GetLastError,setsockopt,setsockopt,bind,GetLastError,getnameinfo,SetLastError,GetLastError,GetLastError,GetLastError,GetLastError,closesocket,freeaddrinfo,	0_2_00007FF61DD89C00

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Windows Service14	Windows Service14	Process Injection1	OS Credential Dumping	System Time Discovery12	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Service Execution12	Boot or Logon Initialization Scripts	Process Injection1	Deobfuscate/Decode Files or Information1	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery13	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tftpd64_svc.exe	8%	Virustotal		Browse
tftpd64_svc.exe	3%	Metadefender		Browse
tftpd64_svc.exe	7%	ReversingLabs	Win64.Network.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	524512
Start date:	18.11.2021
Start time:	16:10:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	tftpd64_svc.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 88.1%) Quality average: 62.6% Quality standard deviation: 33.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

\Device\ConDrv Download File
Process:	C:\Users\user\Desktop\tftpd64_svc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.3991263512448855
Encrypted:	false
SSDEEP:	6:mbQBs0egLsiW7aUvX1UnMxAYyyjB5y+PNMWFGtssfxyk:mkW09It79vFLjrOwVCffT
MD5:	C9923ACC1B05E65898460A860A6B6D91
SHA1:	55219B71289C186AA746FB1269048E22E4BEBBA0
SHA-256:	E81D5A1B93A30F94DCE779649E0D05BFC0186A24C4CEEAFCEA7BF28B48B079B4
SHA-512:	0502DDCD301C5345C456D41B2787594FCCC37F8E4101F82703332AF1DF61B02E8CF71FA38C8E6953FE7800EFABCE782D5962E3B5A8F295287BC9B98BB5E7070C
Malicious:	false
Reputation:	low
Preview:	Tftpd32 -install to install the service..Tftpd32 -remove to remove the service..Tftpd32 -debug <params> to run as a console app for debugging..Tftpd32 -uninstall to suppress registry entries and settings....StartServiceCtrlDispatcher being called...This may take several seconds. Please wait...

Static File Info

General
File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.138396322407685
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tftpd64_svc.exe
File size:	334336
MD5:	7ea3bbf84f39cc37c208945461230614
SHA1:	a2c2c0912f9632024245007083b0f75c4d520afe
SHA256:	cfc0fdbf62d6b3be3960cee3f27d19d6c81ec125b2856912f331f5413e3f12be
SHA512:	d6a39dc4471da3d8ee57ba4a68342b36c1805b3f9ccabb29809d199f0f99393268c90edfcb99c9e61b91ea0de3921c70eab6f725247e80bf33e17ec68385ec27
SSDEEP:	6144:bUJiJIHR90uwDK09BFBMCNDrGwsQ9nEfet:bTmwDPDqqb
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........e...6...6...6...7...6...7...6...7...6...7...6...7...6...7...6...7...6...7...6...6f..6...7...6...6...6..y6...6...7...6Rich...

File Icon


Icon Hash:	9966ce33d4c96288

Static PE Info

General
Entrypoint:	0x140010d00
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5C768010 [Wed Feb 27 12:18:24 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	9f5c11ad09c4f9854ca1d2f71809a230

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F40B4A509F4h
dec eax
add esp, 28h
jmp 00007F40B4A50557h
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F40B4A506F2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F40B4A506F5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F40B4A506EDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F40B4A50136h
int3
dec eax
sub esp, 28h
call 00007F40B4A50E60h
test eax, eax
je 00007F40B4A50703h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F40B4A506E7h
dec eax
cmp ecx, eax
je 00007F40B4A506F6h
xor eax, eax
dec eax
cmpxchg dword ptr [00032AECh], ecx
jne 00007F40B4A506D0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f370	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0xcf28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x2274	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f000	0x7dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3cbc0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3cc00	0x108	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31000	0x688	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2ff70	0x30000	False	0.565739949544	zlib compressed data	6.48269396487	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0xf77e	0xf800	False	0.446966355847	data	5.27609719005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x41000	0xc690	0x2000	False	0.179565429688	data	2.51483766286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x4e000	0x2274	0x2400	False	0.4716796875	data	5.3242848263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x94	0x200	False	0.201171875	data	1.42338039998	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0xcf28	0xd000	False	0.100717397837	data	2.80452122995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5f000	0x7dc	0x800	False	0.62939453125	data	5.38146824912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x52588	0xa068	data	English	United States
RT_ICON	0x5c5f0	0xa68	dBase IV DBT of \200.DBF, blocks size 0, block length 2048, next free block index 40, next free block 2290649224, next used block 2290649224	English	United States
RT_ICON	0x5d058	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 43530, next used block 0	English	United States
RT_ICON	0x5d340	0x668	data	English	United States
RT_ICON	0x5d9e8	0x2e8	data	English	United States
RT_ICON	0x5dce8	0x10a8	data	English	United States
RT_GROUP_ICON	0x5d9a8	0x3e	data	English	United States
RT_GROUP_ICON	0x5dcd0	0x14	data	English	United States
RT_GROUP_ICON	0x5ed90	0x14	data	English	United States
RT_VERSION	0x52280	0x308	data	English	United States
RT_MANIFEST	0x5eda8	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
WS2_32.dll	listen, WSASetLastError, send, accept, select, getsockname, ntohs, connect, recv, WSACloseEvent, WSACreateEvent, WSAEventSelect, gethostbyname, getnameinfo, getaddrinfo, freeaddrinfo, bind, WSAIoctl, closesocket, ntohl, inet_addr, socket, inet_ntoa, getservbyname, gethostname, recvfrom, htonl, sendto, setsockopt, WSAGetLastError, WSACleanup, WSAStartup, htons
IPHLPAPI.DLL	GetIpNetTable, SendARP, GetAdaptersAddresses, DeleteIpNetEntry
KERNEL32.dll	LCMapStringW, HeapReAlloc, GetTimeZoneInformation, OutputDebugStringW, GetModuleFileNameA, lstrlenA, lstrcatA, lstrcpyA, lstrcmpiA, SetConsoleCtrlHandler, Sleep, GetLastError, GetVersionExA, LocalFree, FormatMessageA, WriteFile, SetThreadPriority, SetFilePointer, CreateFileA, GetCurrentThread, GetThreadPriority, CloseHandle, GetLocalTime, FlushFileBuffers, SetLastError, GetCurrentThreadId, lstrcmpA, GetFileSize, GetTickCount, lstrcpynA, WaitForSingleObject, ResetEvent, GetEnvironmentVariableA, GetCurrentDirectoryW, GetCurrentDirectoryA, GetSystemTime, WaitForMultipleObjects, SetEvent, CreateEventA, CreateThread, ReadFile, SetFilePointerEx, CreateMutexA, ReleaseMutex, OutputDebugStringA, GetPrivateProfileStringA, WritePrivateProfileStringA, FileTimeToLocalFileTime, FindClose, FindFirstFileA, FindNextFileA, GetFileAttributesA, FileTimeToSystemTime, GetDateFormatA, GetSystemTimeAsFileTime, HeapAlloc, GetCommandLineW, GetCommandLineA, SystemTimeToTzSpecificLocalTime, HeapFree, PeekNamedPipe, GetFileInformationByHandle, GetDriveTypeW, CreateFileW, WriteConsoleW, GetModuleFileNameW, GetFileType, GetStdHandle, FreeLibraryAndExitThread, ResumeThread, ExitThread, GetModuleHandleExW, ExitProcess, RaiseException, LoadLibraryExW, GetProcAddress, CompareStringW, MultiByteToWideChar, GetFullPathNameW, SetStdHandle, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetStringTypeW, GetProcessHeap, GetConsoleCP, GetConsoleMode, GetFileSizeEx, HeapSize, ReadConsoleW, SetEndOfFile, GetFullPathNameA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary
USER32.dll	LoadIconA, GetParent, GetDesktopWindow, GetClassLongPtrA, GetWindowLongPtrA, GetWindowRect, SetWindowTextA, ReleaseDC, GetDC, DrawIcon, GetSystemMetrics, SetFocus, EndDialog, DialogBoxIndirectParamA, SetWindowPos, DestroyWindow, CreateWindowExA, MessageBeep, MessageBoxA, wsprintfA, DestroyIcon, SendMessageA
GDI32.dll	GetTextExtentPoint32A
ADVAPI32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCreateKeyExA, RegCloseKey, RegDeleteKeyA, StartServiceCtrlDispatcherA, DeregisterEventSource, CreateServiceA, QueryServiceStatus, CloseServiceHandle, SetServiceStatus, RegisterServiceCtrlHandlerA, OpenSCManagerA, DeleteService, ControlService, ReportEventA, ChangeServiceConfig2A, OpenServiceA, RegisterEventSourceA

Version Infos

Description	Data
LegalCopyright	Copyrighted 2018 by Ph. Jounin
InternalName	tftpd32 service edition
FileVersion
CompanyName	Ph. Jounin
LegalTrademarks
ProductName	tftpd32 service edition
ProductVersion	4.62
FileDescription	TFTP server
OriginalFileName	tftpd32
Translation	0x040c 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: tftpd64_svc.exe PID: 2588 Parent PID: 6136

General

Start time:	16:11:42
Start date:	18/11/2021
Path:	C:\Users\user\Desktop\tftpd64_svc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\tftpd64_svc.exe"
Imagebase:	0x7ff61dd80000
File size:	334336 bytes
MD5 hash:	7EA3BBF84F39CC37C208945461230614
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 1544 Parent PID: 2588

General

Start time:	16:11:43
Start date:	18/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: tftpd64_svc.exe PID: 2588 Parent PID: 6136 tftpd64_svc.exeCOMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.4%
Total number of Nodes:	1302
Total number of Limit Nodes:	18

Executed Functions

Function 00007FF61DD816A0, Relevance: 100.0, APIs: 28, Strings: 29, Instructions: 240
servicesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32 ref: 00007FF61DD816D7
GetModuleFileNameA.KERNEL32 ref: 00007FF61DD816F5
OpenSCManagerA.ADVAPI32 ref: 00007FF61DD81729
CreateServiceA.ADVAPI32 ref: 00007FF61DD81795
GetVersionExA.KERNEL32 ref: 00007FF61DD817B6
ChangeServiceConfig2A.ADVAPI32 ref: 00007FF61DD817ED
CloseServiceHandle.ADVAPI32 ref: 00007FF61DD81805
CloseServiceHandle.ADVAPI32 ref: 00007FF61DD8180E

Part of subcall function 00007FF61DD81500: GetLastError.KERNEL32 ref: 00007FF61DD81511
Part of subcall function 00007FF61DD81500: FormatMessageA.KERNEL32 ref: 00007FF61DD81537
Part of subcall function 00007FF61DD81500: lstrlenA.KERNEL32 ref: 00007FF61DD81557
Part of subcall function 00007FF61DD81500: GetLastError.KERNEL32 ref: 00007FF61DD8156A
Part of subcall function 00007FF61DD81500: LocalFree.KERNEL32 ref: 00007FF61DD8159A

lstrcmpiA.KERNEL32 ref: 00007FF61DD81845
OpenSCManagerA.ADVAPI32 ref: 00007FF61DD8185D
OpenServiceA.ADVAPI32 ref: 00007FF61DD8187F
ControlService.ADVAPI32 ref: 00007FF61DD818A0
Sleep.KERNEL32 ref: 00007FF61DD818C9
QueryServiceStatus.ADVAPI32 ref: 00007FF61DD818D9
Sleep.KERNEL32 ref: 00007FF61DD818FF
QueryServiceStatus.ADVAPI32 ref: 00007FF61DD8190F
DeleteService.ADVAPI32 ref: 00007FF61DD8193D
CloseServiceHandle.ADVAPI32 ref: 00007FF61DD8196D
CloseServiceHandle.ADVAPI32 ref: 00007FF61DD81976

Strings

%s failed to stop., xrefs: 00007FF61DD8192E
-install, xrefs: 00007FF61DD816CD
StartServiceCtrlDispatcher failed., xrefs: 00007FF61DD81B0B
CreateService failed - %s, xrefs: 00007FF61DD81821
Tftpd32 operates a TFTP server, xrefs: 00007FF61DD817D4
%s -remove to remove the service, xrefs: 00007FF61DD81A9C
-remove, xrefs: 00007FF61DD8183E
OpenSCManager failed - %s, xrefs: 00007FF61DD819AB
OpenService failed - %s, xrefs: 00007FF61DD81989
%s -install to install the service, xrefs: 00007FF61DD81A89
Stopping %s., xrefs: 00007FF61DD818B8
Tftpd32 service edition, xrefs: 00007FF61DD81707, 00007FF61DD8173D, 00007FF61DD818A6, 00007FF61DD819D0
-uninstall, xrefs: 00007FF61DD81A0C
StartServiceCtrlDispatcher failed. Error %d, xrefs: 00007FF61DD81AFF
Unable to install %s - %s, xrefs: 00007FF61DD8170E
-debug, xrefs: 00007FF61DD819BF
Tftpd32_svc, xrefs: 00007FF61DD81749, 00007FF61DD81875
%s removed., xrefs: 00007FF61DD81947
%s stopped., xrefs: 00007FF61DD8191F
SOFTWARE\TFTPD32, xrefs: 00007FF61DD81A31
%s -uninstall to suppress registry entries and settings, xrefs: 00007FF61DD81AC2
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD81A1D
%s installed., xrefs: 00007FF61DD817F6
%s -debug <params> to run as a console app for debugging, xrefs: 00007FF61DD81AAF
StartServiceCtrlDispatcher being called., xrefs: 00007FF61DD81ACE
DeleteService failed - %s, xrefs: 00007FF61DD81950
Tftpd32, xrefs: 00007FF61DD81A82, 00007FF61DD81A95, 00007FF61DD81AA8, 00007FF61DD81ABB
This may take several seconds. Please wait., xrefs: 00007FF61DD81ADA
Debugging %s., xrefs: 00007FF61DD819E1

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Service$CloseHandle$Open$ErrorLastManagerQuerySleepStatuslstrcmpi$ChangeConfig2ControlCreateDeleteFileFormatFreeLocalMessageModuleNameVersionlstrlen
String ID: %s failed to stop.$%s stopped.$StartServiceCtrlDispatcher being called.$%s -debug <params> to run as a console app for debugging$%s -install to install the service$%s -remove to remove the service$%s -uninstall to suppress registry entries and settings$%s installed.$%s removed.$-debug$-install$-remove$-uninstall$CreateService failed - %s$Debugging %s.$DeleteService failed - %s$OpenSCManager failed - %s$OpenService failed - %s$SOFTWARE\TFTPD32$SOFTWARE\TFTPD32\DHCP$StartServiceCtrlDispatcher failed.$StartServiceCtrlDispatcher failed. Error %d$Stopping %s.$Tftpd32$Tftpd32 operates a TFTP server$Tftpd32 service edition$Tftpd32_svc$This may take several seconds. Please wait.$Unable to install %s - %s
API String ID: 166101069-4046512295
Opcode ID: e2b86e749bbf14b86110556fb8447a1b67b8f8f08c12c8f5aa9a3e674dc0cbf4
Instruction ID: c65a78032742621e633bf715d28e6d5b59be4e5343bddd80791b719ab2faf71f
Opcode Fuzzy Hash: e2b86e749bbf14b86110556fb8447a1b67b8f8f08c12c8f5aa9a3e674dc0cbf4
Instruction Fuzzy Hash: B4C11720E0CE4F91EA119B21E8542BA23A4EF46FE9F40A335D54EC26E5FF6CE549D301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD90B68, Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF61DD90B71
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA1080

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 30f9191b5c8b5762895524e91c8c452617ce949452180edc03544f7a69bb343f
Instruction ID: a664d302363d1e937a8a9802e646292d9fbea9679340a9e8e836ba8dbe7c5893
Opcode Fuzzy Hash: 30f9191b5c8b5762895524e91c8c452617ce949452180edc03544f7a69bb343f
Instruction Fuzzy Hash: 03E08C24E4D89BC1F61933B64C530BC30802F49BB0F108339E11CC13E2EC1E60828B1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD815B0, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF61DD815E3
RegisterEventSourceA.ADVAPI32 ref: 00007FF61DD815F8
ReportEventA.ADVAPI32 ref: 00007FF61DD81667
DeregisterEventSource.ADVAPI32 ref: 00007FF61DD81670

Strings

%s error: %d, xrefs: 00007FF61DD8160C
Tftpd32_svc, xrefs: 00007FF61DD815E9, 00007FF61DD81605

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event$Source$DeregisterErrorLastRegisterReport
String ID: %s error: %d$Tftpd32_svc
API String ID: 544316925-1106718660
Opcode ID: 47c7756775b06bb74b172c730a5374ea5b1304857d733cca4369eeff68a12dad
Instruction ID: 340be8df0cd7d1df2f64cd8cda60c8e226ec84e8896c1226b304787139d0da20
Opcode Fuzzy Hash: 47c7756775b06bb74b172c730a5374ea5b1304857d733cca4369eeff68a12dad
Instruction Fuzzy Hash: 8F211571E0DF8981EB218B20F4517AA73A0FB49BA4F445335D58D87B64EF7CD1488B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD90B84, Relevance: 9.1, APIs: 6, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF61DD90B98

Part of subcall function 00007FF61DD90DCC: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF61DD90DEE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF61DD90BAD
__scrt_release_startup_lock.LIBCMT ref: 00007FF61DD90C1B
__scrt_is_managed_app.LIBCMT ref: 00007FF61DD90C92
__scrt_fastfail.LIBCMT ref: 00007FF61DD90CE0
__scrt_fastfail.LIBCMT ref: 00007FF61DD90CEB

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__vcrt_initialize
String ID:
API String ID: 3691304421-0
Opcode ID: a42740852e2a71879d0b6d9e774216d38402d0cb334e7af095ff70f15a69f0b6
Instruction ID: 820ab805eb34f4da186ba05d8ec8902900a7e1cd168207d64386da9b339d22d8
Opcode Fuzzy Hash: a42740852e2a71879d0b6d9e774216d38402d0cb334e7af095ff70f15a69f0b6
Instruction Fuzzy Hash: FA315121E09D6F45FA58BB64E8613B91391AF45FA4F444338E60DC72E7FE2EB4458340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAABD4, Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAAC15
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF61DDAAB93,?,?,?,00007FF61DDAC502), ref: 00007FF61DDAACD4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF61DDAAB93,?,?,?,00007FF61DDAC502), ref: 00007FF61DDAAD54

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 02c0d7e0865ebf69948aaec949e578a5e157c8d302793733ca861cffe77f80d5
Instruction ID: d636d0c0ea4af69534efec963d3439f419c43061773e4c808769d0b80b8995d8
Opcode Fuzzy Hash: 02c0d7e0865ebf69948aaec949e578a5e157c8d302793733ca861cffe77f80d5
Instruction Fuzzy Hash: 4C81C022F18E1A85FB109B61D8402BE67A0BB44FA4F44D335DA0E937A1FF3CA845C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD90AA0, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF61DD90AB7
_RTC_Initialize.LIBCMT ref: 00007FF61DD90AD8

Part of subcall function 00007FF61DD91000: _onexit.LIBCMT ref: 00007FF61DD91004

Part of subcall function 00007FF61DDA0808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA083A

__scrt_fastfail.LIBCMT ref: 00007FF61DD90B50
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF61DD90B5C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2724578021-0
Opcode ID: ba357d4d5091e2d1ea9b720c8367ebb43e9a42d9222d5326bf4b452a114bb584
Instruction ID: 7136552809bb014ae20a5ab7104fe07f60b44ed678624b336da8d7833be19a5e
Opcode Fuzzy Hash: ba357d4d5091e2d1ea9b720c8367ebb43e9a42d9222d5326bf4b452a114bb584
Instruction Fuzzy Hash: 7D119A44E88E9F41FA5C77B155732B812815F40BA8F404738E60DC66D7FD1FB8548B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8E468, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0

Part of subcall function 00007FF61DD97098: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD970ED

OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

Strings

Th%5d :, xrefs: 00007FF61DD8E4AB

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_invalid_parameter_noinfo
String ID: Th%5d :
API String ID: 1057960562-2094246374
Opcode ID: 6f309b5886740b582ba55119b8bac4cb9fb8584d99b16300ea1af16be0342888
Instruction ID: 987a791adab9f961640004e242b265c1e7dea72e11c8d24d9c87f2e38d82ce64
Opcode Fuzzy Hash: 6f309b5886740b582ba55119b8bac4cb9fb8584d99b16300ea1af16be0342888
Instruction Fuzzy Hash: 49115E32B28A8482E7109B20F8997EA7364FB88BE4F504235EA5D83794EF3CD559C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD929EC, Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF61DD929EB), ref: 00007FF61DD92A15
TerminateProcess.KERNEL32(?,?,?,00007FF61DD929EB), ref: 00007FF61DD92A20
ExitProcess.KERNEL32 ref: 00007FF61DD92A2F

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc2466b6cacb8676fc719d81873ee1cfec8de597c265546977d0301ffa2f8e53
Instruction ID: 89e3deeb160ea2f0ee9738a7cd272880f1b62e1ee6523e45f6bee6f78ce189a7
Opcode Fuzzy Hash: dc2466b6cacb8676fc719d81873ee1cfec8de597c265546977d0301ffa2f8e53
Instruction Fuzzy Hash: B0E04820F54F0D46E7686B7058D537912917F49F71F509738C40E83396ED3EE4488350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA1F9C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA1FBF

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF61DDA1FB8

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 76a54c11b5a289d529224fc560e7af8ae878f838e1919e9749c68a1c38dff14a
Instruction ID: ca47d7f2ebd94ba9fba89562c87684390e70cfaef399c0ffd588b4738f4e4134
Opcode Fuzzy Hash: 76a54c11b5a289d529224fc560e7af8ae878f838e1919e9749c68a1c38dff14a
Instruction Fuzzy Hash: BAE04F52E04D0E91FE4487A2A8001F012519F09BBCF888332DD3C8A3E0AE6DA9958340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA90A0, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF61DDA09B3,?,?,?,00007FF61DDA0C76), ref: 00007FF61DDA90B9
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF61DDA09B3,?,?,?,00007FF61DDA0C76), ref: 00007FF61DDA917D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 2091b6f0f1c8ad31d13b8bdc660e953065175c5d88b77f22816a7c47a8e8d09a
Instruction ID: c62a9814cdd2e95554f5de483cb97bea5414369862581448a6a8c3d0b2db5c69
Opcode Fuzzy Hash: 2091b6f0f1c8ad31d13b8bdc660e953065175c5d88b77f22816a7c47a8e8d09a
Instruction Fuzzy Hash: 99216925F18F5581E6249F11644406A6694FF59FE0F888334DE8EA7BE5EF3CD4528704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAA758, Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF61DDAA80B
GetLastError.KERNEL32 ref: 00007FF61DDAA827

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: fa8b0b6920740ad832c7753448e05748eaceb5bb3493eeeb5ee8ec83d892d722
Instruction ID: 975d6cc626503075df46d6e921d598abcb2e1d1ef2baf3fc43510d56abc94da6
Opcode Fuzzy Hash: fa8b0b6920740ad832c7753448e05748eaceb5bb3493eeeb5ee8ec83d892d722
Instruction Fuzzy Hash: A631C232E18E899AD7108F25E4406AA67A0FB08B94F449231DA4D87764EF3CD456CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA2D40, Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF61DDA2DB9
GetFileType.KERNELBASE ref: 00007FF61DDA2DCF

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: e0e7dba5b246c3015a7d10c782e400dc5902133af6251522fc5767818df6321c
Instruction ID: 56f06d9a8fb0e9725a84214c90e864a026b72fff16557e442ae338361e0ef209
Opcode Fuzzy Hash: e0e7dba5b246c3015a7d10c782e400dc5902133af6251522fc5767818df6321c
Instruction Fuzzy Hash: D431C122E19E5A81EB648B1695D01782A50FB05FB0F246339DB6E873F1DF38E4A1D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAAAE8, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208d957f21addd658668b9691f3384f03ea842347435d0c27a7aea9e7bc47d40
Instruction ID: 98911ca8d299aa3024b66c446aceae558846374ed9a61d4d34cad2765d4c60b8
Opcode Fuzzy Hash: 208d957f21addd658668b9691f3384f03ea842347435d0c27a7aea9e7bc47d40
Instruction Fuzzy Hash: 6B21B032E08A4A46E6416F619C4137A7651BF84FF0F569736E91D873E2EE7CE4818701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD92930, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF61DD9294F

Part of subcall function 00007FF61DD92A38: GetModuleHandleExW.KERNEL32 ref: 00007FF61DD92A54
Part of subcall function 00007FF61DD92A38: GetProcAddress.KERNEL32 ref: 00007FF61DD92A6A
Part of subcall function 00007FF61DD92A38: FreeLibrary.KERNEL32 ref: 00007FF61DD92A87

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: d5236bb2c87ca35d99dd1b730b2a131581d0ffec56fcdb2e33d4d99684f890c0
Instruction ID: b286ad24fbc909007ce1abcd594d0ce7a920048bce9693476e0d643c2bc24624
Opcode Fuzzy Hash: d5236bb2c87ca35d99dd1b730b2a131581d0ffec56fcdb2e33d4d99684f890c0
Instruction Fuzzy Hash: 9B215076E04B4599EF198F74C4942FC3BA0FB44B2CF845636D64D82A85EF39D545CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD96F78, Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD96FA9

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 85b1d8961efe6d4028d8c59653a5dcdb9803cc0320aa63736f36d41519e3501a
Instruction ID: 1a0053ab8852e96ccb1cccfc934850c4202362a9785c19630f0f05ff7afa6260
Opcode Fuzzy Hash: 85b1d8961efe6d4028d8c59653a5dcdb9803cc0320aa63736f36d41519e3501a
Instruction Fuzzy Hash: 1011B076A00F1A9CEB14CFB0E8800DC37B8FB187ACB504626EA5C52B58EF34D1A5C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA2EC8, Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF61DDA4815,?,?,?,00007FF61DD93993), ref: 00007FF61DDA2F06

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b1461cb8123c6476f8670c011686dfa0a9eee1c6a63ccab4a673a40c5816229f
Instruction ID: 33e2e6ca55a11572c109b342e217940a3d9572cd8c90d88895e31013060c0255
Opcode Fuzzy Hash: b1461cb8123c6476f8670c011686dfa0a9eee1c6a63ccab4a673a40c5816229f
Instruction Fuzzy Hash: 6CF01C01F0DA5E85FE6467B3598277567A05F44FB0F889734DD2EC62E2FE6CA4948310

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF61DD8B080, Relevance: 144.2, APIs: 46, Strings: 36, Instructions: 662networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD8B0C0

Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
Part of subcall function 00007FF61DD81F60: GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD81FFD
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
Part of subcall function 00007FF61DD81F60: GetLocalTime.KERNEL32 ref: 00007FF61DD82047
Part of subcall function 00007FF61DD81F60: WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD8213A

Part of subcall function 00007FF61DD81F60: ReleaseMutex.KERNEL32 ref: 00007FF61DD8216D
Part of subcall function 00007FF61DD81F60: CreateFileA.KERNEL32 ref: 00007FF61DD821DA
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD821EC

Strings

<%s> changed to <%u>, xrefs: 00007FF61DD8B904
<%s> proposed by client %d, refused by Tftpd32, xrefs: 00007FF61DD8B727
netascii, xrefs: 00007FF61DD8B26C
ascii, xrefs: 00007FF61DD8B283
Error: Tftpd32 does not handle filenames with a percent sign, xrefs: 00007FF61DD8B160
Option is <%s>, xrefs: 00007FF61DD8B64E
udpport, xrefs: 00007FF61DD8B93F
final name : <%s>, xrefs: 00007FF61DD8B528
File <%s> : error %d in system call %s %s, xrefs: 00007FF61DD8B5B1
%s\%s, xrefs: 00007FF61DD8B1D3
Option <%s>: value <%s>, xrefs: 00007FF61DD8B6DB
mail, xrefs: 00007FF61DD8B297
<%s> changed to <%s>, xrefs: 00007FF61DD8B77E, 00007FF61DD8B81D
FileName is <%s>, xrefs: 00007FF61DD8B17E
octet, xrefs: 00007FF61DD8B2B4
OACK: <%s>, xrefs: 00007FF61DD8BAD7
Uncorrect message, xrefs: 00007FF61DD8B2DC
Mode is <%s>, xrefs: 00007FF61DD8B2F5
Error EACCESS on file %s. Ext error %s, xrefs: 00007FF61DD8B4B7
dir.txt, xrefs: 00007FF61DD8B1C5
CreateFile, xrefs: 00007FF61DD8B5B8
mode is too long, return EBADOP to peer, xrefs: 00007FF61DD8B260
Size of OACK string : <%d>, xrefs: 00007FF61DD8BAE7
, xrefs: 00007FF61DD8B987
binary, xrefs: 00007FF61DD8B2C8
Unexpected request %d from peer, xrefs: 00007FF61DD8B0D8
using udpport option --> %s, xrefs: 00007FF61DD8B9AE
<%s> proposed by client %d, reply with %d, xrefs: 00007FF61DD8B752
blksize, xrefs: 00007FF61DD8B6FC
Read, xrefs: 00007FF61DD8B306
Returning EBADOP to Peer, xrefs: 00007FF61DD8B0E6
Write, xrefs: 00007FF61DD8B315
timeout, xrefs: 00007FF61DD8B7F0
%s request for file <%s>. Mode %s, xrefs: 00007FF61DD8B321
File name too long, return EBADOP to peer, xrefs: 00007FF61DD8BB2C
tsize, xrefs: 00007FF61DD8B875

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Thread$CurrentPrioritySleep$CreateFileLocalMutexObjectReleaseSingleTimeWaithtons
String ID: $%s request for file <%s>. Mode %s$%s\%s$<%s> changed to <%s>$<%s> changed to <%u>$<%s> proposed by client %d, refused by Tftpd32$<%s> proposed by client %d, reply with %d$CreateFile$Error EACCESS on file %s. Ext error %s$Error: Tftpd32 does not handle filenames with a percent sign$File <%s> : error %d in system call %s %s$File name too long, return EBADOP to peer$FileName is <%s>$Mode is <%s>$OACK: <%s>$Option <%s>: value <%s>$Option is <%s>$Read$Returning EBADOP to Peer$Size of OACK string : <%d>$Uncorrect message$Unexpected request %d from peer$Write$ascii$binary$blksize$dir.txt$final name : <%s>$mail$mode is too long, return EBADOP to peer$netascii$octet$timeout$tsize$udpport$using udpport option --> %s
API String ID: 3337751635-2178039422
Opcode ID: b89c40831197293aa8a316b0371ab174d9b35edd3ad7cda9b5baf66c7560ed8e
Instruction ID: 6bfd06d8f8e3ba6a4d20eeedf7091d1e96579face60b514cf7226c8c28e25c38
Opcode Fuzzy Hash: b89c40831197293aa8a316b0371ab174d9b35edd3ad7cda9b5baf66c7560ed8e
Instruction Fuzzy Hash: AF52CF61E08E4A86EB258B35E4443BA63A1FF45FA8F41A335CA4E87695FF3CE505D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD84E90, Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 404sleepnetworkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD85F70: wsprintfA.USER32 ref: 00007FF61DD86039
Part of subcall function 00007FF61DD85F70: wsprintfA.USER32 ref: 00007FF61DD8608D
Part of subcall function 00007FF61DD85F70: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD86135

Sleep.KERNEL32 ref: 00007FF61DD84EDE
setsockopt.WS2_32 ref: 00007FF61DD84FF7
setsockopt.WS2_32 ref: 00007FF61DD8501B
WSAGetLastError.WS2_32 ref: 00007FF61DD85025
setsockopt.WS2_32 ref: 00007FF61DD85053
WSAGetLastError.WS2_32 ref: 00007FF61DD8505E
WSAGetLastError.WS2_32 ref: 00007FF61DD85072
inet_ntoa.WS2_32 ref: 00007FF61DD851BE

Part of subcall function 00007FF61DD8F0F4: lstrcpynA.KERNEL32 ref: 00007FF61DD8F158
Part of subcall function 00007FF61DD8F0F4: GetPrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F17F

Part of subcall function 00007FF61DD8F0F4: lstrcpynA.KERNEL32 ref: 00007FF61DD8F1BB

Part of subcall function 00007FF61DD863E0: lstrcpyA.KERNEL32 ref: 00007FF61DD86419
Part of subcall function 00007FF61DD863E0: lstrcpyA.KERNEL32 ref: 00007FF61DD86441
Part of subcall function 00007FF61DD863E0: lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DD87974), ref: 00007FF61DD864A7

wsprintfA.USER32 ref: 00007FF61DD85144
GetLastError.KERNEL32 ref: 00007FF61DD85268
recvfrom.WS2_32 ref: 00007FF61DD852A2
GetLastError.KERNEL32 ref: 00007FF61DD852AC
GetLastError.KERNEL32 ref: 00007FF61DD852BD
Sleep.KERNEL32 ref: 00007FF61DD852DC
Sleep.KERNEL32 ref: 00007FF61DD85314
inet_addr.WS2_32 ref: 00007FF61DD8532F
Sleep.KERNEL32 ref: 00007FF61DD8535C
inet_ntoa.WS2_32 ref: 00007FF61DD8533D

Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
Part of subcall function 00007FF61DD81F60: GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD81FFD
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
Part of subcall function 00007FF61DD81F60: GetLocalTime.KERNEL32 ref: 00007FF61DD82047
Part of subcall function 00007FF61DD81F60: WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD8213A

Sleep.KERNEL32 ref: 00007FF61DD85386
gethostname.WS2_32 ref: 00007FF61DD853AB
lstrcpyA.KERNEL32 ref: 00007FF61DD853C4
lstrcmpA.KERNEL32 ref: 00007FF61DD85401

Strings

Thread 0x%X: send %d bytes, xrefs: 00007FF61DD854FA
Recv error %d, xrefs: 00007FF61DD852C3
%02X%c, xrefs: 00007FF61DD85134
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD84F17, 00007FF61DD84F42
udp, xrefs: 00007FF61DD8556B
IP_Pool, xrefs: 00007FF61DD84F08
DHCP thread ends here, xrefs: 00007FF61DD85627
Message truncated (length was %d), xrefs: 00007FF61DD852F1
PoolSize, xrefs: 00007FF61DD84F3B
Can add broadcast capabilty to DHCP socket ! Error %d, xrefs: 00007FF61DD8502D
sendto error %d: %s, xrefs: 00007FF61DD85523
bootpc, xrefs: 00007FF61DD85572
%d Request %d not processed, xrefs: 00007FF61DD8543E
FF:F, xrefs: 00007FF61DD850FF
Packet addressed to %s, xrefs: 00007FF61DD85417
Tftpd32DchpServer, xrefs: 00007FF61DD853B6
Message received on an unbound interface (IP %s), xrefs: 00007FF61DD85343
Lease file updated.Discover Devices, xrefs: 00007FF61DD84FCC
Can add PKTINFO capabilty to DHCP socket ! Error %d, xrefs: 00007FF61DD85066

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: SleepThread$ErrorLast$Currentlstrcpy$Prioritysetsockoptwsprintf$inet_ntoalstrcpyn$LocalObjectPrivateProfileSingleStringTimeWaitgethostnameinet_addrlstrcmprecvfrom
String ID: %02X%c$%d Request %d not processed$Can add PKTINFO capabilty to DHCP socket ! Error %d$Can add broadcast capabilty to DHCP socket ! Error %d$DHCP thread ends here$FF:F$IP_Pool$Lease file updated.Discover Devices$Message received on an unbound interface (IP %s)$Message truncated (length was %d)$Packet addressed to %s$PoolSize$Recv error %d$SOFTWARE\TFTPD32\DHCP$Tftpd32DchpServer$Thread 0x%X: send %d bytes$bootpc$sendto error %d: %s$udp
API String ID: 2244681156-3910943496
Opcode ID: d23445066f6ebbb985f7810bed91c0c3ae3392db6b155ea580e7e2da96cde6eb
Instruction ID: 723398f69fe9b6527ab4461ad8ebef055e3abe55bacc0cdb8fdba896b73c29eb
Opcode Fuzzy Hash: d23445066f6ebbb985f7810bed91c0c3ae3392db6b155ea580e7e2da96cde6eb
Instruction Fuzzy Hash: A7226D21E08E8A95EB218B24E8403B977A1FF45F68F84533AD64D876D9EF7CE548D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D82B, Relevance: 91.3, APIs: 34, Strings: 18, Instructions: 312networksleepsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

GetLastError.KERNEL32 ref: 00007FF61DD8D917

Part of subcall function 00007FF61DD822A0: lstrlenA.KERNEL32 ref: 00007FF61DD82308
Part of subcall function 00007FF61DD822A0: WaitForSingleObject.KERNEL32 ref: 00007FF61DD82329
Part of subcall function 00007FF61DD822A0: Sleep.KERNEL32 ref: 00007FF61DD8235A
Part of subcall function 00007FF61DD822A0: ReleaseMutex.KERNEL32 ref: 00007FF61DD8238E

WSACreateEvent.WS2_32 ref: 00007FF61DD8D930
WSAEventSelect.WS2_32 ref: 00007FF61DD8D94B
WaitForMultipleObjects.KERNEL32 ref: 00007FF61DD8D96F
WSACloseEvent.WS2_32 ref: 00007FF61DD8D97F
closesocket.WS2_32 ref: 00007FF61DD8D98C
accept.WS2_32 ref: 00007FF61DD8D9A4
GetLastError.KERNEL32 ref: 00007FF61DD8D9B3
WSACloseEvent.WS2_32 ref: 00007FF61DD8D9CC
closesocket.WS2_32 ref: 00007FF61DD8D9D9
Sleep.KERNEL32 ref: 00007FF61DD8D9FE
setsockopt.WS2_32 ref: 00007FF61DD8DA36
GetLastError.KERNEL32 ref: 00007FF61DD8DA40
Sleep.KERNEL32 ref: 00007FF61DD8DA8F
CreateMutexA.KERNEL32 ref: 00007FF61DD8DACA
CreateEventA.KERNEL32 ref: 00007FF61DD8DAE1
WSACreateEvent.WS2_32 ref: 00007FF61DD8DB1D
WSAEventSelect.WS2_32 ref: 00007FF61DD8DB34
WaitForMultipleObjects.KERNEL32 ref: 00007FF61DD8DB5E
WSAEventSelect.WS2_32 ref: 00007FF61DD8DB7D
ResetEvent.KERNEL32 ref: 00007FF61DD8DB88
GetLastError.KERNEL32 ref: 00007FF61DD8DBD7
WSAEventSelect.WS2_32 ref: 00007FF61DD8DBFD
WSACloseEvent.WS2_32 ref: 00007FF61DD8DC24
closesocket.WS2_32 ref: 00007FF61DD8DC36
CloseHandle.KERNEL32 ref: 00007FF61DD8DC43
CloseHandle.KERNEL32 ref: 00007FF61DD8DC5B
SetEvent.KERNEL32 ref: 00007FF61DD8DC8C
Sleep.KERNEL32 ref: 00007FF61DD8DC97
SetEvent.KERNEL32 ref: 00007FF61DD8DCA4

Part of subcall function 00007FF61DD8DE20: getaddrinfo.WS2_32 ref: 00007FF61DD8DE76
Part of subcall function 00007FF61DD8DE20: wsprintfA.USER32 ref: 00007FF61DD8DEA4
Part of subcall function 00007FF61DD8DE20: getaddrinfo.WS2_32 ref: 00007FF61DD8DEB8

htons.WS2_32 ref: 00007FF61DD8DD65
send.WS2_32 ref: 00007FF61DD8DD7F
send.WS2_32 ref: 00007FF61DD8DD94
SetEvent.KERNEL32 ref: 00007FF61DD8DDC8

Strings

can not create listening socketError %d, xrefs: 00007FF61DD8D91F
Console %sconnected, xrefs: 00007FF61DD8D8B3, 00007FF61DD8DAAD
tftpd32, xrefs: 00007FF61DD8D8FE
Version check OK, xrefs: 00007FF61DD8DA9A
Rc!=0, xrefs: 00007FF61DD8DDE3
End of console thread, xrefs: 00007FF61DD8DCE1
received %d bytes from console, xrefs: 00007FF61DD8DBBC
opening comm socket, xrefs: 00007FF61DD8D8A0
Verify Console/GUI parameters, xrefs: 00007FF61DD8DA5E
end of GUI session, xrefs: 00007FF61DD8DC61
dis, xrefs: 00007FF61DD8D8AC
rcvd error %d/%d in console, xrefs: 00007FF61DD8DBE0
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD8DDDC
Tftpd32, xrefs: 00007FF61DD8DAFE
accept error %d, xrefs: 00007FF61DD8D9BB
Can not create resource, xrefs: 00007FF61DD8DB05
Error %d during setsockopt, xrefs: 00007FF61DD8DA48
tftpd32, xrefs: 00007FF61DD8D897

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event$Close$CreateErrorLastSelectSleep$Waitclosesocket$HandleMultipleMutexObjectsgetaddrinfosend$CurrentDebugObjectOutputReleaseResetSingleStringThreadaccepthtonslstrlensetsockoptwsprintf
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Can not create resource$Console %sconnected$End of console thread$Error %d during setsockopt$Rc!=0$Tftpd32$Verify Console/GUI parameters$Version check OK$accept error %d$can not create listening socketError %d$dis$end of GUI session$opening comm socket$rcvd error %d/%d in console$received %d bytes from console$tftpd32$tftpd32
API String ID: 3437018365-4021603041
Opcode ID: eb0bd7fd5bb5caa1380680b8f23fdcc3ca114856ddcd43de520458a5a01e872e
Instruction ID: c1992e3a2375d26691f778f2c6da4f755b386660a92a7081a51fbde166d4fd09
Opcode Fuzzy Hash: eb0bd7fd5bb5caa1380680b8f23fdcc3ca114856ddcd43de520458a5a01e872e
Instruction Fuzzy Hash: 77F14821E08E4A86F7119B29E8546B92760BF85FB4F50A335D92EC26E5FF3CE445D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD83A80, Relevance: 79.5, APIs: 22, Strings: 23, Instructions: 706stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD83B94
inet_ntoa.WS2_32 ref: 00007FF61DD83BB0
lstrcpyA.KERNEL32 ref: 00007FF61DD83DA6
lstrcpyA.KERNEL32 ref: 00007FF61DD83DD5
lstrcpyA.KERNEL32 ref: 00007FF61DD83E43
wsprintfA.USER32 ref: 00007FF61DD83EA5
SendARP.IPHLPAPI ref: 00007FF61DD84024
inet_ntoa.WS2_32 ref: 00007FF61DD8406D
inet_addr.WS2_32 ref: 00007FF61DD841E7
htonl.WS2_32 ref: 00007FF61DD841EF
htonl.WS2_32 ref: 00007FF61DD841F9
inet_addr.WS2_32 ref: 00007FF61DD8420E
htonl.WS2_32 ref: 00007FF61DD84216
htonl.WS2_32 ref: 00007FF61DD84226
inet_ntoa.WS2_32 ref: 00007FF61DD84365
inet_ntoa.WS2_32 ref: 00007FF61DD84391

Part of subcall function 00007FF61DD829B0: wsprintfA.USER32 ref: 00007FF61DD82A14
Part of subcall function 00007FF61DD829B0: inet_addr.WS2_32 ref: 00007FF61DD82A76

wsprintfA.USER32 ref: 00007FF61DD84424
inet_ntoa.WS2_32 ref: 00007FF61DD8443F
inet_ntoa.WS2_32 ref: 00007FF61DD844E0
inet_ntoa.WS2_32 ref: 00007FF61DD8452A
wsprintfA.USER32 ref: 00007FF61DD84604
inet_ntoa.WS2_32 ref: 00007FF61DD84642

Part of subcall function 00007FF61DD97B24: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD97B64

Strings

_InitialOfferTime, xrefs: 00007FF61DD83C84
Client requested address %s which was not allocated by tftpd32 and is either outside our pool or is used by someone else, xrefs: 00007FF61DD84397
Added lease for existing address %s, xrefs: 00007FF61DD84073
%02X%c, xrefs: 00007FF61DD83B84, 00007FF61DD83E95, 00007FF61DD84414, 00007FF61DD845F4
Previously allocated address %s acked, xrefs: 00007FF61DD8436B
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD83D9C
Rcvd %s Msg for IP %s, Mac %s, xrefs: 00007FF61DD83BB9
Item %d: IP %s, Mac %s, Age %d sec, %s, xrefs: 00007FF61DD8464D
DHCP, xrefs: 00007FF61DD8454C
BOOTP, xrefs: 00007FF61DD8453B
%s: statically assigned to address %s, xrefs: 00007FF61DD84451
Ack, xrefs: 00007FF61DD845BE
Client requested address %s, xrefs: 00007FF61DD844E6
Nak, xrefs: 00007FF61DD84628
%s: proposed address %s, xrefs: 00007FF61DD84545
%02d/%02d/%04d/%02d:%02d:%02d, xrefs: 00007FF61DD83D41
item destroyed, xrefs: 00007FF61DD83FB9
%s%d%s, xrefs: 00007FF61DD83C97
item %s released, xrefs: 00007FF61DD83EC1
no more address or address previously allocated by another server, xrefs: 00007FF61DD84516
Ignoring Bootp request, xrefs: 00007FF61DD843B9
Lease_, xrefs: 00007FF61DD83C8B
no more addresses or address previously allocated by another server, xrefs: 00007FF61DD842F7

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: inet_ntoa$wsprintf$htonl$inet_addrlstrcpy$Send_invalid_parameter_noinfo
String ID: %02X%c$%02d/%02d/%04d/%02d:%02d:%02d$%s%d%s$%s: proposed address %s$%s: statically assigned to address %s$Ack$Added lease for existing address %s$BOOTP$Client requested address %s$Client requested address %s which was not allocated by tftpd32 and is either outside our pool or is used by someone else$DHCP$Ignoring Bootp request$Item %d: IP %s, Mac %s, Age %d sec, %s$Lease_$Nak$Previously allocated address %s acked$Rcvd %s Msg for IP %s, Mac %s$SOFTWARE\TFTPD32\DHCP$_InitialOfferTime$item %s released$item destroyed$no more address or address previously allocated by another server$no more addresses or address previously allocated by another server
API String ID: 2793022205-3629169906
Opcode ID: daa2ef6b318eebcd7a323bc09116dbcd76c12fed6c1ba12203f1883d9396e641
Instruction ID: 268953622f26fdb34919932e6208583d4284b0d09afab2531203add051ae42ae
Opcode Fuzzy Hash: daa2ef6b318eebcd7a323bc09116dbcd76c12fed6c1ba12203f1883d9396e641
Instruction Fuzzy Hash: 1472CA61E08E8A86EB26CB24E4507B937A1EF45FA8F445239DA4EC3695FF3CE505D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD89C00, Relevance: 66.8, APIs: 27, Strings: 11, Instructions: 288stringnetworkCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD89CB3
GetAdaptersAddresses.IPHLPAPI ref: 00007FF61DD89CF5
GetAdaptersAddresses.IPHLPAPI ref: 00007FF61DD89D3E
wsprintfA.USER32 ref: 00007FF61DD89D6F
lstrcmpA.KERNEL32 ref: 00007FF61DD89D7C
inet_ntoa.WS2_32 ref: 00007FF61DD89DB3
lstrcpyA.KERNEL32 ref: 00007FF61DD89DC0
getaddrinfo.WS2_32 ref: 00007FF61DD89DF2
socket.WS2_32 ref: 00007FF61DD89E0F
GetLastError.KERNEL32 ref: 00007FF61DD89E2A
freeaddrinfo.WS2_32 ref: 00007FF61DD89E46
getaddrinfo.WS2_32 ref: 00007FF61DD89E93
GetLastError.KERNEL32 ref: 00007FF61DD89EA1
GetLastError.KERNEL32 ref: 00007FF61DD89EF3

Part of subcall function 00007FF61DD822A0: lstrlenA.KERNEL32 ref: 00007FF61DD82308
Part of subcall function 00007FF61DD822A0: WaitForSingleObject.KERNEL32 ref: 00007FF61DD82329
Part of subcall function 00007FF61DD822A0: Sleep.KERNEL32 ref: 00007FF61DD8235A
Part of subcall function 00007FF61DD822A0: ReleaseMutex.KERNEL32 ref: 00007FF61DD8238E

GetLastError.KERNEL32 ref: 00007FF61DD89EB6

Part of subcall function 00007FF61DD8ED18: GetLastError.KERNEL32 ref: 00007FF61DD8ED1C
Part of subcall function 00007FF61DD8ED18: FormatMessageA.KERNEL32 ref: 00007FF61DD8ED47
Part of subcall function 00007FF61DD8ED18: lstrcpynA.KERNEL32 ref: 00007FF61DD8ED73
Part of subcall function 00007FF61DD8ED18: LocalFree.KERNEL32 ref: 00007FF61DD8ED7E

Strings

Bind error %d%s, xrefs: 00007FF61DD8A054
bind port to %s port %s failed, xrefs: 00007FF61DD8A0CA
Port %d may be reused, xrefs: 00007FF61DD89F48
Error %d%sTftpd32 can not bind the %s portan application is already listening on this port, xrefs: 00007FF61DD8A0A8
setsockopt error, xrefs: 00007FF61DD89F51
tftp, xrefs: 00007FF61DD89DD5, 00007FF61DD89E5B
%ls, xrefs: 00007FF61DD89D64
Error %d%sTftpd32 tried to bind the %s portto the interface %swhich is not available for this hostEither remove the %s service or suppress %s interface assignation, xrefs: 00007FF61DD89EC1, 00007FF61DD8A077
Error : Can't create socketError %d (%s), xrefs: 00007FF61DD89E33, 00007FF61DD89EFC
, xrefs: 00007FF61DD8A006
unknown, xrefs: 00007FF61DD89FBF

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLast$AdaptersAddressesgetaddrinfowsprintf$FormatFreeLocalMessageMutexObjectReleaseSingleSleepWaitfreeaddrinfoinet_ntoalstrcmplstrcpylstrcpynlstrlensocket
String ID: $%ls$Bind error %d%s$Error %d%sTftpd32 can not bind the %s portan application is already listening on this port$Error %d%sTftpd32 tried to bind the %s portto the interface %swhich is not available for this hostEither remove the %s service or suppress %s interface assignation$Error : Can't create socketError %d (%s)$Port %d may be reused$bind port to %s port %s failed$setsockopt error$tftp$unknown
API String ID: 1575229138-3226681565
Opcode ID: 378c5e00a19c521b6e190ee915a1380c3dcfb99a4bf5c544899ce92da0676da8
Instruction ID: 14e68b05f1b1c4d9f6920c2602cd3d12d503efa9c3989e41669e2052a985159a
Opcode Fuzzy Hash: 378c5e00a19c521b6e190ee915a1380c3dcfb99a4bf5c544899ce92da0676da8
Instruction Fuzzy Hash: 16E16C32E08F4A86EB119B61E8402A977A0FB46FB8F545335DA5D83AE5EF3CE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8BE90, Relevance: 61.6, APIs: 18, Strings: 17, Instructions: 321networkfileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FF61DD8BF34
SetFilePointerEx.KERNEL32 ref: 00007FF61DD8BF60
ReadFile.KERNEL32 ref: 00007FF61DD8BF83
htons.WS2_32 ref: 00007FF61DD8BFB7
htons.WS2_32 ref: 00007FF61DD8BFC5
send.WS2_32 ref: 00007FF61DD8BFE2
recv.WS2_32 ref: 00007FF61DD8C034

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

htons.WS2_32 ref: 00007FF61DD8C063
htons.WS2_32 ref: 00007FF61DD8C076
htons.WS2_32 ref: 00007FF61DD8C08A
htons.WS2_32 ref: 00007FF61DD8C0D5
htons.WS2_32 ref: 00007FF61DD8C102
htons.WS2_32 ref: 00007FF61DD8C116

Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
Part of subcall function 00007FF61DD81F60: GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD81FFD
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
Part of subcall function 00007FF61DD81F60: GetLocalTime.KERNEL32 ref: 00007FF61DD82047
Part of subcall function 00007FF61DD81F60: WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD8213A

Part of subcall function 00007FF61DD81F60: ReleaseMutex.KERNEL32 ref: 00007FF61DD8216D
Part of subcall function 00007FF61DD81F60: CreateFileA.KERNEL32 ref: 00007FF61DD821DA
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD821EC

htons.WS2_32 ref: 00007FF61DD8C139
GetLastError.KERNEL32 ref: 00007FF61DD8C1DB
GetLastError.KERNEL32 ref: 00007FF61DD8C223
GetLastError.KERNEL32 ref: 00007FF61DD8C26B
GetLastError.KERNEL32 ref: 00007FF61DD8C2CF

Strings

rcvd packet too short, xrefs: 00007FF61DD8C04A
TIMEOUT waiting for Ack block #%d , xrefs: 00007FF61DD8C394
Ack of block #%d received (last block sent #%d !), xrefs: 00007FF61DD8C123
send, xrefs: 00007FF61DD8C23F
C:\Users\ark\source\repos\tftpd64\src\_services\tftpd_thread.c, xrefs: 00007FF61DD8BEB7
timeout while waiting for ack blk #%d, xrefs: 00007FF61DD8C15A
Peer returns ERROR <%s> -> aborting transfer, xrefs: 00007FF61DD8C2B4
ReadFile, xrefs: 00007FF61DD8C287
fseek, xrefs: 00007FF61DD8C1F7
File <%s> : error %d in system call %s %s, xrefs: 00007FF61DD8C1F0, 00007FF61DD8C238, 00007FF61DD8C280, 00007FF61DD8C2E4
WARNING : Last block #%d not acked for file <%s>, xrefs: 00007FF61DD8C324
MAX RETRIES while waiting for Ack block %d. file <%s>, xrefs: 00007FF61DD8C1B4
pTftp!=NULL, xrefs: 00007FF61DD8BEBE
Ack block %d ignored (received twice), xrefs: 00007FF61DD8C0E7
recv, xrefs: 00007FF61DD8C2EB
Count %d, Last pkt %d , xrefs: 00007FF61DD8C346
ignore unknown opcode %d received, xrefs: 00007FF61DD8C143

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons$Thread$ErrorFileLast$CurrentPrioritySleep$Pointer$CreateLocalMutexObjectReadReleaseSingleTimeWait_set_error_moderecvsend
String ID: Ack block %d ignored (received twice)$Ack of block #%d received (last block sent #%d !)$C:\Users\ark\source\repos\tftpd64\src\_services\tftpd_thread.c$Count %d, Last pkt %d $File <%s> : error %d in system call %s %s$MAX RETRIES while waiting for Ack block %d. file <%s>$Peer returns ERROR <%s> -> aborting transfer$ReadFile$TIMEOUT waiting for Ack block #%d $WARNING : Last block #%d not acked for file <%s>$fseek$ignore unknown opcode %d received$pTftp!=NULL$rcvd packet too short$recv$send$timeout while waiting for ack blk #%d
API String ID: 3042123529-4116792352
Opcode ID: 0e99ebef462774d84a5edec505d667564bd6eaa67181c9656efea8e8bc60042b
Instruction ID: 27bb881bca472618cd8e8830550cbff731591d4582e2c65ad0061f83b3ada29a
Opcode Fuzzy Hash: 0e99ebef462774d84a5edec505d667564bd6eaa67181c9656efea8e8bc60042b
Instruction Fuzzy Hash: 4AE16932E08A4AA7EB159B25E6405B973A0FB05BA5F406236D70EC3A95FF3CF464D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8E68C, Relevance: 56.3, APIs: 28, Strings: 4, Instructions: 281windowstringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00007FF61DD8E6E7
GetDC.USER32 ref: 00007FF61DD8E6FC
GetTextExtentPoint32A.GDI32 ref: 00007FF61DD8E72E
ReleaseDC.USER32 ref: 00007FF61DD8E771
GetParent.USER32 ref: 00007FF61DD8E77A
GetDesktopWindow.USER32 ref: 00007FF61DD8E78F
GetWindowRect.USER32 ref: 00007FF61DD8E7A0
GetWindowLongPtrA.USER32 ref: 00007FF61DD8E7AE
CreateWindowExA.USER32 ref: 00007FF61DD8E7FC
GetSystemMetrics.USER32 ref: 00007FF61DD8E80E
GetSystemMetrics.USER32 ref: 00007FF61DD8E81C
GetSystemMetrics.USER32 ref: 00007FF61DD8E82A
GetWindowLongPtrA.USER32 ref: 00007FF61DD8E8BB
CreateWindowExA.USER32 ref: 00007FF61DD8E943
SetFocus.USER32 ref: 00007FF61DD8E9A9
SetWindowPos.USER32 ref: 00007FF61DD8EA05
SetWindowTextA.USER32 ref: 00007FF61DD8EA12
SetWindowTextA.USER32 ref: 00007FF61DD8EA1F
LoadIconA.USER32 ref: 00007FF61DD8EA3E
GetParent.USER32 ref: 00007FF61DD8EA4A
SendMessageA.USER32 ref: 00007FF61DD8EA5F
GetParent.USER32 ref: 00007FF61DD8EA6D
SendMessageA.USER32 ref: 00007FF61DD8EA7F
GetParent.USER32 ref: 00007FF61DD8EA8D
GetClassLongPtrA.USER32 ref: 00007FF61DD8EA9B
GetParent.USER32 ref: 00007FF61DD8EAA9
GetClassLongPtrA.USER32 ref: 00007FF61DD8EAB7
SendMessageA.USER32 ref: 00007FF61DD8EAD0

Strings

2, xrefs: 00007FF61DD8E7F4
<, xrefs: 00007FF61DD8E91E
Edit, xrefs: 00007FF61DD8E7C5
BUTTON, xrefs: 00007FF61DD8E926

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Window$Parent$Long$MessageMetricsSendSystemText$ClassCreate$DesktopExtentFocusIconLoadPoint32RectReleaselstrlen
String ID: 2$<$BUTTON$Edit
API String ID: 145751049-2098600227
Opcode ID: f18c5fef83fd8de4845624d210dcf61f5a52c70b8a23ea201ab077ebe50eb6a5
Instruction ID: 86223b87d7c6d90f89e395cff9a276ee6257b2e0ea779f14583db17bfeb5e9be
Opcode Fuzzy Hash: f18c5fef83fd8de4845624d210dcf61f5a52c70b8a23ea201ab077ebe50eb6a5
Instruction Fuzzy Hash: 21C1C172A08A4987E714CF25E84476A77A4FB89F98F519335DA8E83758EF3CE045CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8C7A0, Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 287networksleepthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF61DD8C7F6
htons.WS2_32 ref: 00007FF61DD8C965
bind.WS2_32 ref: 00007FF61DD8C97E
GetLastError.KERNEL32 ref: 00007FF61DD8C997
GetLastError.KERNEL32 ref: 00007FF61DD8C9AF
connect.WS2_32 ref: 00007FF61DD8C9E6
GetLastError.KERNEL32 ref: 00007FF61DD8C9F0
Sleep.KERNEL32 ref: 00007FF61DD8CA16
getsockname.WS2_32 ref: 00007FF61DD8CA4B
getnameinfo.WS2_32 ref: 00007FF61DD8CA7C
MessageBoxA.USER32 ref: 00007FF61DD8CADA

Part of subcall function 00007FF61DD8C3C0: htons.WS2_32 ref: 00007FF61DD8C408
Part of subcall function 00007FF61DD8C3C0: send.WS2_32 ref: 00007FF61DD8C425
Part of subcall function 00007FF61DD8C3C0: GetLastError.KERNEL32 ref: 00007FF61DD8C438

GetLastError.KERNEL32 ref: 00007FF61DD8C7FE

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

SetThreadPriority.KERNEL32 ref: 00007FF61DD8C830
socket.WS2_32 ref: 00007FF61DD8C8C0
GetLastError.KERNEL32 ref: 00007FF61DD8C8D3
closesocket.WS2_32 ref: 00007FF61DD8CBA0
CloseHandle.KERNEL32 ref: 00007FF61DD8CBBC
GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8CBE5
SetEvent.KERNEL32 ref: 00007FF61DD8CC03
Sleep.KERNEL32 ref: 00007FF61DD8CC0E

Strings

, xrefs: 00007FF61DD8CA60
permanent thread signalled %d (%d), xrefs: 00007FF61DD8C806
Humm, xrefs: 00007FF61DD8CAD1
Error : socket returns %d: <%s>, xrefs: 00007FF61DD8C8E3
worker thread leaving %d, xrefs: 00007FF61DD8CBED
Using local port %s, xrefs: 00007FF61DD8CA92
Error : connect returns %d: <%s>, xrefs: 00007FF61DD8CA00
Tftpd32, xrefs: 00007FF61DD8CACA
return from thread, xrefs: 00007FF61DD8CB1D
Error : bind returns %d: <%s>, xrefs: 00007FF61DD8C9BF
end of transfer %d, xrefs: 00007FF61DD8CB46

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLast$Thread$CurrentSleephtons$CloseDebugEventHandleMessageObjectOutputPrioritySingleStringWaitbindclosesocketconnectgetnameinfogetsocknamesendsocket
String ID: $Error : bind returns %d: <%s>$Error : connect returns %d: <%s>$Error : socket returns %d: <%s>$Humm$Tftpd32$Using local port %s$end of transfer %d$permanent thread signalled %d (%d)$return from thread$worker thread leaving %d
API String ID: 2479419578-264993322
Opcode ID: 01fbed29ec929dc43d14d59e61a777062cd7ca21ad319495f900c797810d7c58
Instruction ID: 59fbbb6d81ef706ce58da832e617ead6fc104483f854c82a90079f4eb2552f9a
Opcode Fuzzy Hash: 01fbed29ec929dc43d14d59e61a777062cd7ca21ad319495f900c797810d7c58
Instruction Fuzzy Hash: 91D17D22E08E4A86E7519F39D40027923A4FB85FB8F156336EA1DD76D4FE3CE8849750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8C3C0, Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 232networkfileCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD8C408
send.WS2_32 ref: 00007FF61DD8C425
GetLastError.KERNEL32 ref: 00007FF61DD8C438

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

recv.WS2_32 ref: 00007FF61DD8C4B6
htons.WS2_32 ref: 00007FF61DD8C4D5
htons.WS2_32 ref: 00007FF61DD8C4E9
htons.WS2_32 ref: 00007FF61DD8C52C
WriteFile.KERNEL32 ref: 00007FF61DD8C567
htons.WS2_32 ref: 00007FF61DD8C5BC
htons.WS2_32 ref: 00007FF61DD8C5CA
send.WS2_32 ref: 00007FF61DD8C5E3

Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
Part of subcall function 00007FF61DD81F60: GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD81FFD
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
Part of subcall function 00007FF61DD81F60: GetLocalTime.KERNEL32 ref: 00007FF61DD82047
Part of subcall function 00007FF61DD81F60: WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD8213A

Part of subcall function 00007FF61DD8ED18: GetLastError.KERNEL32 ref: 00007FF61DD8ED1C
Part of subcall function 00007FF61DD8ED18: FormatMessageA.KERNEL32 ref: 00007FF61DD8ED47
Part of subcall function 00007FF61DD8ED18: lstrcpynA.KERNEL32 ref: 00007FF61DD8ED73
Part of subcall function 00007FF61DD8ED18: LocalFree.KERNEL32 ref: 00007FF61DD8ED7E

GetLastError.KERNEL32 ref: 00007FF61DD8C649

Part of subcall function 00007FF61DD81F60: ReleaseMutex.KERNEL32 ref: 00007FF61DD8216D
Part of subcall function 00007FF61DD81F60: CreateFileA.KERNEL32 ref: 00007FF61DD821DA
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD821EC

Strings

rcvd packet too short, xrefs: 00007FF61DD8C6BF
send, xrefs: 00007FF61DD8C454
C:\Users\ark\source\repos\tftpd64\src\_services\tftpd_thread.c, xrefs: 00007FF61DD8C3E5
MAX RETRIES while waiting for Data block %d. file <%s>, xrefs: 00007FF61DD8C61E
write, xrefs: 00007FF61DD8C665
File <%s> : error %d in system call %s %s, xrefs: 00007FF61DD8C44D, 00007FF61DD8C65E, 00007FF61DD8C701
TIMEOUT while waiting for Data block %d, file <%s>, xrefs: 00007FF61DD8C73C
2, xrefs: 00007FF61DD8C606
Peer sent unexpected message %d, xrefs: 00007FF61DD8C69A
pTftp!=NULL, xrefs: 00007FF61DD8C3EC
WARNING: First block sent by client is #0, should be #1, fixed by Tftpd32, xrefs: 00007FF61DD8C514
timeout while waiting for data blk #%d, xrefs: 00007FF61DD8C5A0
recv, xrefs: 00007FF61DD8C708

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Threadhtons$CurrentErrorLastPrioritySleep$FileLocalsend$CreateFormatFreeMessageMutexObjectReleaseSingleTimeWaitWrite_set_error_modelstrcpynrecv
String ID: 2$C:\Users\ark\source\repos\tftpd64\src\_services\tftpd_thread.c$File <%s> : error %d in system call %s %s$MAX RETRIES while waiting for Data block %d. file <%s>$Peer sent unexpected message %d$TIMEOUT while waiting for Data block %d, file <%s>$WARNING: First block sent by client is #0, should be #1, fixed by Tftpd32$pTftp!=NULL$rcvd packet too short$recv$send$timeout while waiting for data blk #%d$write
API String ID: 1815284848-1207958474
Opcode ID: 96e91efb5cfb5d34b77ff01a9b0750aa495e95a072aa68b76012d31dc7e9fc3e
Instruction ID: b859a63f1076e658eb81ce6c79da0edf7ef4e63f6a1c3a56d252a55fac6be896
Opcode Fuzzy Hash: 96e91efb5cfb5d34b77ff01a9b0750aa495e95a072aa68b76012d31dc7e9fc3e
Instruction Fuzzy Hash: 84B17E72E08E4A86EB159F39E4011B933A1EF45FA9F446236DA0EC6699FF3CE544D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD888B0, Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 197networkCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD88963
getaddrinfo.WS2_32 ref: 00007FF61DD8898F
GetLastError.KERNEL32 ref: 00007FF61DD889A1
socket.WS2_32 ref: 00007FF61DD889D3
setsockopt.WS2_32 ref: 00007FF61DD88A09
setsockopt.WS2_32 ref: 00007FF61DD88A54
bind.WS2_32 ref: 00007FF61DD88A6A
GetLastError.KERNEL32 ref: 00007FF61DD88AA6
getnameinfo.WS2_32 ref: 00007FF61DD88ADB
SetLastError.KERNEL32 ref: 00007FF61DD88AE3
GetLastError.KERNEL32 ref: 00007FF61DD88AE9
GetLastError.KERNEL32 ref: 00007FF61DD88B08
GetLastError.KERNEL32 ref: 00007FF61DD88B29
GetLastError.KERNEL32 ref: 00007FF61DD88B5C
closesocket.WS2_32 ref: 00007FF61DD88B79
freeaddrinfo.WS2_32 ref: 00007FF61DD88B98

Strings

Bind error %d%s, xrefs: 00007FF61DD88B11
bind port to %s port %s failed, xrefs: 00007FF61DD88B87
Error %d%sTftpd32 can not bind the %s portan application is already listening on this port, xrefs: 00007FF61DD88B65
setsockopt error, xrefs: 00007FF61DD88A21
, xrefs: 00007FF61DD88AC3
Error %d%sTftpd32 tried to bind the %s portto the interface %swhich is not available for this hostEither remove the %s service or suppress %s interface assignation, xrefs: 00007FF61DD88B34
Port %d may be reused, xrefs: 00007FF61DD88A14
Error : Can't create socketError %d (%s), xrefs: 00007FF61DD889AA
unknown, xrefs: 00007FF61DD88A7C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLast$setsockopt$bindclosesocketfreeaddrinfogetaddrinfogetnameinfosocketwsprintf
String ID: $Bind error %d%s$Error %d%sTftpd32 can not bind the %s portan application is already listening on this port$Error %d%sTftpd32 tried to bind the %s portto the interface %swhich is not available for this hostEither remove the %s service or suppress %s interface assignation$Error : Can't create socketError %d (%s)$Port %d may be reused$bind port to %s port %s failed$setsockopt error$unknown
API String ID: 2263015294-3648659133
Opcode ID: f1c4cf5baf44ea731864f1551234da284f699cd666fbce6840b22aff328bad8a
Instruction ID: 9943aec31c2f080a4f5d37c3d247617c69e5936bb7e65156e95090ac519f57f3
Opcode Fuzzy Hash: f1c4cf5baf44ea731864f1551234da284f699cd666fbce6840b22aff328bad8a
Instruction Fuzzy Hash: 0191CD22E08E4A86E711DB65E4452AD77A0FB8AFB8F505335DA1D936E4EF3CE449C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD84A10, Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 133networkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF61DD84A44
WSAGetLastError.WS2_32 ref: 00007FF61DD84A53
setsockopt.WS2_32 ref: 00007FF61DD84A79
getservbyname.WS2_32 ref: 00007FF61DD84A8D
bind.WS2_32 ref: 00007FF61DD84AB9
setsockopt.WS2_32 ref: 00007FF61DD84AE3
htonl.WS2_32 ref: 00007FF61DD84AFC
sendto.WS2_32 ref: 00007FF61DD84B1E
GetCurrentThreadId.KERNEL32 ref: 00007FF61DD84B26
GetLastError.KERNEL32 ref: 00007FF61DD84B50
htonl.WS2_32 ref: 00007FF61DD84B78
htonl.WS2_32 ref: 00007FF61DD84B89
getservbyname.WS2_32 ref: 00007FF61DD84BA3
sendto.WS2_32 ref: 00007FF61DD84BDC
closesocket.WS2_32 ref: 00007FF61DD84BEC

Strings

sendto error %d: %s, xrefs: 00007FF61DD84B59
Thread 0x%X: send %d bytes, xrefs: 00007FF61DD84B2F
bootps, xrefs: 00007FF61DD84A86, 00007FF61DD84B9C
udp, xrefs: 00007FF61DD84A7F, 00007FF61DD84B95

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htonl$ErrorLastgetservbynamesendtosetsockopt$CurrentThreadbindclosesocketsocket
String ID: Thread 0x%X: send %d bytes$bootps$sendto error %d: %s$udp
API String ID: 299956617-405404397
Opcode ID: d80af17b99361d9fac73d831c209ce95b669a5ac8ec5f5233bf03a91765f61ea
Instruction ID: c0cd7d19c9539714eceb7b11911c653ebe59b3f90caf43b62310a408a5c0ebb5
Opcode Fuzzy Hash: d80af17b99361d9fac73d831c209ce95b669a5ac8ec5f5233bf03a91765f61ea
Instruction Fuzzy Hash: 21519161E08A4A86E7109F25A8046793761AF46FB9F149335DA5D87BE0EF3CE489C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9B0EC, Relevance: 40.4, APIs: 20, Strings: 2, Instructions: 1863COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF61DD9BE0D
memcpy_s.LIBCPMT ref: 00007FF61DD9BE9D
memcpy_s.LIBCPMT ref: 00007FF61DD9C595
memcpy_s.LIBCPMT ref: 00007FF61DD9C5DC
memcpy_s.LIBCPMT ref: 00007FF61DD9C810
memcpy_s.LIBCPMT ref: 00007FF61DD9C879
memcpy_s.LIBCPMT ref: 00007FF61DD9C8B4
memcpy_s.LIBCPMT ref: 00007FF61DD9C95C
memcpy_s.LIBCPMT ref: 00007FF61DD9CB70
memcpy_s.LIBCPMT ref: 00007FF61DD9C04F

Part of subcall function 00007FF61DD9E058: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9E08A

memcpy_s.LIBCPMT ref: 00007FF61DD9C225
memcpy_s.LIBCPMT ref: 00007FF61DD9C313
memcpy_s.LIBCPMT ref: 00007FF61DD9C349
memcpy_s.LIBCPMT ref: 00007FF61DD9C3DE
memcpy_s.LIBCPMT ref: 00007FF61DD9C4EF
memcpy_s.LIBCPMT ref: 00007FF61DD9CD3F

Strings

%d/%d/%d/%d:%d:%d, xrefs: 00007FF61DD9B0F2
, xrefs: 00007FF61DD9CB82

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $%d/%d/%d/%d:%d:%d
API String ID: 2880407647-2211377134
Opcode ID: d4e7b6b5b735c23bfe89580a36dce14d4fe99950e75709a70411d4a303f26263
Instruction ID: a386050ede6b161263da9a50e7f2d05fea3800a79896aa462312e09d33d2db62
Opcode Fuzzy Hash: d4e7b6b5b735c23bfe89580a36dce14d4fe99950e75709a70411d4a303f26263
Instruction Fuzzy Hash: EA030972E089D68BD779CE29D4507F93795F788B9CF411235DA0AD7B88EF3AA9008740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8A200, Relevance: 35.4, APIs: 10, Strings: 10, Instructions: 371sleepthreadnetworkCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF61DD8A287
getnameinfo.WS2_32 ref: 00007FF61DD8A2B6
recvfrom.WS2_32 ref: 00007FF61DD8A475
WSAGetLastError.WS2_32 ref: 00007FF61DD8A48A
getnameinfo.WS2_32 ref: 00007FF61DD8A514
getnameinfo.WS2_32 ref: 00007FF61DD8A6A5
Sleep.KERNEL32 ref: 00007FF61DD8A6C9
getnameinfo.WS2_32 ref: 00007FF61DD8A77E
CreateThread.KERNEL32 ref: 00007FF61DD8A82F
SetEvent.KERNEL32 ref: 00007FF61DD8A889

Strings

, xrefs: 00007FF61DD8A766
Error : RecvFrom returns %d: <%s>, xrefs: 00007FF61DD8A493
max number of threads reached, connection from %s dropped, xrefs: 00007FF61DD8A2C5
thread %d started, xrefs: 00007FF61DD8A85B
waking up thread %d for transfer %d, xrefs: 00007FF61DD8A872
Warning : Unaccepted request received from %s, xrefs: 00007FF61DD8A595
Transfert #%d, xrefs: 00007FF61DD8A416
Connection received from %s on port %s, xrefs: 00007FF61DD8A7F9
Warning : received duplicated request from %s:%s, xrefs: 00007FF61DD8A6B8
Thread %d transfer %d started (records %p/%p), xrefs: 00007FF61DD8A83C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: getnameinfo$recvfrom$CreateErrorEventLastSleepThread
String ID: $Connection received from %s on port %s$Error : RecvFrom returns %d: <%s>$Thread %d transfer %d started (records %p/%p)$Transfert #%d$Warning : Unaccepted request received from %s$Warning : received duplicated request from %s:%s$max number of threads reached, connection from %s dropped$thread %d started$waking up thread %d for transfer %d
API String ID: 432015200-3195956678
Opcode ID: c30b097326c5a4a4ecb6e6027a23bc4730ee71cb7378e90900deabe0e0195d47
Instruction ID: 4c1a543cc08efdb8083418f8230e0717f37f01b2bbfc9951d859ae3f1c524d62
Opcode Fuzzy Hash: c30b097326c5a4a4ecb6e6027a23bc4730ee71cb7378e90900deabe0e0195d47
Instruction Fuzzy Hash: 05129E62E08F8A86EB219F60E4402A933A4FB44F68F446339DA4D87695FF3CE594D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAB200, Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF61DDAB249
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAB854
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDABA17
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDABC1E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDABEE2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAC0DD
memcpy_s.LIBCPMT ref: 00007FF61DDAC1CB
memcpy_s.LIBCPMT ref: 00007FF61DDAC276
memcpy_s.LIBCPMT ref: 00007FF61DDAC33F

Strings

1#INF, xrefs: 00007FF61DDAC413
1#QNAN, xrefs: 00007FF61DDAC3F7
1#IND, xrefs: 00007FF61DDAC3E5
1#SNAN, xrefs: 00007FF61DDAC3EE

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: dbdff64b9079932f741b5d8b1cf7d24d1aba2bb1ac5bb67ed602905bc7c4067c
Instruction ID: 20fa86b6b6207ccd1e9be1246b5d0af6beb1178ce879282cc565f6f8239f1022
Opcode Fuzzy Hash: dbdff64b9079932f741b5d8b1cf7d24d1aba2bb1ac5bb67ed602905bc7c4067c
Instruction Fuzzy Hash: AFB21972E089968AE7758E79C4407FD37A0FB44B98F519735DA0A97B94EF38E901CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD885F0, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 150networksleeptimeCOMMON

Download Yara Rule

APIs

gethostname.WS2_32 ref: 00007FF61DD88626
gethostbyname.WS2_32 ref: 00007FF61DD88638
recvfrom.WS2_32 ref: 00007FF61DD886C7
GetLastError.KERNEL32 ref: 00007FF61DD886D1
Sleep.KERNEL32 ref: 00007FF61DD886EA
GetSystemTime.KERNEL32 ref: 00007FF61DD88730
htonl.WS2_32 ref: 00007FF61DD8879F
htonl.WS2_32 ref: 00007FF61DD887C3
sendto.WS2_32 ref: 00007FF61DD88826
GetLastError.KERNEL32 ref: 00007FF61DD8883D

Strings

erreur %d during socket operation, xrefs: 00007FF61DD886D9
End of Sntp thread, xrefs: 00007FF61DD8887F
SNTPD: sendto error %d: %s, xrefs: 00007FF61DD88846

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLasthtonl$SleepSystemTimegethostbynamegethostnamerecvfromsendto
String ID: End of Sntp thread$SNTPD: sendto error %d: %s$erreur %d during socket operation
API String ID: 1892856538-762114845
Opcode ID: 70c703632fa71cbc3c47ba74c25216891abd3fc93456672e926a51b27f714f92
Instruction ID: 8df03fa33e0a04cfac18908bb46c7ff6cf4a728877b29e194ef4fbb72b24994d
Opcode Fuzzy Hash: 70c703632fa71cbc3c47ba74c25216891abd3fc93456672e926a51b27f714f92
Instruction Fuzzy Hash: D4716131E08E898AE7118F28F8512B977A0FF45B68F445339DA4D976A5EF3CE195CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD90450, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 94networkCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD904AE
getaddrinfo.WS2_32 ref: 00007FF61DD904C2
socket.WS2_32 ref: 00007FF61DD904D6
setsockopt.WS2_32 ref: 00007FF61DD90503
bind.WS2_32 ref: 00007FF61DD90533
freeaddrinfo.WS2_32 ref: 00007FF61DD9053F
GetLastError.KERNEL32 ref: 00007FF61DD90545
closesocket.WS2_32 ref: 00007FF61DD90597

Strings

UdpSend bind returns %d (error %d), xrefs: 00007FF61DD9054D
sendto returns %d, xrefs: 00007FF61DD90586
UdpSend: Port %d may be reused, xrefs: 00007FF61DD90509
setsockopt error, xrefs: 00007FF61DD90512

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLastbindclosesocketfreeaddrinfogetaddrinfosetsockoptsocketwsprintf
String ID: UdpSend bind returns %d (error %d)$UdpSend: Port %d may be reused$sendto returns %d$setsockopt error
API String ID: 3714774335-4139470167
Opcode ID: fd7eb1bbe38ee85f95315ce82acb6309e169bc777c6e91e43d4a698f87af9519
Instruction ID: 70f476c8d32de181e70de98df1d261f24543cad169a20694d259ef12004759cb
Opcode Fuzzy Hash: fd7eb1bbe38ee85f95315ce82acb6309e169bc777c6e91e43d4a698f87af9519
Instruction Fuzzy Hash: 53414F62F08A598AE7109F75E8506AC27B1AB49FA8F508335DD1E87B94EE3CD449C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9EB00, Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 332COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DDA6180: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA61A6

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9EFEA

Part of subcall function 00007FF61DDA6100: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA6129

GetModuleHandleExW.KERNEL32 ref: 00007FF61DD9EBAA
GetModuleFileNameW.KERNEL32 ref: 00007FF61DD9EBCC

Part of subcall function 00007FF61DDA61E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA6216

Strings

File: , xrefs: 00007FF61DD9EC88
<program name unknown>, xrefs: 00007FF61DD9EBD6
Program: , xrefs: 00007FF61DD9EB6B
Expression: , xrefs: 00007FF61DD9EE45
..., xrefs: 00007FF61DD9EC45, 00007FF61DD9ED33, 00007FF61DD9ED82, 00007FF61DD9EEA5, 00007FF61DD9EF5D, 00007FF61DD9EF8A
(Press Retry to debug the application - JIT must be enabled), xrefs: 00007FF61DD9EF0D
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 00007FF61DD9EED9
Line: , xrefs: 00007FF61DD9EDD3
Assertion failed!, xrefs: 00007FF61DD9EB31

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo$Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program:
API String ID: 3031022502-1508414584
Opcode ID: de05f39f635cd0b65964fd2980abb88fc8af06393cee3de2339ddfa81edca481
Instruction ID: 4fff9f2517018cdf1c81e0c117bb97d2a92e378b7a3735fec399124a57d38f1f
Opcode Fuzzy Hash: de05f39f635cd0b65964fd2980abb88fc8af06393cee3de2339ddfa81edca481
Instruction Fuzzy Hash: 9FC1C461F09E4B80FA58AF6299146FA9254AF55FE4F418632DD0ED27EAFE3DE405C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8F80C, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 70filestringtimeCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32 ref: 00007FF61DD8F853
lstrcatA.KERNEL32 ref: 00007FF61DD8F867
FindFirstFileA.KERNEL32 ref: 00007FF61DD8F879
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF61DD8F8A1
FileTimeToSystemTime.KERNEL32 ref: 00007FF61DD8F8B1
GetDateFormatA.KERNEL32 ref: 00007FF61DD8F8DC
wsprintfA.USER32 ref: 00007FF61DD8F90F
FindNextFileA.KERNEL32 ref: 00007FF61DD8F928
FindClose.KERNEL32 ref: 00007FF61DD8F939

Strings

\*.*, xrefs: 00007FF61DD8F859
%s%s%u, xrefs: 00007FF61DD8F8F6

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: File$Time$Find$CloseDateFirstFormatLocalNextSystemlstrcatlstrcpynwsprintf
String ID: %s%s%u$\*.*
API String ID: 564219435-1614761745
Opcode ID: 0385a1ec300b7975a5ffca78e87ae0221223f768be0acaa7512209fbd9a01242
Instruction ID: 2a066c0e862d5a84b3fb8f46d5dd1fc119f07f6cf0118d76ed38a19bfe6963df
Opcode Fuzzy Hash: 0385a1ec300b7975a5ffca78e87ae0221223f768be0acaa7512209fbd9a01242
Instruction Fuzzy Hash: B7315432A08ECA95EB218F34E8447E97360FB45BA8F405335DA5D87698EF7CD649C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA53A0, Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 329timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF61DDA53DB

Part of subcall function 00007FF61DDA4B4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA4B60

_get_daylight.LIBCMT ref: 00007FF61DDA53CA

Part of subcall function 00007FF61DDA4BAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA4BC0

_get_daylight.LIBCMT ref: 00007FF61DDA55CB
_get_daylight.LIBCMT ref: 00007FF61DDA55DC
_get_daylight.LIBCMT ref: 00007FF61DDA55ED
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF61DDA5821), ref: 00007FF61DDA5614

Strings

?, xrefs: 00007FF61DDA56E6

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID: ?
API String ID: 435049134-1684325040
Opcode ID: bc73b998a468b2aba87aab0478bea212433230b82ec23ec09290a59c2b04f884
Instruction ID: 1a37c81370c9871cd97d5db58386a8bb31a9fdc172b1189f44eae78c8afa3c0a
Opcode Fuzzy Hash: bc73b998a468b2aba87aab0478bea212433230b82ec23ec09290a59c2b04f884
Instruction Fuzzy Hash: CCD18422E08A4A8AEB509F35D4402B97B95FB44FB4F949335EA4EC76A5EF3CF4418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8DE20, Relevance: 12.1, APIs: 8, Instructions: 95networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF61DD8DE76
wsprintfA.USER32 ref: 00007FF61DD8DEA4
getaddrinfo.WS2_32 ref: 00007FF61DD8DEB8
socket.WS2_32 ref: 00007FF61DD8DEE4
bind.WS2_32 ref: 00007FF61DD8DF02
listen.WS2_32 ref: 00007FF61DD8DF1B
htons.WS2_32 ref: 00007FF61DD8DF50
freeaddrinfo.WS2_32 ref: 00007FF61DD8DF5D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: getaddrinfo$bindfreeaddrinfohtonslistensocketwsprintf
String ID:
API String ID: 4202540692-0
Opcode ID: 0981a251dcf5fb7a434584e914e48d6bbef2c15f01b8a2dd4ebad8b3cbf72181
Instruction ID: ce1becd602373bfc1933dec1d896818e80d037145fa42a0e0f3796e2b9c97481
Opcode Fuzzy Hash: 0981a251dcf5fb7a434584e914e48d6bbef2c15f01b8a2dd4ebad8b3cbf72181
Instruction Fuzzy Hash: F1415D72E04A4A89E7118BB5D8442AC33B1BB45FB8F149335DE2E966D4EF38A444D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9E4B4, Relevance: 9.2, APIs: 6, Instructions: 245COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9E4D6
_get_daylight.LIBCMT ref: 00007FF61DD9E532
_get_daylight.LIBCMT ref: 00007FF61DD9E543
_get_daylight.LIBCMT ref: 00007FF61DD9E554
_isindst.LIBCMT ref: 00007FF61DD9E5A5
_isindst.LIBCMT ref: 00007FF61DD9E5F8

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 351c459857be33ea068bbbb1494632df6d08fcf718ddfd7d83a9e1cc1e23ce2f
Instruction ID: 054a1604fd6de10fbda4a30b518da667b6480665249377cfb9eeeb08e0de09ea
Opcode Fuzzy Hash: 351c459857be33ea068bbbb1494632df6d08fcf718ddfd7d83a9e1cc1e23ce2f
Instruction Fuzzy Hash: A091D7B2F05A4A8BEB588F65C9513B86795EB54F98F448235EA0DCB789FF3DE4408700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA19B8, Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF61DDA1A31
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF61DDA1A49
RtlVirtualUnwind.KERNEL32 ref: 00007FF61DDA1A84
IsDebuggerPresent.KERNEL32 ref: 00007FF61DDA1ABD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF61DDA1AC7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF61DDA1AD2

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f53299b4997bac391509a7597e1b126c21cff379310d57e246afe53c960929d1
Instruction ID: 3d415a93b924d1774277ba5bf9347aeb77158d1c0e451d4ad0deacbd4dd317e6
Opcode Fuzzy Hash: f53299b4997bac391509a7597e1b126c21cff379310d57e246afe53c960929d1
Instruction Fuzzy Hash: 6C316436A04F8585D764CF35E8402AE73A4FB85BA8F544335EA9D83B98EF38D155CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA55A8, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF61DDA55CB

Part of subcall function 00007FF61DDA4BAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA4BC0

_get_daylight.LIBCMT ref: 00007FF61DDA55DC

Part of subcall function 00007FF61DDA4B4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA4B60

_get_daylight.LIBCMT ref: 00007FF61DDA55ED

Part of subcall function 00007FF61DDA4B7C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA4B90

Part of subcall function 00007FF61DDA1D84: HeapFree.KERNEL32(?,?,?,00007FF61DDA9798,?,?,?,00007FF61DDA97DB,?,?,?,00007FF61DDA9CA0,?,?,?,00007FF61DDA9BD3), ref: 00007FF61DDA1D9A
Part of subcall function 00007FF61DDA1D84: GetLastError.KERNEL32(?,?,?,00007FF61DDA9798,?,?,?,00007FF61DDA97DB,?,?,?,00007FF61DDA9CA0,?,?,?,00007FF61DDA9BD3), ref: 00007FF61DDA1DAC

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF61DDA5821), ref: 00007FF61DDA5614

Strings

?, xrefs: 00007FF61DDA56E6

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 3458911817-1684325040
Opcode ID: 3ed54b7a0ad21a9cc3cd6283ebe8b06c05cff8a10e935103b6ed8c0b8de3d61d
Instruction ID: d2e601076356676f1dc8863aa09318fcf73ea39e455aed515047bbbb4b1b3248
Opcode Fuzzy Hash: 3ed54b7a0ad21a9cc3cd6283ebe8b06c05cff8a10e935103b6ed8c0b8de3d61d
Instruction Fuzzy Hash: 6B614F32D18A5A86E760DF21E8405A977A4FB48BA4F948336EA4DC76A5EF3CF441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAA27C, Relevance: 7.8, APIs: 5, Instructions: 325fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF61DDAA2EB
WriteFile.KERNEL32 ref: 00007FF61DDAA59A
WriteFile.KERNEL32 ref: 00007FF61DDAA5EC
GetLastError.KERNEL32 ref: 00007FF61DDAA733
GetLastError.KERNEL32 ref: 00007FF61DDAA745

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 0f3b1c07fd0547d85254a5ffe24d06f40ae6d3166f51d655e15f3f5e087e9449
Instruction ID: 78f9b8c125b1a0ae503aa95918ab9e1df61991483ddccb02f58b2a8bc9ba9ba9
Opcode Fuzzy Hash: 0f3b1c07fd0547d85254a5ffe24d06f40ae6d3166f51d655e15f3f5e087e9449
Instruction Fuzzy Hash: 8EE1E262F08E858AE711CF64D4402EE77B1FB44BA8B549335CA4D87BA9EE38D016C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD846B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF61DD84719
SendARP.IPHLPAPI ref: 00007FF61DD8474F

Part of subcall function 00007FF61DD82EF0: inet_addr.WS2_32 ref: 00007FF61DD82F34
Part of subcall function 00007FF61DD82EF0: gethostname.WS2_32 ref: 00007FF61DD82F8B
Part of subcall function 00007FF61DD82EF0: gethostbyname.WS2_32 ref: 00007FF61DD82F9F
Part of subcall function 00007FF61DD82EF0: GetIpNetTable.IPHLPAPI ref: 00007FF61DD8300F
Part of subcall function 00007FF61DD82EF0: GetIpNetTable.IPHLPAPI ref: 00007FF61DD83039

inet_ntoa.WS2_32 ref: 00007FF61DD84791

Part of subcall function 00007FF61DD866C0: lstrcpyA.KERNEL32 ref: 00007FF61DD867CE
Part of subcall function 00007FF61DD866C0: lstrcpyA.KERNEL32 ref: 00007FF61DD86803
Part of subcall function 00007FF61DD866C0: lstrcpyA.KERNEL32 ref: 00007FF61DD86874

Strings

Added lease for existing address %s, xrefs: 00007FF61DD84797

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$Table$Sendgethostbynamegethostnameinet_addrinet_ntoarecvfrom
String ID: Added lease for existing address %s
API String ID: 270021040-73727089
Opcode ID: 56a1f0f41698e2b6caae5c19b142efb11df9dc71f1d8553786be90375fdbc8ee
Instruction ID: e21d51b53bb41ffbc6b55ee05aeebd4937753ffc7de02fed4e0bac7eaa0f4cb5
Opcode Fuzzy Hash: 56a1f0f41698e2b6caae5c19b142efb11df9dc71f1d8553786be90375fdbc8ee
Instruction Fuzzy Hash: A1314131E19F8A85EB51DB10E8407AA73A1FB96F64F406239E64D43695EF7CE444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8ED18, Relevance: 6.0, APIs: 4, Instructions: 30stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF61DD8ED1C
FormatMessageA.KERNEL32 ref: 00007FF61DD8ED47
lstrcpynA.KERNEL32 ref: 00007FF61DD8ED73
LocalFree.KERNEL32 ref: 00007FF61DD8ED7E

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessagelstrcpyn
String ID:
API String ID: 2452728953-0
Opcode ID: c75bcb14c7b88114fea77ece60e4e0a999cbd421e4e360be8e95220d9f13f4c0
Instruction ID: 0bd7235793ddb9dd0c87d8e5eb54c86907bfa1dc719d6739b6333d40b6595075
Opcode Fuzzy Hash: c75bcb14c7b88114fea77ece60e4e0a999cbd421e4e360be8e95220d9f13f4c0
Instruction Fuzzy Hash: E4018F21E18E0A82F7009BA1E88436A3760FB85FA9F504339D54D827A8EF7CD108C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9CF20, Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF61DD9CF86
memcpy_s.LIBCPMT ref: 00007FF61DD9CFB1

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 25d6ef64154c71e97d3c907b8c0542e140336511937ffae7f2708c7683102caa
Instruction ID: 9c35ff9bbfbf4d8f2dcd791ec90880963bf0adc165f2f851ea91f74b343bc108
Opcode Fuzzy Hash: 25d6ef64154c71e97d3c907b8c0542e140336511937ffae7f2708c7683102caa
Instruction Fuzzy Hash: EDC1E772F1968A87E728CF19E154A69B791F794B94F448235DB4E83744EF3EE801C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9E150, Relevance: 4.8, APIs: 3, Instructions: 252COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9E18F
_get_daylight.LIBCMT ref: 00007FF61DD9E402
_get_daylight.LIBCMT ref: 00007FF61DD9E413

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: d28d89bca5ec8f80273649ea5111998d2820f4fdc98992b50a5d4e89dbfc96a9
Instruction ID: a6cce431e7ac2af0ef277964b04bc8c02bcc18bf3032f61a011b6eda373ab1cf
Opcode Fuzzy Hash: d28d89bca5ec8f80273649ea5111998d2820f4fdc98992b50a5d4e89dbfc96a9
Instruction Fuzzy Hash: 13917F62F06E2A86FF1CCAA4D5606BC62A4AF55F68F044735DE0ED66D5FF2EE5018300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA396C, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA39D0

Strings

gfffffff, xrefs: 00007FF61DDA3C6D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: a49586a0d896ee7d429223d03e553d5eb7c9dfc20e69b5a083ea7503c1e3187d
Instruction ID: 85fdf4a56a31f2c2cbeca21f48c3162c515f47ec230e02842d420d6b21bbe9b1
Opcode Fuzzy Hash: a49586a0d896ee7d429223d03e553d5eb7c9dfc20e69b5a083ea7503c1e3187d
Instruction Fuzzy Hash: 03912462F09BCA86EB15CB69D4007A96796AB54FE0F05C232CA4D873A1FE7DE506C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA7E6C, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA7E9C

Part of subcall function 00007FF61DDA1BEC: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF61DDA1BC9), ref: 00007FF61DDA1BF5
Part of subcall function 00007FF61DDA1BEC: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF61DDA1BC9), ref: 00007FF61DDA1C1A

Strings

*?, xrefs: 00007FF61DDA7EC3

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?
API String ID: 4036615347-2564092906
Opcode ID: 84fb8b90cf0a4f2c7072f1df2422b36c08b4ab2b4c01596c4a98f0508ddb2c28
Instruction ID: 5c528e42a1a982f7aef3b5eafac2f907d6c2f0062c8d275e15fef069c3243646
Opcode Fuzzy Hash: 84fb8b90cf0a4f2c7072f1df2422b36c08b4ab2b4c01596c4a98f0508ddb2c28
Instruction Fuzzy Hash: 4351F162F14F9A95EF10CBA698014B967A1FB48FE8B458631EE1E87B95FF3CD4418310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDB0688, Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF61DDB08D7
RaiseException.KERNEL32 ref: 00007FF61DDB08E8

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: fc229cfffd7c9502cc055cfe495bf0d79ef17ba3abc1df723886e5e33cc1d9a7
Instruction ID: 8812d36fb34abe26f54e2a95536306c79850c4a186c0508cfd77fe531525606e
Opcode Fuzzy Hash: fc229cfffd7c9502cc055cfe495bf0d79ef17ba3abc1df723886e5e33cc1d9a7
Instruction Fuzzy Hash: 1DB13977A00B998BEB15CF29C48226877A0F786F98F18CA25DA5D877A4DF39D451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAD018, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF61DDAD07C

Part of subcall function 00007FF61DDA0DC4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA0DD8

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 173ffc0fdbb817a0ebc568ee26d2f17adc6a627284657c8817f1b871f208bdb6
Instruction ID: 31e52b2062dcb0870c5547c32b532ed9b5872d9b96d8c6968888839ee17e361b
Opcode Fuzzy Hash: 173ffc0fdbb817a0ebc568ee26d2f17adc6a627284657c8817f1b871f208bdb6
Instruction Fuzzy Hash: 5571E422F08A9A87FB344A6D9440A796391AB80B70F14C735DA6EC76F5FE3DE841C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA8078, Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5090e572eb044f76d92cb2a9fc69c516b4897d7907a9bfef800e40b502d2483
Instruction ID: bc345e677b97c9dd5e6e45800ca076b8b0c7148b06848042e134808c822a3d78
Opcode Fuzzy Hash: b5090e572eb044f76d92cb2a9fc69c516b4897d7907a9bfef800e40b502d2483
Instruction Fuzzy Hash: D251C222F08B9599F7208B72A9015AE7BA5BB44BE4F148335EE5D87B95EF3CD141C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD95914, Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF61DD95AE3

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 746f7eb24f727b4eef300390552474dc1cb85980915c1aa0ca15db3de613e0f8
Instruction ID: fa6a7942273666c413c4ef9152b03eecebe261d8d9730c5652022406e95d10d9
Opcode Fuzzy Hash: 746f7eb24f727b4eef300390552474dc1cb85980915c1aa0ca15db3de613e0f8
Instruction Fuzzy Hash: FC71C315E18A0B46FABC9A2940606B922A1EF40F64FC05336DD49936D9EE3FF843C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD95148, Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF61DD952E1

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: b738ffd988268f17dc7c72b05d085da71073f83a510af38d787aaf184fa1460e
Instruction ID: 43b2735afb892f3b770bdfa71053fb1ebea09822f3e2cc101b152e9e16e6f3bd
Opcode Fuzzy Hash: b738ffd988268f17dc7c72b05d085da71073f83a510af38d787aaf184fa1460e
Instruction Fuzzy Hash: 9371E311E0CA4E46FA6C8A2990207BE6791AB42F68FC41335DD49877D9EE2FF843C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD953CC, Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF61DD95565

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 818faa384e9ba73175ee990b501f496c86bc0d3fe0ea9c741a4c8ea92a832f7b
Instruction ID: 37f6e95caeb8bec09ad5c92614d037d3760a4deaab7743359e6fa43c9abb2da8
Opcode Fuzzy Hash: 818faa384e9ba73175ee990b501f496c86bc0d3fe0ea9c741a4c8ea92a832f7b
Instruction Fuzzy Hash: 2C611311E0CA4E86EAEC8A2950203BA17969F41F78FD40331DD4DD769AEE2FF8478701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA9EF0, Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF61DDA9EF4

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 26b32f3d803b06936bed53e795b6283efed1ad399a61523788cd40325f41a35c
Instruction ID: 400f1d98f12749ae056056c97a4508edfcb10fc28c1063391f36492607d179ec
Opcode Fuzzy Hash: 26b32f3d803b06936bed53e795b6283efed1ad399a61523788cd40325f41a35c
Instruction Fuzzy Hash: 6EB09220E17F4AC2EA482B216C8221423A46F48F20FA94278C00C80320FE3C20F55700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8FBB8, Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdbc517c7ba04a632b902b84bc85892e206b92796fb512f0bf12e38e0ce9e19
Instruction ID: 370c0798df63e9e2c8ccbe40bb6010f6a4c553ad6eaa8b19adda75812ac896ac
Opcode Fuzzy Hash: dbdbc517c7ba04a632b902b84bc85892e206b92796fb512f0bf12e38e0ce9e19
Instruction Fuzzy Hash: 552272B7F384204BD31DCB69EC52FA936A2B75434C749A02CEA17D3F44EA3DEA158644

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9ABE0, Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b8e01fa580a535f1fa342b646fa8a054d00d41030700a12481af887a58dd72
Instruction ID: 12b9c4c6badc13b92fa2c6a28c7461f4cb082d598636050086dee02dbed2d911
Opcode Fuzzy Hash: 34b8e01fa580a535f1fa342b646fa8a054d00d41030700a12481af887a58dd72
Instruction Fuzzy Hash: EF912623F18A5A4AFE6D4D2594303BB1680AB50B64F142739EE6EC77D4FD2EE8059701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD95634, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41ecd7c0e3580cdd35124c553102cedd493a216aacff9caa1ed17112d502efdf
Instruction ID: 1aa308dce9ccf19b8161845d45091326f6ff31752984cffab2f854864ed7f3bf
Opcode Fuzzy Hash: 41ecd7c0e3580cdd35124c553102cedd493a216aacff9caa1ed17112d502efdf
Instruction Fuzzy Hash: CC81F625E1CA0B82EB6C9A1990206BD26A1EF40F64FC45335ED4DD7298EE2FF946C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA1118, Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: dacc0909ab386fe0fec21eb24c32389b51e6b926bfebf4da5722741a0edc02ed
Instruction ID: a3f7f82484ebe0361098c8170837410a2ac3a3f8218a654dc15de06be0b08c2a
Opcode Fuzzy Hash: dacc0909ab386fe0fec21eb24c32389b51e6b926bfebf4da5722741a0edc02ed
Instruction Fuzzy Hash: 3941E122B15E5882EF04CF7AD9155A973A5AB48FE4F499236EE0DC7B68EF3CD1418300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9D4D4, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1287ddf3d0120646fed57915a44b4c3f900048cc1bd1d2335878aa888a07ad61
Instruction ID: 9b35f1f23e0840729a2915da728fcac1d9ff7221898398a07fcf61e6d3e57e3b
Opcode Fuzzy Hash: 1287ddf3d0120646fed57915a44b4c3f900048cc1bd1d2335878aa888a07ad61
Instruction Fuzzy Hash: 40319E32E1C98E45F6EDA92D84346791212AF83F38E648331C50D86999FCAFF8459710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDB04D0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb62f3551e6468f4431583b451632a591bf7b0fd7a73ae62d806273d4a681a77
Instruction ID: 76b833072506079f24d0961f0a698b657579ee24eeea6cbb500a86364a99576b
Opcode Fuzzy Hash: fb62f3551e6468f4431583b451632a591bf7b0fd7a73ae62d806273d4a681a77
Instruction Fuzzy Hash: 23F06871B296568AEB988F28A442A2977D0EB18794F50813DE59DC3F14DA3C90508F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD912D8, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71909c89a6ad8ca25ef36df1da1766d3ac7e60f19c570342ef0afd5f2758f118
Instruction ID: e4d60ba99f30697e6c1879430f4628585ca2a1666b6cb3e8bf65b1be312b7e08
Opcode Fuzzy Hash: 71909c89a6ad8ca25ef36df1da1766d3ac7e60f19c570342ef0afd5f2758f118
Instruction Fuzzy Hash: E2A00221D0CC0BD0E7089B60F8614302734FB51B24B508335C04DC24B4BF3DA490C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD87E90, Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 181networkstringsynchronizationCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD87F02
htonl.WS2_32 ref: 00007FF61DD87F11
htons.WS2_32 ref: 00007FF61DD87F1E
htons.WS2_32 ref: 00007FF61DD87F39
htons.WS2_32 ref: 00007FF61DD87F63
htons.WS2_32 ref: 00007FF61DD87F8D
htonl.WS2_32 ref: 00007FF61DD87F9C
htons.WS2_32 ref: 00007FF61DD87FAA
htons.WS2_32 ref: 00007FF61DD87FB9
htons.WS2_32 ref: 00007FF61DD88027
htons.WS2_32 ref: 00007FF61DD88030
htons.WS2_32 ref: 00007FF61DD88044
htonl.WS2_32 ref: 00007FF61DD88053
htons.WS2_32 ref: 00007FF61DD88061
htons.WS2_32 ref: 00007FF61DD88070
htons.WS2_32 ref: 00007FF61DD8808D
lstrcpyA.KERNEL32 ref: 00007FF61DD880B7
inet_ntoa.WS2_32 ref: 00007FF61DD880C3
lstrcpyA.KERNEL32 ref: 00007FF61DD880D4
WaitForSingleObject.KERNEL32 ref: 00007FF61DD880FB
Sleep.KERNEL32 ref: 00007FF61DD88135
ReleaseMutex.KERNEL32 ref: 00007FF61DD8816C

Strings

Rc!=0, xrefs: 00007FF61DD88181
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD88112
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD8810B, 00007FF61DD8817A

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons$htonl$lstrcpy$MutexObjectReleaseSingleSleepWaitinet_ntoa
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 1789357783-2064142993
Opcode ID: 144575c4ebc00023f872dff76e36d358e7b5576266ba7299f6582d2f4c123261
Instruction ID: 044317abab4c9758209508992683835af38b2f29fc8b09a672ed78a1864ca47f
Opcode Fuzzy Hash: 144575c4ebc00023f872dff76e36d358e7b5576266ba7299f6582d2f4c123261
Instruction Fuzzy Hash: 7F915D62D08A899AEB159F71E8043B97360FF05B79F149339CB5A872E0EF7CA494C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8A8E0, Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 236networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 00007FF61DD8A964
CreateThread.KERNEL32 ref: 00007FF61DD8A992
WSACreateEvent.WS2_32 ref: 00007FF61DD8A9F0
WSAEventSelect.WS2_32 ref: 00007FF61DD8AA09
GetLastError.KERNEL32 ref: 00007FF61DD8AA0F
WaitForMultipleObjects.KERNEL32 ref: 00007FF61DD8AA35
CloseHandle.KERNEL32 ref: 00007FF61DD8AC0C
closesocket.WS2_32 ref: 00007FF61DD8ACF8
WSACloseEvent.WS2_32 ref: 00007FF61DD8AD0C

Strings

signalling worker threads, xrefs: 00007FF61DD8AC43
WaitForMultipleObjects error %d, xrefs: 00007FF61DD8ABE3
do NOT signal worker threads, xrefs: 00007FF61DD8AC32
WaitForMultipleObjects error %d, xrefs: 00007FF61DD8ABF5
main TFTP thread ends here, xrefs: 00007FF61DD8AD12
waiting for worker threads, xrefs: 00007FF61DD8AC90
End of thread %d, xrefs: 00007FF61DD8ACC6

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event$Create$Close$ErrorHandleLastMultipleObjectsSelectThreadWaitclosesocket
String ID: End of thread %d$WaitForMultipleObjects error %d$WaitForMultipleObjects error %d$do NOT signal worker threads$main TFTP thread ends here$signalling worker threads$waiting for worker threads
API String ID: 4024205651-4289409385
Opcode ID: 1ec086875e5d5cd074bdf484e5053b9f92d09f0f671a553f5f74fd87dd182f37
Instruction ID: 4d429d7baa5217fadaea3b36d4e634836ae807df442238dc305e59a57522292c
Opcode Fuzzy Hash: 1ec086875e5d5cd074bdf484e5053b9f92d09f0f671a553f5f74fd87dd182f37
Instruction Fuzzy Hash: 95C15621E08E4A86EB119F25E84027923A5AF45FB4F186339DA1ED72E1FF3DF4919701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD897E0, Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 207filestringsynchronizationCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF61DD8985A
CloseHandle.KERNEL32 ref: 00007FF61DD89877
CreateFileA.KERNEL32 ref: 00007FF61DD898AE
SetFilePointer.KERNEL32 ref: 00007FF61DD898C9
recvfrom.WS2_32 ref: 00007FF61DD8992F
getnameinfo.WS2_32 ref: 00007FF61DD899C5
wsprintfA.USER32 ref: 00007FF61DD89A74
lstrlenA.KERNEL32 ref: 00007FF61DD89A81
WriteFile.KERNEL32 ref: 00007FF61DD89AA2
WriteFile.KERNEL32 ref: 00007FF61DD89AC5
lstrcpyA.KERNEL32 ref: 00007FF61DD89AD6
WaitForSingleObject.KERNEL32 ref: 00007FF61DD89AF5
Sleep.KERNEL32 ref: 00007FF61DD89B26
ReleaseMutex.KERNEL32 ref: 00007FF61DD89B5A
CloseHandle.KERNEL32 ref: 00007FF61DD89BB1
CloseHandle.KERNEL32 ref: 00007FF61DD89BCC

Strings

End of Syslog thread, xrefs: 00007FF61DD89BD2
, xrefs: 00007FF61DD8988E
Rc!=0, xrefs: 00007FF61DD89B6F
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD89B0C
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD89B05, 00007FF61DD89B68
\\.\pipe\Tftpd32Syslog, xrefs: 00007FF61DD89838
%24.24s;%s; %s, xrefs: 00007FF61DD89A61

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: File$CloseHandle$CreateWrite$MutexObjectPointerReleaseSingleSleepWaitgetnameinfolstrcpylstrlenrecvfromwsprintf
String ID: $%24.24s;%s; %s$C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$End of Syslog thread$Rc!=0$Rc==WAIT_OBJECT_0$\\.\pipe\Tftpd32Syslog
API String ID: 1243492708-488349565
Opcode ID: d66b8198c070671c3560b4d2c67da1b95d59ef0148ce7dea5419e897bd42703b
Instruction ID: f77b1fdeba34d223ae2f946d9dfab0aefd9392e91efd1ea555d5487193a7b4ec
Opcode Fuzzy Hash: d66b8198c070671c3560b4d2c67da1b95d59ef0148ce7dea5419e897bd42703b
Instruction Fuzzy Hash: A5B16E31E18E8A85E7219F25E8501A937A4FB45FB8F405335D6AD93AE8EF3CE545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD82AB0, Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 271COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF61DD82AF2
htonl.WS2_32 ref: 00007FF61DD82AFA
htonl.WS2_32 ref: 00007FF61DD82B05
inet_addr.WS2_32 ref: 00007FF61DD82B16
htonl.WS2_32 ref: 00007FF61DD82B1E
htonl.WS2_32 ref: 00007FF61DD82B2F
inet_ntoa.WS2_32 ref: 00007FF61DD82C58
inet_ntoa.WS2_32 ref: 00007FF61DD82C8A
inet_ntoa.WS2_32 ref: 00007FF61DD82CC9
inet_addr.WS2_32 ref: 00007FF61DD82D16
htonl.WS2_32 ref: 00007FF61DD82D47
htonl.WS2_32 ref: 00007FF61DD82D7A
htonl.WS2_32 ref: 00007FF61DD82DB0
htonl.WS2_32 ref: 00007FF61DD82DD5
inet_addr.WS2_32 ref: 00007FF61DD82DE4
inet_ntoa.WS2_32 ref: 00007FF61DD82DFE
inet_ntoa.WS2_32 ref: 00007FF61DD82EC4

Strings

Reply with new : %s, xrefs: 00007FF61DD82E04
Reply with previously allocated : %s, xrefs: 00007FF61DD82C90
Request for %s granted, xrefs: 00007FF61DD82C5E
Reply with reuse : %s, xrefs: 00007FF61DD82ECA
Reply with requested address : %s, xrefs: 00007FF61DD82CCF

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htonl$inet_ntoa$inet_addr
String ID: Reply with new : %s$Reply with previously allocated : %s$Reply with requested address : %s$Reply with reuse : %s$Request for %s granted
API String ID: 3772491625-935886887
Opcode ID: cd0ec795384ef2dbd2fd2ea59ca709975b6ee28022ed0269e375d28332e6840e
Instruction ID: dc58de659a3bd27a83a45b1e582ad264d23f5598db60739ba9acd092d64f348c
Opcode Fuzzy Hash: cd0ec795384ef2dbd2fd2ea59ca709975b6ee28022ed0269e375d28332e6840e
Instruction Fuzzy Hash: C9C19C21E09E4A86EA158F65E89067977A5BF44FA4F446339DA4EC73A1FE3CF844D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81F60, Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 170threadsleepfileCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Sleep.KERNEL32 ref: 00007FF61DD81FFD
GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
GetLocalTime.KERNEL32 ref: 00007FF61DD82047
WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Sleep.KERNEL32 ref: 00007FF61DD8213A
ReleaseMutex.KERNEL32 ref: 00007FF61DD8216D
CreateFileA.KERNEL32 ref: 00007FF61DD821DA
Sleep.KERNEL32 ref: 00007FF61DD821EC
SetFilePointer.KERNEL32 ref: 00007FF61DD82207
WriteFile.KERNEL32 ref: 00007FF61DD82228
WriteFile.KERNEL32 ref: 00007FF61DD82248
FlushFileBuffers.KERNEL32 ref: 00007FF61DD82251
CloseHandle.KERNEL32 ref: 00007FF61DD8225A

Strings

[%02d/%02d %02d:%02d:%02d.%03d], xrefs: 00007FF61DD820D0
Rc!=0, xrefs: 00007FF61DD82182
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD82121
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD8211A, 00007FF61DD8217B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Thread$File$CurrentPrioritySleep$Write$BuffersCloseCreateFlushHandleLocalMutexObjectPointerReleaseSingleTimeWait
String ID: [%02d/%02d %02d:%02d:%02d.%03d]$C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 71578472-2359001905
Opcode ID: bd46b4f6900032bfd838eaf67166edcf4c92e6d9b597814e47395be77f8bd3e0
Instruction ID: 6fb8bde4ec90da40357bf65bea5aa1b19353af303e86536391c753fec22e361d
Opcode Fuzzy Hash: bd46b4f6900032bfd838eaf67166edcf4c92e6d9b597814e47395be77f8bd3e0
Instruction Fuzzy Hash: 9D912C31E08E4A86E7209F25F88467977A4FB85FA4F505339DA9D836A4EF3CE545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81B50, Relevance: 35.1, APIs: 9, Strings: 11, Instructions: 128sleepnetworkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF61DD81B73
GetLastError.KERNEL32 ref: 00007FF61DD81B7D

Part of subcall function 00007FF61DD8E51C: GetWindowLongPtrA.USER32 ref: 00007FF61DD8E54C
Part of subcall function 00007FF61DD8E51C: DialogBoxIndirectParamA.USER32 ref: 00007FF61DD8E5B5

GetEnvironmentVariableA.KERNEL32 ref: 00007FF61DD81BF3
GetEnvironmentVariableA.KERNEL32 ref: 00007FF61DD81C31
GetEnvironmentVariableA.KERNEL32 ref: 00007FF61DD81CB9
GetFullPathNameA.KERNEL32 ref: 00007FF61DD81D03
Sleep.KERNEL32 ref: 00007FF61DD81DA5

Strings

Tftpd32 Service Edition is ready, xrefs: 00007FF61DD81D88
SOFTWARE\TFTPD32, xrefs: 00007FF61DD81C63
TFTP_LOG, xrefs: 00007FF61DD81BDE
Still Alive, xrefs: 00007FF61DD81DAB
Error: Tftpd32 now requires winsock version 2, xrefs: 00007FF61DD81B83
Error: Can't init Winsocket, xrefs: 00007FF61DD81B95
TFTP_DIR, xrefs: 00007FF61DD81CAC
Tftpd32, xrefs: 00007FF61DD81B9C
Tftpd32.ini, xrefs: 00007FF61DD81C43
TFTP_INI, xrefs: 00007FF61DD81C2A
Worker threads started, xrefs: 00007FF61DD81D7C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: EnvironmentVariable$DialogErrorFullIndirectLastLongNameParamPathSleepStartupWindow
String ID: Error: Can't init Winsocket$Error: Tftpd32 now requires winsock version 2$SOFTWARE\TFTPD32$Still Alive$TFTP_DIR$TFTP_INI$TFTP_LOG$Tftpd32$Tftpd32 Service Edition is ready$Tftpd32.ini$Worker threads started
API String ID: 4093368745-3352602689
Opcode ID: b22442635d16a19dbb4a77be650ce21e6f50ab0a23bcc0768d9ee66b4f918c23
Instruction ID: 85d182df6fac2e317ce1a6580a85d187fa947b1c1472f05e27e05c8c5d894d25
Opcode Fuzzy Hash: b22442635d16a19dbb4a77be650ce21e6f50ab0a23bcc0768d9ee66b4f918c23
Instruction Fuzzy Hash: D7610A61E08D8B95FB219B20E8943B96760FF45FA8F80533AD64DC26A5FF6CE549C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD87430, Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 296COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8F790: Sleep.KERNEL32(?,?,00000001,00007FF61DD8746B), ref: 00007FF61DD8F7B6
Part of subcall function 00007FF61DD8F790: WaitForSingleObject.KERNEL32(?,?,00000001,00007FF61DD8746B), ref: 00007FF61DD8F7C4
Part of subcall function 00007FF61DD8F790: ReleaseMutex.KERNEL32(?,?,00000001,00007FF61DD8746B), ref: 00007FF61DD8F7F0

Part of subcall function 00007FF61DD8F0F4: lstrcpynA.KERNEL32 ref: 00007FF61DD8F158
Part of subcall function 00007FF61DD8F0F4: GetPrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F17F

inet_addr.WS2_32 ref: 00007FF61DD87680

Part of subcall function 00007FF61DD823F0: lstrlenA.KERNEL32 ref: 00007FF61DD82458
Part of subcall function 00007FF61DD823F0: WaitForSingleObject.KERNEL32 ref: 00007FF61DD82479
Part of subcall function 00007FF61DD823F0: Sleep.KERNEL32 ref: 00007FF61DD824AA
Part of subcall function 00007FF61DD823F0: ReleaseMutex.KERNEL32 ref: 00007FF61DD824DD

Part of subcall function 00007FF61DD8F0F4: lstrcpynA.KERNEL32 ref: 00007FF61DD8F1BB

inet_addr.WS2_32 ref: 00007FF61DD87867
htonl.WS2_32 ref: 00007FF61DD8786F
htonl.WS2_32 ref: 00007FF61DD87879
inet_addr.WS2_32 ref: 00007FF61DD8788A
htonl.WS2_32 ref: 00007FF61DD87892
htonl.WS2_32 ref: 00007FF61DD878A2

Strings

_InitialOfferTime, xrefs: 00007FF61DD874E4, 00007FF61DD87625, 00007FF61DD87928
The pool size is too small for the number of leases, ignoring extra leases, xrefs: 00007FF61DD874B6
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD8748F, 00007FF61DD87573, 00007FF61DD87669, 00007FF61DD876D0, 00007FF61DD877AD
%x:%x:%x:%x:%x:%x, xrefs: 00007FF61DD8759D
%s%d%s, xrefs: 00007FF61DD87520, 00007FF61DD8763B, 00007FF61DD876A2, 00007FF61DD8777F
Lease_NumLeases, xrefs: 00007FF61DD87481
%d/%d/%d/%d:%d:%d, xrefs: 00007FF61DD8771E, 00007FF61DD877EF
_IP, xrefs: 00007FF61DD874F3, 00007FF61DD8791F
_MAC, xrefs: 00007FF61DD87544
_LeaseStartTime, xrefs: 00007FF61DD87769
Lease_, xrefs: 00007FF61DD87516, 00007FF61DD87634, 00007FF61DD8769B, 00007FF61DD87773

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htonl$inet_addr$MutexObjectReleaseSingleSleepWaitlstrcpyn$PrivateProfileStringlstrlen
String ID: %d/%d/%d/%d:%d:%d$%s%d%s$%x:%x:%x:%x:%x:%x$Lease_$Lease_NumLeases$SOFTWARE\TFTPD32\DHCP$The pool size is too small for the number of leases, ignoring extra leases$_IP$_InitialOfferTime$_LeaseStartTime$_MAC
API String ID: 3980527857-3453468310
Opcode ID: e11f1815283010e265cca5f2d60aeb310881a721fa4be02928c5d1d5bdf144ef
Instruction ID: 4fbfabfc78a3553f72e1af6d6063696ce5c8bc671cbe8298ebe0af22aae29b82
Opcode Fuzzy Hash: e11f1815283010e265cca5f2d60aeb310881a721fa4be02928c5d1d5bdf144ef
Instruction Fuzzy Hash: CFF17C32E08F8A99EB21CB24E8405A977B4FB44B68F405336DA9C877A5EF3CE154C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD86F00, Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 283stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD86F4F
lstrcpyA.KERNEL32 ref: 00007FF61DD86F72
lstrcpyA.KERNEL32 ref: 00007FF61DD86FD1
wsprintfA.USER32 ref: 00007FF61DD87074
inet_ntoa.WS2_32 ref: 00007FF61DD87099
lstrcpyA.KERNEL32 ref: 00007FF61DD8730F
lstrcpyA.KERNEL32 ref: 00007FF61DD87342
lstrcpyA.KERNEL32 ref: 00007FF61DD873A8

Strings

_InitialOfferTime, xrefs: 00007FF61DD8724F
%02X%c, xrefs: 00007FF61DD87064
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD86F45, 00007FF61DD871E5, 00007FF61DD87243, 00007FF61DD872A4, 00007FF61DD87305
%02d/%02d/%04d/%02d:%02d:%02d, xrefs: 00007FF61DD870F4, 00007FF61DD8715D
%s%d%s, xrefs: 00007FF61DD871A6, 00007FF61DD87207, 00007FF61DD87265, 00007FF61DD872C6
Lease_NumLeases, xrefs: 00007FF61DD86F68
_IP, xrefs: 00007FF61DD871F1
_MAC, xrefs: 00007FF61DD87190
_LeaseStartTime, xrefs: 00007FF61DD872B0
Lease_, xrefs: 00007FF61DD8719A, 00007FF61DD871FB, 00007FF61DD87259, 00007FF61DD872BA

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$inet_ntoawsprintf
String ID: %02X%c$%02d/%02d/%04d/%02d:%02d:%02d$%s%d%s$Lease_$Lease_NumLeases$SOFTWARE\TFTPD32\DHCP$_IP$_InitialOfferTime$_LeaseStartTime$_MAC
API String ID: 1968709948-2954879211
Opcode ID: a379c2c7630bf18848679e72221ac9fc3a8151ec787b0e57ca466ef7d4a680c6
Instruction ID: e5c78a16f4183b3b6425d8df22db14285dd7747fffa59272b8faecdfdadc70a9
Opcode Fuzzy Hash: a379c2c7630bf18848679e72221ac9fc3a8151ec787b0e57ca466ef7d4a680c6
Instruction Fuzzy Hash: 6CE16732E08F8A95EB11CB24E8502A9B7A0FB45BA8F455335DA6D877D5EF3CE048C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD89040, Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 194synchronizationsleepthreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF61DD890A3
SetThreadPriority.KERNEL32(?,?,?,00007FF61DD81D7C), ref: 00007FF61DD890B1
Sleep.KERNEL32(?,?,?,00007FF61DD81D7C), ref: 00007FF61DD890C8
WaitForSingleObject.KERNEL32(?,?,?,00007FF61DD81D7C), ref: 00007FF61DD891B8
Sleep.KERNEL32(?,?,?,00007FF61DD81D7C), ref: 00007FF61DD891E9
ReleaseMutex.KERNEL32(?,?,?,00007FF61DD81D7C), ref: 00007FF61DD89219
socket.WS2_32 ref: 00007FF61DD89246
GetLastError.KERNEL32(?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8924F
closesocket.WS2_32 ref: 00007FF61DD89258
WaitForSingleObject.KERNEL32 ref: 00007FF61DD892BA
Sleep.KERNEL32 ref: 00007FF61DD892F5
ReleaseMutex.KERNEL32 ref: 00007FF61DD8932A

Strings

IPv6 enabled, xrefs: 00007FF61DD89264
service %s not started, xrefs: 00007FF61DD89178
Rc!=0, xrefs: 00007FF61DD8922E, 00007FF61DD8933F
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD891CF, 00007FF61DD892D1
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD891C8, 00007FF61DD89227, 00007FF61DD892CA, 00007FF61DD89338
--- all services started, init done, xrefs: 00007FF61DD89193

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Sleep$MutexObjectReleaseSingleThreadWait$CurrentErrorLastPriorityclosesocketsocket
String ID: --- all services started, init done$C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$IPv6 enabled$Rc!=0$Rc==WAIT_OBJECT_0$service %s not started
API String ID: 446551302-892426468
Opcode ID: c2513eda5d71b9454f305348b9751e895b4959fd9b91bf2cb92a89c8db10fd6c
Instruction ID: 82ac1c46e919c69f1f5b66a596a603aeaef45015a0c16db90d5742ce052cbff8
Opcode Fuzzy Hash: c2513eda5d71b9454f305348b9751e895b4959fd9b91bf2cb92a89c8db10fd6c
Instruction Fuzzy Hash: EE916931E08E0A99EB119B25E8446B833A5BF55F65F44A338C94ED21E5FF3CE489DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD82EF0, Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 190networksleepCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF61DD82F34

Part of subcall function 00007FF61DD82AB0: inet_addr.WS2_32 ref: 00007FF61DD82AF2
Part of subcall function 00007FF61DD82AB0: htonl.WS2_32 ref: 00007FF61DD82AFA
Part of subcall function 00007FF61DD82AB0: htonl.WS2_32 ref: 00007FF61DD82B05
Part of subcall function 00007FF61DD82AB0: inet_addr.WS2_32 ref: 00007FF61DD82B16
Part of subcall function 00007FF61DD82AB0: htonl.WS2_32 ref: 00007FF61DD82B1E
Part of subcall function 00007FF61DD82AB0: htonl.WS2_32 ref: 00007FF61DD82B2F

gethostname.WS2_32 ref: 00007FF61DD82F8B
gethostbyname.WS2_32 ref: 00007FF61DD82F9F
GetIpNetTable.IPHLPAPI ref: 00007FF61DD8300F
GetIpNetTable.IPHLPAPI ref: 00007FF61DD83039
DeleteIpNetEntry.IPHLPAPI ref: 00007FF61DD83077
inet_ntoa.WS2_32 ref: 00007FF61DD83083
SendARP.IPHLPAPI ref: 00007FF61DD830B3
inet_ntoa.WS2_32 ref: 00007FF61DD830C3
inet_ntoa.WS2_32 ref: 00007FF61DD8311D
WSAGetLastError.WS2_32 ref: 00007FF61DD83174
Sleep.KERNEL32 ref: 00007FF61DD83196

Strings

Ping Error %d (%s), xrefs: 00007FF61DD8317D
Suppress pingable address %s, xrefs: 00007FF61DD83123
IP address %s flushed from ARP table, xrefs: 00007FF61DD83089
FF:FF:FF:FF:FF:FF, xrefs: 00007FF61DD830DF, 00007FF61DD83139
Suppress arp-able address %s, xrefs: 00007FF61DD830C9

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htonl$inet_addrinet_ntoa$Table$DeleteEntryErrorLastSendSleepgethostbynamegethostname
String ID: FF:FF:FF:FF:FF:FF$IP address %s flushed from ARP table$Ping Error %d (%s)$Suppress arp-able address %s$Suppress pingable address %s
API String ID: 3498480018-3993020774
Opcode ID: c47f7ce29f17f6abe4c69f0a01b8ba9eeb086f310227718e5c1b58e92538f6e8
Instruction ID: be7210510685c4ad931d5669a41796275d17ce392cea213493c7e5b2b6b6bf33
Opcode Fuzzy Hash: c47f7ce29f17f6abe4c69f0a01b8ba9eeb086f310227718e5c1b58e92538f6e8
Instruction Fuzzy Hash: C481B121E08A4A46FB258B21E8507BA2391AF4AFA5F446335DA4DC37E5FE3CE445C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD89470, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 185synchronizationthreadsleepCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF61DD89495
SetThreadPriority.KERNEL32 ref: 00007FF61DD894A3
WaitForMultipleObjects.KERNEL32 ref: 00007FF61DD895B7
ResetEvent.KERNEL32 ref: 00007FF61DD895ED

Part of subcall function 00007FF61DD881C0: GetAdaptersAddresses.IPHLPAPI ref: 00007FF61DD88229
Part of subcall function 00007FF61DD881C0: GetAdaptersAddresses.IPHLPAPI ref: 00007FF61DD88273
Part of subcall function 00007FF61DD881C0: wsprintfA.USER32 ref: 00007FF61DD882C8
Part of subcall function 00007FF61DD881C0: getnameinfo.WS2_32 ref: 00007FF61DD88321

closesocket.WS2_32 ref: 00007FF61DD8965E
CloseHandle.KERNEL32 ref: 00007FF61DD89672
WaitForSingleObject.KERNEL32 ref: 00007FF61DD896D2
Sleep.KERNEL32 ref: 00007FF61DD89705
ReleaseMutex.KERNEL32 ref: 00007FF61DD8973A

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

Strings

end of ip pooling thread, xrefs: 00007FF61DD89793
process %s has terminated, xrefs: 00007FF61DD89630
Rc!=0, xrefs: 00007FF61DD8974F
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD896E9
Scheduler signal received, xrefs: 00007FF61DD895DA
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD896E2, 00007FF61DD89748

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Thread$AdaptersAddressesCurrentWait$CloseDebugEventHandleMultipleMutexObjectObjectsOutputPriorityReleaseResetSingleSleepStringclosesocketgetnameinfowsprintf
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0$Scheduler signal received$end of ip pooling thread$process %s has terminated
API String ID: 1802696196-3320815701
Opcode ID: 3931339fcbbd58288a8adb5f2e6ac5a45052de4f541beb3d0eaf30310a325035
Instruction ID: 701dcc40c21833c703a39e4cf8ab5ef1df3e0b3a71a7816b62a76f95e58ab063
Opcode Fuzzy Hash: 3931339fcbbd58288a8adb5f2e6ac5a45052de4f541beb3d0eaf30310a325035
Instruction Fuzzy Hash: 21915C30E18E4A96EA619F19E88017923A5FB85FB5F501339D99E932E4FF3CE441C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD847E0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 117sleepnetworkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF61DD84822

Part of subcall function 00007FF61DD97308: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD97324

htons.WS2_32 ref: 00007FF61DD8488F
htons.WS2_32 ref: 00007FF61DD848C3
GetTickCount.KERNEL32 ref: 00007FF61DD848CE
htonl.WS2_32 ref: 00007FF61DD848D6
sendto.WS2_32 ref: 00007FF61DD8491E
Sleep.KERNEL32 ref: 00007FF61DD84929
sendto.WS2_32 ref: 00007FF61DD84954
htonl.WS2_32 ref: 00007FF61DD8495E
htonl.WS2_32 ref: 00007FF61DD84985
Sleep.KERNEL32 ref: 00007FF61DD84994
Sleep.KERNEL32 ref: 00007FF61DD849AD
closesocket.WS2_32 ref: 00007FF61DD849C4

Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
Part of subcall function 00007FF61DD81F60: GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD81FFD
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
Part of subcall function 00007FF61DD81F60: GetLocalTime.KERNEL32 ref: 00007FF61DD82047
Part of subcall function 00007FF61DD81F60: WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD8213A

Strings

can create thread for ping Range, xrefs: 00007FF61DD8485F

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Thread$Sleep$CurrentPriorityhtonl$htonssendto$CountLocalObjectSingleTickTimeWait_invalid_parameter_noinfoclosesocketsocket
String ID: can create thread for ping Range
API String ID: 694595486-715432486
Opcode ID: bdb32c7d05a0b0f6a8c17189de511e1fe736013b98c1126087caf1ca2a773821
Instruction ID: c5b020419956395c96d394e16f0d0d918cff7552473bbde71e5dfc45cd9202ac
Opcode Fuzzy Hash: bdb32c7d05a0b0f6a8c17189de511e1fe736013b98c1126087caf1ca2a773821
Instruction Fuzzy Hash: 98513C32E09E4986E7219F20E45436973B1FB89F64F545339E69E876D8EF3DD4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD861D0, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32 ref: 00007FF61DD86235
inet_ntoa.WS2_32 ref: 00007FF61DD8623D
lstrcatA.KERNEL32 ref: 00007FF61DD8624B
lstrcpynA.KERNEL32 ref: 00007FF61DD86282
wsprintfA.USER32 ref: 00007FF61DD862A9
lstrcatA.KERNEL32 ref: 00007FF61DD862CD
lstrcatA.KERNEL32 ref: 00007FF61DD8631E
lstrcpynA.KERNEL32 ref: 00007FF61DD86332

Strings

$MAC$, xrefs: 00007FF61DD8625A
%02X%c, xrefs: 00007FF61DD86299
$IP$, xrefs: 00007FF61DD86209
$BootFileName$, xrefs: 00007FF61DD862D9

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcatlstrcpyn$inet_ntoawsprintf
String ID: $BootFileName$$$IP$$$MAC$$%02X%c
API String ID: 1554466265-3449672084
Opcode ID: fd0f6d6547a62726fc9b72ab0c246be6dabd9aaf0af43e1d05679f9ade4e2860
Instruction ID: 4a0a334fb89019556ad453f0e9b9c0e09fd6fe50cfbe627ace33b630c8048d9c
Opcode Fuzzy Hash: fd0f6d6547a62726fc9b72ab0c246be6dabd9aaf0af43e1d05679f9ade4e2860
Instruction Fuzzy Hash: 7741E222F18E5A91EB219B25E8146B953A0FF49FE8F449335CD0E8B794FE2DD109C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD85A80, Relevance: 24.3, APIs: 11, Strings: 5, Instructions: 272stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD85B9F
lstrcpyA.KERNEL32 ref: 00007FF61DD85BD4
lstrcpyA.KERNEL32 ref: 00007FF61DD85C50
wsprintfA.USER32 ref: 00007FF61DD85CC9
lstrcpyA.KERNEL32 ref: 00007FF61DD85CF0
lstrcpyA.KERNEL32 ref: 00007FF61DD85D22
lstrcpyA.KERNEL32 ref: 00007FF61DD85D90
wsprintfA.USER32 ref: 00007FF61DD85DD1
lstrcpyA.KERNEL32 ref: 00007FF61DD85DF8
lstrcpyA.KERNEL32 ref: 00007FF61DD85E35
lstrcpyA.KERNEL32 ref: 00007FF61DD85F00

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD85B95, 00007FF61DD85CE6, 00007FF61DD85DEE
%s%d, xrefs: 00007FF61DD85CBE, 00007FF61DD85DC6
AddOptionValue, xrefs: 00007FF61DD85DBF
AddOptionNumber, xrefs: 00007FF61DD85CB7
Can not allocate memory, xrefs: 00007FF61DD85AF7

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: %s%d$AddOptionNumber$AddOptionValue$Can not allocate memory$SOFTWARE\TFTPD32\DHCP
API String ID: 553454533-1026846957
Opcode ID: 369db36c5cdb1d2c53819b6043daa31a392cca1463021b205e952de4611c8f7c
Instruction ID: ba99a57e027d892f80c710e0484bbce2a8d473a73150a073ef7290460c0bad98
Opcode Fuzzy Hash: 369db36c5cdb1d2c53819b6043daa31a392cca1463021b205e952de4611c8f7c
Instruction Fuzzy Hash: 4ED17A61E08F8A96EB15DB24E4503B823A1AB45FA8F44A338DA1E937D5FF3CB055C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD82740, Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 122stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD827A4
inet_ntoa.WS2_32 ref: 00007FF61DD827BF
inet_ntoa.WS2_32 ref: 00007FF61DD82814
lstrcpyA.KERNEL32 ref: 00007FF61DD828B0
lstrcpyA.KERNEL32 ref: 00007FF61DD828D4
lstrcpyA.KERNEL32 ref: 00007FF61DD82935

Strings

Freeing item %s %s, xrefs: 00007FF61DD827D4
%02X%c, xrefs: 00007FF61DD82794
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD828A6
%s%d%s, xrefs: 00007FF61DD827F7
Lease_NumLeases, xrefs: 00007FF61DD828CA
_IP, xrefs: 00007FF61DD827E4
Lease_, xrefs: 00007FF61DD827EB

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$inet_ntoa$wsprintf
String ID: %02X%c$%s%d%s$Freeing item %s %s$Lease_$Lease_NumLeases$SOFTWARE\TFTPD32\DHCP$_IP
API String ID: 165547974-2814492973
Opcode ID: 94a503032a61c1f62271655bac4edcb105c7b2e1f06c9fc0695c70ce32653cdc
Instruction ID: 5e4dcb49374cc3d8581b339cd179fb50246a2b7338defedc4fef987803c2c390
Opcode Fuzzy Hash: 94a503032a61c1f62271655bac4edcb105c7b2e1f06c9fc0695c70ce32653cdc
Instruction Fuzzy Hash: 51517631E09E8A95EA11DB25E8602A937A0EF89F64F455339DA5D873E1FF3CE405C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8AE20, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 77stringfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD8AE61
lstrlenA.KERNEL32 ref: 00007FF61DD8AE6C
lstrcpyA.KERNEL32 ref: 00007FF61DD8AE9E
lstrcatA.KERNEL32 ref: 00007FF61DD8AEB0
CreateFileA.KERNEL32 ref: 00007FF61DD8AEE0
wsprintfA.USER32 ref: 00007FF61DD8AF11
WriteFile.KERNEL32 ref: 00007FF61DD8AF42
CloseHandle.KERNEL32 ref: 00007FF61DD8AF4B

Strings

, xrefs: 00007FF61DD8AEC2
.md5, xrefs: 00007FF61DD8AEA4
\, xrefs: 00007FF61DD8AE88
MD5 written into <%s>, xrefs: 00007FF61DD8AF5B
%02x, xrefs: 00007FF61DD8AF0A

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Filelstrcpy$CloseCreateHandleWritelstrcatlstrlenwsprintf
String ID: $%02x$.md5$MD5 written into <%s>$\
API String ID: 2970503177-2041570805
Opcode ID: 076920bfa61fa5d6be6ff3dded4499faf383736d9ea7b51db9a1531cf2745ce4
Instruction ID: 49ace1b0cb813ae886142c957d3c0b8cb1355d3fa686308841f718385dd4ada0
Opcode Fuzzy Hash: 076920bfa61fa5d6be6ff3dded4499faf383736d9ea7b51db9a1531cf2745ce4
Instruction Fuzzy Hash: 5F318861E08E8587EB14CB24E89436A73A1FF85B99F509335D78D866A9EF3CD509CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8EDAC, Relevance: 22.7, APIs: 15, Instructions: 186networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF61DD8EE1D
WSAGetLastError.WS2_32 ref: 00007FF61DD8EE58
closesocket.WS2_32 ref: 00007FF61DD8EE62
WSASetLastError.WS2_32 ref: 00007FF61DD8EE69
GetTickCount.KERNEL32 ref: 00007FF61DD8EECB
GetTickCount.KERNEL32 ref: 00007FF61DD8EF24
GetTickCount.KERNEL32 ref: 00007FF61DD8EF2E
GetTickCount.KERNEL32 ref: 00007FF61DD8EF3C
GetTickCount.KERNEL32 ref: 00007FF61DD8EFFB
closesocket.WS2_32 ref: 00007FF61DD8F00D
WSAGetLastError.WS2_32 ref: 00007FF61DD8F022
closesocket.WS2_32 ref: 00007FF61DD8F02C
WSASetLastError.WS2_32 ref: 00007FF61DD8F033

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CountErrorLastTick$closesocket
String ID:
API String ID: 3838087051-0
Opcode ID: 64fbd4b20cc598838e2a5aa1a9168b6bd3d594784ff45f41f096e94bf81b6e06
Instruction ID: 1d0795994330afadb7cc37d996f733e55d349968a4b7812ef37ae4cf6be4be4f
Opcode Fuzzy Hash: 64fbd4b20cc598838e2a5aa1a9168b6bd3d594784ff45f41f096e94bf81b6e06
Instruction Fuzzy Hash: B271E722E08B8A4AE7269B78E44427976A4FF45BA4F002335DA5DC76E5FF3CD544DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD881C0, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 163synchronizationsleepnetworkCOMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI ref: 00007FF61DD88229
GetAdaptersAddresses.IPHLPAPI ref: 00007FF61DD88273
wsprintfA.USER32 ref: 00007FF61DD882C8
getnameinfo.WS2_32 ref: 00007FF61DD88321
WaitForSingleObject.KERNEL32 ref: 00007FF61DD883CB
Sleep.KERNEL32 ref: 00007FF61DD88405

Part of subcall function 00007FF61DD8F534: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F57C
Part of subcall function 00007FF61DD8F534: ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F5B4
Part of subcall function 00007FF61DD8F534: OutputDebugStringA.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F5C1
Part of subcall function 00007FF61DD8F534: Sleep.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F5CC
Part of subcall function 00007FF61DD8F534: ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F67D

Part of subcall function 00007FF61DD88BD0: SetEvent.KERNEL32 ref: 00007FF61DD88C1B

ReleaseMutex.KERNEL32 ref: 00007FF61DD8843D

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

WSAGetLastError.WS2_32 ref: 00007FF61DD88475

Strings

Rc!=0, xrefs: 00007FF61DD88452
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD883E2
%ls, xrefs: 00007FF61DD882AD
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD883DB, 00007FF61DD8844B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: MutexRelease$AdaptersAddressesObjectSingleSleepWait$DebugErrorEventLastOutputString_set_error_modegetnameinfowsprintf
String ID: %ls$C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 1804719471-1722514933
Opcode ID: bd0151cd1f889bc42901324463152cfed1daac7f8428b80b1f98708482da982f
Instruction ID: 2545131c3fad452382d44d98a197242a27ca2ae3bdbe54f0b8aa3b9e2767f21f
Opcode Fuzzy Hash: bd0151cd1f889bc42901324463152cfed1daac7f8428b80b1f98708482da982f
Instruction Fuzzy Hash: A5715E32E08E4A86EB14DB25F4516A9B3A0FB85FA4F444239D64DC7A99EF7DE4058B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD85F70, Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 120stringthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8F0F4: lstrcpynA.KERNEL32 ref: 00007FF61DD8F158
Part of subcall function 00007FF61DD8F0F4: GetPrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F17F

wsprintfA.USER32 ref: 00007FF61DD86039
wsprintfA.USER32 ref: 00007FF61DD8608D
GetCurrentThreadId.KERNEL32 ref: 00007FF61DD86135
lstrcpyA.KERNEL32 ref: 00007FF61DD8616F

Part of subcall function 00007FF61DD822A0: lstrlenA.KERNEL32 ref: 00007FF61DD82308
Part of subcall function 00007FF61DD822A0: WaitForSingleObject.KERNEL32 ref: 00007FF61DD82329
Part of subcall function 00007FF61DD822A0: Sleep.KERNEL32 ref: 00007FF61DD8235A
Part of subcall function 00007FF61DD822A0: ReleaseMutex.KERNEL32 ref: 00007FF61DD8238E

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD85FF3, 00007FF61DD8606B, 00007FF61DD860B5
%s%d, xrefs: 00007FF61DD8602D, 00007FF61DD86081
AddOptionValue, xrefs: 00007FF61DD8607A
WINS server copied from DNS servers, xrefs: 00007FF61DD86175
AddOptionNumber, xrefs: 00007FF61DD86026
%d, Lease time not specified, set to 2 days, xrefs: 00007FF61DD8613B
Can not allocate memory, xrefs: 00007FF61DD861B6

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: wsprintf$CurrentMutexObjectPrivateProfileReleaseSingleSleepStringThreadWaitlstrcpylstrcpynlstrlen
String ID: %d, Lease time not specified, set to 2 days$%s%d$AddOptionNumber$AddOptionValue$Can not allocate memory$SOFTWARE\TFTPD32\DHCP$WINS server copied from DNS servers
API String ID: 526798118-3077575731
Opcode ID: 22fa0aefe805931d9b94e3a820a257e86ca81e8db33893e638d7c2d7a7241ba9
Instruction ID: f51dfeb1b70f412981668af82bc90dfa14093e3c2960e8e9566ebbce06544691
Opcode Fuzzy Hash: 22fa0aefe805931d9b94e3a820a257e86ca81e8db33893e638d7c2d7a7241ba9
Instruction Fuzzy Hash: 21516D71E08E8A95FB20DB24E8547A93765FB84FA8F455336DA4D836A5EF3CE109C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD88BD0, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 100networkCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF61DD88C1B

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

wsprintfA.USER32 ref: 00007FF61DD88CF9
getaddrinfo.WS2_32 ref: 00007FF61DD88D29
socket.WS2_32 ref: 00007FF61DD88D4A
sendto.WS2_32 ref: 00007FF61DD88D79
closesocket.WS2_32 ref: 00007FF61DD88D82
freeaddrinfo.WS2_32 ref: 00007FF61DD88D8D

Strings

C:\Users\ark\source\repos\tftpd64\src\_services\start_threads.c, xrefs: 00007FF61DD88C3D
wake up, xrefs: 00007FF61DD88D6A
! tThreads[Idx].gRunning || Rc!=0, xrefs: 00007FF61DD88C44
127.0.0.1, xrefs: 00007FF61DD88D09

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event_set_error_modeclosesocketfreeaddrinfogetaddrinfosendtosocketwsprintf
String ID: ! tThreads[Idx].gRunning || Rc!=0$127.0.0.1$C:\Users\ark\source\repos\tftpd64\src\_services\start_threads.c$wake up
API String ID: 1530048320-1310211757
Opcode ID: 35fb342a4d2a00053ec3fe768cf36146fcac1ce3b02ab658feead440b9464b7d
Instruction ID: eea04f86752e47cf21f82683ae01ad9de3aa72b5cfaa7e7b47b0e561006dd669
Opcode Fuzzy Hash: 35fb342a4d2a00053ec3fe768cf36146fcac1ce3b02ab658feead440b9464b7d
Instruction Fuzzy Hash: 69519632E18F4A86EB558B25F4813A973A0FB95F54F049336DA4E836A4EF3CE545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD88DC0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124synchronizationsleepCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00007FF61DD8908E,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD88EBD
closesocket.WS2_32 ref: 00007FF61DD88EDA
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000,00007FF61DD8908E,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD88EEE
WaitForSingleObject.KERNEL32 ref: 00007FF61DD88F95
Sleep.KERNEL32 ref: 00007FF61DD88FC6
ReleaseMutex.KERNEL32 ref: 00007FF61DD88FFB
SetEvent.KERNEL32(?,?,?,?,00000000,00000000,00000000,00007FF61DD8908E,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD89028

Part of subcall function 00007FF61DD888B0: wsprintfA.USER32 ref: 00007FF61DD88963
Part of subcall function 00007FF61DD888B0: getaddrinfo.WS2_32 ref: 00007FF61DD8898F
Part of subcall function 00007FF61DD888B0: GetLastError.KERNEL32 ref: 00007FF61DD889A1

Strings

Rc!=0, xrefs: 00007FF61DD89010
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD88FAC
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD88FA5, 00007FF61DD89009

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event$CloseCreateErrorHandleLastMutexObjectReleaseSingleSleepWaitclosesocketgetaddrinfowsprintf
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 3602007946-2064142993
Opcode ID: 394cbf58d5eeb8d0b7d60c5fe220c8ad725726a7a273de29e1962d4a76f00727
Instruction ID: 03da52facc6eb3a326ca680152233deda9bbe6647106c381a824719ed2a2cf8d
Opcode Fuzzy Hash: 394cbf58d5eeb8d0b7d60c5fe220c8ad725726a7a273de29e1962d4a76f00727
Instruction Fuzzy Hash: 71615AB1A04B5A96E7258B24F8405A933A5FB45B7CF105335EA7D832E4EF3CE465C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8F534, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 96synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F57C
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F5B4
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F5C1
Sleep.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F5CC
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,00007FF61DD81D7C), ref: 00007FF61DD8F67D

Strings

--------- Log queue full, xrefs: 00007FF61DD8F5BA
C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c, xrefs: 00007FF61DD8F58C
C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c, xrefs: 00007FF61DD8F5F6
pmsg != NULL, xrefs: 00007FF61DD8F5FD
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD8F593

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: MutexRelease$DebugObjectOutputSingleSleepStringWait
String ID: --------- Log queue full$C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c$C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c$Rc==WAIT_OBJECT_0$pmsg != NULL
API String ID: 4005009217-3397380523
Opcode ID: 5610740b0442f69abe83b7062e197c48700a758fb5105222669988668881767c
Instruction ID: 7d169777f13bc1758181c449aaa099feb2200a808b3770a743c2e395ee6dd55a
Opcode Fuzzy Hash: 5610740b0442f69abe83b7062e197c48700a758fb5105222669988668881767c
Instruction Fuzzy Hash: 83413D32E15E4996EA55EF21E894A797368FB48BA4F444335DA4EC73A1EF3CE141C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD82520, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 114stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD825BF
lstrcpyA.KERNEL32 ref: 00007FF61DD825E7
lstrcpyA.KERNEL32 ref: 00007FF61DD82654
inet_ntoa.WS2_32 ref: 00007FF61DD826AC

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD825B5
%s%d%s, xrefs: 00007FF61DD82697
Lease_NumLeases, xrefs: 00007FF61DD825DD
_IP, xrefs: 00007FF61DD82684
Lease_, xrefs: 00007FF61DD8268B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$inet_ntoa
String ID: %s%d%s$Lease_$Lease_NumLeases$SOFTWARE\TFTPD32\DHCP$_IP
API String ID: 2621009525-3307456023
Opcode ID: 625699643db9aad9bcfdadc8e6d5e28c00cf0261ddfbabe6f07b90a28051989c
Instruction ID: 7cca54248b1f501a95d2ca3f2c1af5ca80eceff753d3989949871dccef988b30
Opcode Fuzzy Hash: 625699643db9aad9bcfdadc8e6d5e28c00cf0261ddfbabe6f07b90a28051989c
Instruction Fuzzy Hash: 7C516C71E09E4E91EA15DB19E8616B927A4AF49FB4F445339DA0E87391FE3CE405C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA4204, Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA4372

Strings

NAN(IND), xrefs: 00007FF61DDA42B0
NAN(SNAN), xrefs: 00007FF61DDA429A
nan(snan), xrefs: 00007FF61DDA42A5
NAN, xrefs: 00007FF61DDA4262
INF, xrefs: 00007FF61DDA4278
inf, xrefs: 00007FF61DDA428B
nan(ind), xrefs: 00007FF61DDA42CA
nan, xrefs: 00007FF61DDA4269

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 4e608d3b896eb877323f59f79fae4eca249318ec7f1748c9f9a059c9857c6399
Instruction ID: ac3fd2ea476b3fcc015e85c733420f9aded878bddcfc3e1f3e8fe3cbfd9c638d
Opcode Fuzzy Hash: 4e608d3b896eb877323f59f79fae4eca249318ec7f1748c9f9a059c9857c6399
Instruction Fuzzy Hash: 89415B32E09F4989E700CB65E8507A937A5FB59BA8F448235EA5C87B98EE38D525C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD86AE0, Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD86BEE
lstrcpyA.KERNEL32 ref: 00007FF61DD86C23
lstrcpyA.KERNEL32 ref: 00007FF61DD86C94

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD86BE4
%02d/%02d/%04d/%02d:%02d:%02d, xrefs: 00007FF61DD86B80
ffff, xrefs: 00007FF61DD86B2F
%s%d%s, xrefs: 00007FF61DD86B1E
_LeaseStartTime, xrefs: 00007FF61DD86B03
ffff, xrefs: 00007FF61DD86B37
Lease_, xrefs: 00007FF61DD86B17

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy
String ID: %02d/%02d/%04d/%02d:%02d:%02d$%s%d%s$Lease_$SOFTWARE\TFTPD32\DHCP$_LeaseStartTime$ffff$ffff
API String ID: 3722407311-2911424208
Opcode ID: e78f8e409f5f94fc21c0274e3702b352b31009bcea0de1f5c4e01e4f03062f68
Instruction ID: a73de08c84cb04ff2922beabf4eca04173f602da2be37711842cdfe6a5af6bb1
Opcode Fuzzy Hash: e78f8e409f5f94fc21c0274e3702b352b31009bcea0de1f5c4e01e4f03062f68
Instruction Fuzzy Hash: A1517D71E09F8A96EB15DB14E4503A977A0EB45FA8F045335DA4D87795EF3CE444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD87B90, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 175networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD87BC9
htons.WS2_32 ref: 00007FF61DD87BDC
htons.WS2_32 ref: 00007FF61DD87C9F
htons.WS2_32 ref: 00007FF61DD87CB1
getaddrinfo.WS2_32 ref: 00007FF61DD87D3E
freeaddrinfo.WS2_32 ref: 00007FF61DD87E08
GetLastError.KERNEL32 ref: 00007FF61DD87E10

Strings

Complex DNS request : ignored, xrefs: 00007FF61DD87E57

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons$ErrorLastfreeaddrinfogetaddrinfo
String ID: Complex DNS request : ignored
API String ID: 2537595892-3673308873
Opcode ID: 0bb19152f12191a7736653ea26dadabeb2921bedf8437844c8c9c0b94dbcddce
Instruction ID: 5ddcab51ef1c33e455b9ac6b4a57fdbff89d5888e9b57f396562bc0025c4f49b
Opcode Fuzzy Hash: 0bb19152f12191a7736653ea26dadabeb2921bedf8437844c8c9c0b94dbcddce
Instruction Fuzzy Hash: 8971C522E09ACA91EB728F21D4403BA67A1FB85FA4F499235DE8D83785EF3CD455D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAD6C8, Relevance: 13.8, APIs: 9, Instructions: 273fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DDAD2AC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAD2ED
Part of subcall function 00007FF61DDAD2AC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAD36D
Part of subcall function 00007FF61DDAD2AC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAD3C1
Part of subcall function 00007FF61DDAD2AC: _get_daylight.LIBCMT ref: 00007FF61DDAD419

CreateFileW.KERNEL32 ref: 00007FF61DDAD7CE
CreateFileW.KERNEL32 ref: 00007FF61DDAD81E
GetLastError.KERNEL32 ref: 00007FF61DDAD84E
GetFileType.KERNEL32 ref: 00007FF61DDAD863
GetLastError.KERNEL32 ref: 00007FF61DDAD86D
CloseHandle.KERNEL32 ref: 00007FF61DDAD8A0
CloseHandle.KERNEL32 ref: 00007FF61DDAD9FB
CreateFileW.KERNEL32 ref: 00007FF61DDADA30
GetLastError.KERNEL32 ref: 00007FF61DDADA3F

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: cf6eb23bc62c8350d1366f143bd0a5072e13a0e283c354d61a9d92f36361d0f2
Instruction ID: 56573698292d3a86df0dc333ffd12fe4d1dee7a22f0bbd6d781c943c7de70a2d
Opcode Fuzzy Hash: cf6eb23bc62c8350d1366f143bd0a5072e13a0e283c354d61a9d92f36361d0f2
Instruction Fuzzy Hash: CEC19F36F24E4A86EB14CF69D4806AC3761F749FA8B119329DA1E977E4EF38D452C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD864E0, Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 110stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD86578
lstrcpyA.KERNEL32 ref: 00007FF61DD865D2
lstrcpyA.KERNEL32 ref: 00007FF61DD86607
lstrcpyA.KERNEL32 ref: 00007FF61DD86674

Strings

%02X%c, xrefs: 00007FF61DD86568
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD865C8
%s%d%s, xrefs: 00007FF61DD86522
_MAC, xrefs: 00007FF61DD8650C
Lease_, xrefs: 00007FF61DD8651B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: %02X%c$%s%d%s$Lease_$SOFTWARE\TFTPD32\DHCP$_MAC
API String ID: 553454533-2404180094
Opcode ID: 47de2d9ef9d706602c6ceee3de1a322a3283d0b0114b10b79c611afb98d6105f
Instruction ID: 6bc6409dd71e6c96e576dab3367eb1bfd38327ceeb5e2d03c85047c1ccc67a2f
Opcode Fuzzy Hash: 47de2d9ef9d706602c6ceee3de1a322a3283d0b0114b10b79c611afb98d6105f
Instruction Fuzzy Hash: F4419B21E09F8A95EB21DB20E8103A967A1EB45FA8F489335EA4E477D5FF3CE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8F2E8, Relevance: 13.6, APIs: 9, Instructions: 96registrystringfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF61DD8F344
CloseHandle.KERNEL32 ref: 00007FF61DD8F353
lstrcpyA.KERNEL32 ref: 00007FF61DD8F374
wsprintfA.USER32 ref: 00007FF61DD8F3A1
WritePrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F3BF
RegCreateKeyExA.ADVAPI32 ref: 00007FF61DD8F401
lstrlenA.KERNEL32 ref: 00007FF61DD8F418
RegSetValueExA.ADVAPI32 ref: 00007FF61DD8F43D
CloseHandle.KERNEL32 ref: 00007FF61DD8F44D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CloseCreateHandle$FilePrivateProfileStringValueWritelstrcpylstrlenwsprintf
String ID:
API String ID: 2107986745-0
Opcode ID: aadf93ccc465da68db7bfab317fbea3853d205e9524971ae2c2c33c018a9bef8
Instruction ID: 931427282705f92055504b2f7a70b17ef42a2d8194c96506e232a42b194983b6
Opcode Fuzzy Hash: aadf93ccc465da68db7bfab317fbea3853d205e9524971ae2c2c33c018a9bef8
Instruction Fuzzy Hash: F3419772A08A8686D7208F25E85476AB361FB85BF8F405335DA5D87B94EF7CD1498B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8DF84, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87networkfileCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF61DD8E005
WSAGetLastError.WS2_32 ref: 00007FF61DD8E00F
recv.WS2_32 ref: 00007FF61DD8E043
WriteFile.KERNEL32 ref: 00007FF61DD8E06E

Strings

select returns error %d, xrefs: 00007FF61DD8E017
recv returns error %d, xrefs: 00007FF61DD8E082

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorFileLastWriterecvselect
String ID: recv returns error %d$select returns error %d
API String ID: 2281566966-2510261032
Opcode ID: 7009edc749ffd6c9c2e6db6277c9e63807850f03e704506f2183ba14379cd299
Instruction ID: 54506a3c0805d4340046000a51c698b7bf419af4bc884cc009162321ca107ad1
Opcode Fuzzy Hash: 7009edc749ffd6c9c2e6db6277c9e63807850f03e704506f2183ba14379cd299
Instruction Fuzzy Hash: 2F31C522E1CE8A45F7615B34E8047796694AF45FB5F102330EA6EC26D4FF2DE445AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9F004, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF61DD9F048
GetFileType.KERNEL32 ref: 00007FF61DD9F05E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF61DD9F087
WriteConsoleW.KERNEL32 ref: 00007FF61DD9F0BD

Strings

Assertion failed: %Ts, file %Ts, line %d, xrefs: 00007FF61DD9F06E
C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c, xrefs: 00007FF61DD9F008
pmsg != NULL, xrefs: 00007FF61DD9F007

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: Assertion failed: %Ts, file %Ts, line %d$C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c$pmsg != NULL
API String ID: 2943507729-1772824407
Opcode ID: 4cfb30f43f59137ed24b3cbae0dc4ab1cb5b9fc626cdf245b6a13fac358919f9
Instruction ID: 9cbd75f839c6d4df951dc7e118234e118410aa4983bf5c710c9d3ad1494bb5e2
Opcode Fuzzy Hash: 4cfb30f43f59137ed24b3cbae0dc4ab1cb5b9fc626cdf245b6a13fac358919f9
Instruction Fuzzy Hash: D9319322E09E8A82E718DB61E8516BA67A5FB80BB0F504335F66D83AD5EF3DD501C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8CCC0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF61DD8CD01
WaitForSingleObject.KERNEL32 ref: 00007FF61DD8CD6C
ReleaseMutex.KERNEL32 ref: 00007FF61DD8CDD7

Strings

Rc!=0, xrefs: 00007FF61DD8CDF1
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD8CD1A, 00007FF61DD8CD81
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD8CD13, 00007FF61DD8CD7A, 00007FF61DD8CDEA

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ObjectSingleWait$MutexRelease
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 1412826340-2064142993
Opcode ID: 51953731bd4dddd534ce6ccf349ef3db3c48e9d5e1604895d4447de8fc8736c4
Instruction ID: bdb8d36c0bef965efd3cc12d2f82d6cc9483dc21116fd08b3faee2d137c92393
Opcode Fuzzy Hash: 51953731bd4dddd534ce6ccf349ef3db3c48e9d5e1604895d4447de8fc8736c4
Instruction Fuzzy Hash: 7A314921E18E0A82E715AB2AE84127936A4FF95FB4F406339D91DC76E5FF2CE4059740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD822A0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69synchronizationsleepstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD97098: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD970ED

lstrlenA.KERNEL32 ref: 00007FF61DD82308
WaitForSingleObject.KERNEL32 ref: 00007FF61DD82329
Sleep.KERNEL32 ref: 00007FF61DD8235A
ReleaseMutex.KERNEL32 ref: 00007FF61DD8238E

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

Strings

Rc!=0, xrefs: 00007FF61DD823A3
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD82340
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD82339, 00007FF61DD8239C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: MutexObjectReleaseSingleSleepWait_invalid_parameter_noinfo_set_error_modelstrlen
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 3149561393-2064142993
Opcode ID: 2094999adb32b57ac6f90f5ca7e2f0ae8e824b1e4139b2169445b3dba42951eb
Instruction ID: 74d7601c5a9912f7027d8f1b6b0209b28a00c2528098dfc3c57fd3a57fbe7eee
Opcode Fuzzy Hash: 2094999adb32b57ac6f90f5ca7e2f0ae8e824b1e4139b2169445b3dba42951eb
Instruction Fuzzy Hash: 13316631E28E0A82E7109B21E8A47A933A4BB45FA4F405338D94DC62E5EF2DE508CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81DE0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68sleepnetworkCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DD813E4), ref: 00007FF61DD81E5A
closesocket.WS2_32 ref: 00007FF61DD81E7A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DD813E4), ref: 00007FF61DD81E89
Sleep.KERNEL32 ref: 00007FF61DD81EBD
WSACleanup.WS2_32 ref: 00007FF61DD81EC3

Part of subcall function 00007FF61DD88BD0: SetEvent.KERNEL32 ref: 00007FF61DD88C1B

Strings

Tftpd32 service edition has ended, xrefs: 00007FF61DD81EC9
all level 1 threads have returned, xrefs: 00007FF61DD81EAC

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CleanupCloseEventHandleMultipleObjectsSleepWaitclosesocket
String ID: Tftpd32 service edition has ended$all level 1 threads have returned
API String ID: 1268883751-2212784168
Opcode ID: 0a601a80d75ad622685142f167d9361396bacb3547b342527f4a05dfddfc22ec
Instruction ID: feed4f6b9e364a5eb2dfeb03722009cbd61eda3afb699576f7f4e4fc01905794
Opcode Fuzzy Hash: 0a601a80d75ad622685142f167d9361396bacb3547b342527f4a05dfddfc22ec
Instruction Fuzzy Hash: EA314632E08F4A82E7118F24E85416973A5FB49FB8F545331DABD936E4EE3CE9468700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD87A30, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF61DD87AB0
sendto.WS2_32 ref: 00007FF61DD87B01

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

GetLastError.KERNEL32 ref: 00007FF61DD87B20
Sleep.KERNEL32 ref: 00007FF61DD87B39

Part of subcall function 00007FF61DD87B90: htons.WS2_32 ref: 00007FF61DD87BC9
Part of subcall function 00007FF61DD87B90: htons.WS2_32 ref: 00007FF61DD87BDC
Part of subcall function 00007FF61DD87B90: htons.WS2_32 ref: 00007FF61DD87C9F
Part of subcall function 00007FF61DD87B90: htons.WS2_32 ref: 00007FF61DD87CB1
Part of subcall function 00007FF61DD87B90: getaddrinfo.WS2_32 ref: 00007FF61DD87D3E

Strings

End of DNS thread, xrefs: 00007FF61DD87B5C
erreur %d during socket operation, xrefs: 00007FF61DD87B28
send %d/%d bytes, xrefs: 00007FF61DD87B0B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons$CurrentDebugErrorLastOutputSleepStringThreadgetaddrinforecvfromsendto
String ID: End of DNS thread$erreur %d during socket operation$send %d/%d bytes
API String ID: 3529181994-3167698669
Opcode ID: b4a87bf19fe7cedc4a619c0e5243d4444ebc88bf69693ea4ad390eab07ae4d8a
Instruction ID: b2f9bf961bcf7820d33e0dfea2e3c6caed480dc20194354ea2ff0b457fe21256
Opcode Fuzzy Hash: b4a87bf19fe7cedc4a619c0e5243d4444ebc88bf69693ea4ad390eab07ae4d8a
Instruction Fuzzy Hash: 64315E21E19E8A95F7609B10F4507AA73A0FB85B98F405335DA8D83694EF7CE505CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D6B4, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

Part of subcall function 00007FF61DD8F80C: lstrcpynA.KERNEL32 ref: 00007FF61DD8F853
Part of subcall function 00007FF61DD8F80C: lstrcatA.KERNEL32 ref: 00007FF61DD8F867
Part of subcall function 00007FF61DD8F80C: FindFirstFileA.KERNEL32 ref: 00007FF61DD8F879
Part of subcall function 00007FF61DD8F80C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF61DD8F8A1
Part of subcall function 00007FF61DD8F80C: FileTimeToSystemTime.KERNEL32 ref: 00007FF61DD8F8B1
Part of subcall function 00007FF61DD8F80C: GetDateFormatA.KERNEL32 ref: 00007FF61DD8F8DC
Part of subcall function 00007FF61DD8F80C: wsprintfA.USER32 ref: 00007FF61DD8F90F
Part of subcall function 00007FF61DD8F80C: FindNextFileA.KERNEL32 ref: 00007FF61DD8F928
Part of subcall function 00007FF61DD8F80C: FindClose.KERNEL32 ref: 00007FF61DD8F939

WaitForSingleObject.KERNEL32 ref: 00007FF61DD8D70B
ReleaseMutex.KERNEL32 ref: 00007FF61DD8D77C

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

Strings

sending Directory content, xrefs: 00007FF61DD8D6B4
Rc!=0, xrefs: 00007FF61DD8D791
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD8D722
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD8D71B, 00007FF61DD8D78A

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: File$Time$Find$CloseCurrentDateDebugFirstFormatLocalMutexNextObjectOutputReleaseSingleStringSystemThreadWait_set_error_modelstrcatlstrcpynwsprintf
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0$sending Directory content
API String ID: 2803583227-4201129929
Opcode ID: c14f8912ddb859bae765699a186dd0f56ef620ff2ea9e2a1ed348352f273c3ca
Instruction ID: 83aa358acdcd90afba9fcb12c9ac88baa18ed4c4cdf836be3522fe542b67ead3
Opcode Fuzzy Hash: c14f8912ddb859bae765699a186dd0f56ef620ff2ea9e2a1ed348352f273c3ca
Instruction Fuzzy Hash: 74314821E08D4A95F7169B29E8516B82360EF45FA8F849336C80EC32E5EF6DE546DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD823F0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 64synchronizationsleepstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD97098: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD970ED

lstrlenA.KERNEL32 ref: 00007FF61DD82458
WaitForSingleObject.KERNEL32 ref: 00007FF61DD82479
Sleep.KERNEL32 ref: 00007FF61DD824AA
ReleaseMutex.KERNEL32 ref: 00007FF61DD824DD

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

Strings

Rc!=0, xrefs: 00007FF61DD824F2
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD82490
C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c, xrefs: 00007FF61DD82489, 00007FF61DD824EB

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: MutexObjectReleaseSingleSleepWait_invalid_parameter_noinfo_set_error_modelstrlen
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\to_console.c$Rc!=0$Rc==WAIT_OBJECT_0
API String ID: 3149561393-2064142993
Opcode ID: 4aee6dba0547bff49b4d8af972b2b48b5bfe8a7a23e404475978a7b7623728ef
Instruction ID: 0f548cd547ae6f1af317048ea356d4b86ff1066b19b76371185179e53eaccd96
Opcode Fuzzy Hash: 4aee6dba0547bff49b4d8af972b2b48b5bfe8a7a23e404475978a7b7623728ef
Instruction Fuzzy Hash: 84316831E18E0A81E7109B25E8957B933A8FB95FA4F409338D91D872A5EF3CE504C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8BB90, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 46networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

send.WS2_32 ref: 00007FF61DD8BC09
GetLastError.KERNEL32 ref: 00007FF61DD8BC23
WSAGetLastError.WS2_32 ref: 00007FF61DD8BC29

Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FD7
Part of subcall function 00007FF61DD81F60: GetThreadPriority.KERNEL32 ref: 00007FF61DD81FE0
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD81FE8
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD81FF4
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD81FFD
Part of subcall function 00007FF61DD81F60: GetCurrentThread.KERNEL32 ref: 00007FF61DD82003
Part of subcall function 00007FF61DD81F60: SetThreadPriority.KERNEL32 ref: 00007FF61DD8200E
Part of subcall function 00007FF61DD81F60: GetLocalTime.KERNEL32 ref: 00007FF61DD82047
Part of subcall function 00007FF61DD81F60: WaitForSingleObject.KERNEL32 ref: 00007FF61DD8210A
Part of subcall function 00007FF61DD81F60: Sleep.KERNEL32 ref: 00007FF61DD8213A

Strings

C:\Users\ark\source\repos\tftpd64\src\_services\tftpd_thread.c, xrefs: 00007FF61DD8BBA4
send OACK %d bytes, xrefs: 00007FF61DD8BBBB
send : Error %d, xrefs: 00007FF61DD8BC2F
pTftp!=NULL, xrefs: 00007FF61DD8BBAB

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Thread$CurrentPriority$ErrorLastSleep$LocalObjectSingleTimeWait_set_error_modesend
String ID: C:\Users\ark\source\repos\tftpd64\src\_services\tftpd_thread.c$pTftp!=NULL$send : Error %d$send OACK %d bytes
API String ID: 3931932432-3934667808
Opcode ID: 9f785f06fad8841afa55c5ca3e5d4fc995387d71deb850b9572705ff6a979c2f
Instruction ID: 2344ff0075dea3c7cc4cbb32594b4e5d548e18db94efe9fd7f93ee7a5eb0f6a4
Opcode Fuzzy Hash: 9f785f06fad8841afa55c5ca3e5d4fc995387d71deb850b9572705ff6a979c2f
Instruction Fuzzy Hash: 37116D62F18D0A82EB109F39E4406B92361FF45F68F849635DA0DC7698FF2CE049C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD868D0, Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 119stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD869DE
lstrcpyA.KERNEL32 ref: 00007FF61DD86A13
lstrcpyA.KERNEL32 ref: 00007FF61DD86A84

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD869D4
%02d/%02d/%04d/%02d:%02d:%02d, xrefs: 00007FF61DD86971
%s%d%s, xrefs: 00007FF61DD8690E
_LeaseStartTime, xrefs: 00007FF61DD868F3
Lease_, xrefs: 00007FF61DD86907

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy
String ID: %02d/%02d/%04d/%02d:%02d:%02d$%s%d%s$Lease_$SOFTWARE\TFTPD32\DHCP$_LeaseStartTime
API String ID: 3722407311-4248207637
Opcode ID: f5ba6423d54ef6d7219ba9a891ad53ec684f27cc28e575a6998fb1997557de00
Instruction ID: 4ca5e2fee2213564cbe64b03f8923073bf4f803a13b393d608f3cf4830d810db
Opcode Fuzzy Hash: f5ba6423d54ef6d7219ba9a891ad53ec684f27cc28e575a6998fb1997557de00
Instruction Fuzzy Hash: 6B514C32E09F8A9AEB25DB14E4502A977A0FB49FA4F045335DA8D87795EF3CE445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD86CF0, Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD86DFE
lstrcpyA.KERNEL32 ref: 00007FF61DD86E33
lstrcpyA.KERNEL32 ref: 00007FF61DD86EA4

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD86DF4
%02d/%02d/%04d/%02d:%02d:%02d, xrefs: 00007FF61DD86D8A
%s%d%s, xrefs: 00007FF61DD86D2E
_LeaseStartTime, xrefs: 00007FF61DD86D13
Lease_, xrefs: 00007FF61DD86D27

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy
String ID: %02d/%02d/%04d/%02d:%02d:%02d$%s%d%s$Lease_$SOFTWARE\TFTPD32\DHCP$_LeaseStartTime
API String ID: 3722407311-4248207637
Opcode ID: ca0c7fd057f4d83c2909875900b711dd16ef1f7b732d71af65c5eb33f6bd1c25
Instruction ID: 45ecb3c118f4cf21df61ec7080699fd0731d20334c5408bf76519acf7875dc7d
Opcode Fuzzy Hash: ca0c7fd057f4d83c2909875900b711dd16ef1f7b732d71af65c5eb33f6bd1c25
Instruction Fuzzy Hash: D7516D72E09F8A96EB25DB14E4502A977A0FB89FA4F045235DA4D87795EF3CE045CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD866C0, Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD867CE
lstrcpyA.KERNEL32 ref: 00007FF61DD86803
lstrcpyA.KERNEL32 ref: 00007FF61DD86874

Strings

_InitialOfferTime, xrefs: 00007FF61DD866E3
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD867C4
%02d/%02d/%04d/%02d:%02d:%02d, xrefs: 00007FF61DD86761
%s%d%s, xrefs: 00007FF61DD866FE
Lease_, xrefs: 00007FF61DD866F7

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy
String ID: %02d/%02d/%04d/%02d:%02d:%02d$%s%d%s$Lease_$SOFTWARE\TFTPD32\DHCP$_InitialOfferTime
API String ID: 3722407311-3020353603
Opcode ID: f1ec33fd2a7d2f1d44932eb2509de029f1ddec6a35d6a3af3eefd4977147507d
Instruction ID: b6be4ad69a3e5c8019144030162d399256ec9ef09daf63500695aec504696ae0
Opcode Fuzzy Hash: f1ec33fd2a7d2f1d44932eb2509de029f1ddec6a35d6a3af3eefd4977147507d
Instruction Fuzzy Hash: 4E516A72E08B8A96EB15DB10E4503A9B7A0EB89FA4F445235EA4D877D5EF3CE445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAED6C, Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAF1A2

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1a25d7d0356dfcfcf5b42c6cacd7070287dacc94e588899a163453eedf814ba1
Instruction ID: c3735c0bea9279c930bd064ba64214c741eb3c61db8f6aab238787c7f3651e96
Opcode Fuzzy Hash: 1a25d7d0356dfcfcf5b42c6cacd7070287dacc94e588899a163453eedf814ba1
Instruction Fuzzy Hash: 46C1B222E08E8A81E6605B65D4402B97BA0FB80FE4F458371EA4D877E5EF7CE859C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D1CF, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 141stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

lstrcmpA.KERNEL32 ref: 00007FF61DD8D21A
lstrcpynA.KERNEL32 ref: 00007FF61DD8D2BF
lstrcpyA.KERNEL32 ref: 00007FF61DD8D329
lstrcpyA.KERNEL32 ref: 00007FF61DD8D35A
lstrcpyA.KERNEL32 ref: 00007FF61DD8D3D0

Strings

SOFTWARE\TFTPD32, xrefs: 00007FF61DD8D31F
storing new TFTP settings, xrefs: 00007FF61DD8D1CF

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy$CurrentDebugOutputStringThreadlstrcmplstrcpyn
String ID: SOFTWARE\TFTPD32$storing new TFTP settings
API String ID: 277310150-174040948
Opcode ID: a53392ba19285e647ffac3ec8332bde07d7daa356dd949a4edf9c44c25b63e45
Instruction ID: 5d892a91411980fad078b8476f69771dc74ea31d677e8367b66a047718ee3fdd
Opcode Fuzzy Hash: a53392ba19285e647ffac3ec8332bde07d7daa356dd949a4edf9c44c25b63e45
Instruction Fuzzy Hash: F0618621E09E0A99FB11DB29E8506B827A0AF49FB4F846339D91DC32E1FE3DE541D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8F0F4, Relevance: 10.6, APIs: 7, Instructions: 133registrystringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32 ref: 00007FF61DD8F158
GetPrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F17F
lstrcpynA.KERNEL32 ref: 00007FF61DD8F1BB
GetPrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F1EF
RegOpenKeyExA.ADVAPI32 ref: 00007FF61DD8F276
RegQueryValueExA.ADVAPI32 ref: 00007FF61DD8F29D
RegCloseKey.ADVAPI32 ref: 00007FF61DD8F2B5

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: PrivateProfileStringlstrcpyn$CloseOpenQueryValue
String ID:
API String ID: 2965803066-0
Opcode ID: 146649dd30453a54691608110932c45c2ddcbc4d9248cd8298346d896144df2f
Instruction ID: 9711cb8b4313c81b2c56f81b91bced134779dd8bd34332154da48db0197449aa
Opcode Fuzzy Hash: 146649dd30453a54691608110932c45c2ddcbc4d9248cd8298346d896144df2f
Instruction Fuzzy Hash: 9451C723F18A9A85EB618B74E840B6967A0FB55BB8F405331EF5D82BD8EF3CD1458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8E260, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD8E284

Strings

send returns error %d, xrefs: 00007FF61DD8E313

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons
String ID: send returns error %d
API String ID: 4207154920-3644801256
Opcode ID: 3add14312600155dbc0142a831417055174b1d2effb871e511336846ecb2bd82
Instruction ID: 7a20ea3e1035fb1d3afaf41b9d93d75a578d747f5cf052c566fe51d22779aa21
Opcode Fuzzy Hash: 3add14312600155dbc0142a831417055174b1d2effb871e511336846ecb2bd82
Instruction Fuzzy Hash: 2121D022F18F5682E7105B36E844679A290AF85FF4F545330EA7DC3AD4EF2DE8019B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8BC50, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60networkwindowCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD8BC72
htons.WS2_32 ref: 00007FF61DD8BCC5
MessageBeep.USER32 ref: 00007FF61DD8BD3D

Strings

sent, xrefs: 00007FF61DD8BCD0
rcvd, xrefs: 00007FF61DD8BCDB
<%s>: %s %d blk%s, %d bytes in %d s. %d blk%s resent, xrefs: 00007FF61DD8BCFC

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons$BeepMessage
String ID: <%s>: %s %d blk%s, %d bytes in %d s. %d blk%s resent$rcvd$sent
API String ID: 4254488149-519785448
Opcode ID: b71577ef5bbbe6016fd810e847aea3273045705d5c461e5b72ef1c1399cff9ff
Instruction ID: a58244d5d23330406e7487667d8d07b0a5b26f0c60e03dbba6d4c9326046ab3d
Opcode Fuzzy Hash: b71577ef5bbbe6016fd810e847aea3273045705d5c461e5b72ef1c1399cff9ff
Instruction Fuzzy Hash: D921A0B2D08A4986D7109F25F8045A973A4FB00BA8F814236EB8E83795EF3CE585CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81220, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32 ref: 00007FF61DD81232
SetServiceStatus.ADVAPI32 ref: 00007FF61DD812B3

Part of subcall function 00007FF61DD815B0: GetLastError.KERNEL32 ref: 00007FF61DD815E3
Part of subcall function 00007FF61DD815B0: RegisterEventSourceA.ADVAPI32 ref: 00007FF61DD815F8
Part of subcall function 00007FF61DD815B0: ReportEventA.ADVAPI32 ref: 00007FF61DD81667
Part of subcall function 00007FF61DD815B0: DeregisterEventSource.ADVAPI32 ref: 00007FF61DD81670

SetServiceStatus.ADVAPI32 ref: 00007FF61DD81331

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

Strings

reporting service status %d, xrefs: 00007FF61DD81276, 00007FF61DD812F1
SetServiceStatus, xrefs: 00007FF61DD812BD, 00007FF61DD8133B
Tftpd32_svc, xrefs: 00007FF61DD8122B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: EventService$RegisterSourceStatus$CtrlCurrentDebugDeregisterErrorHandlerLastOutputReportStringThread
String ID: SetServiceStatus$Tftpd32_svc$reporting service status %d
API String ID: 1980693714-1236392229
Opcode ID: 87ce4a4444252bfa7b3e7e9773bdaadf4e6661dd5280b881705e54809ce9e43c
Instruction ID: 8ded6d22de9de89955990f945c49ae522912d4113791946a00f7ece4954e95d4
Opcode Fuzzy Hash: 87ce4a4444252bfa7b3e7e9773bdaadf4e6661dd5280b881705e54809ce9e43c
Instruction Fuzzy Hash: 2D31B2B0E09E4BC6EA119F25E8802A537A0FF4AF69F445339C14DC62A4FF7CB1489744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDB012C, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF61DDB015D
GetLastError.KERNEL32 ref: 00007FF61DDB0169
CloseHandle.KERNEL32 ref: 00007FF61DDB0181
CreateFileW.KERNEL32 ref: 00007FF61DDB01AC
WriteConsoleW.KERNEL32 ref: 00007FF61DDB01CB

Strings

CONOUT$, xrefs: 00007FF61DDB018D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b213ba185833639ae4cc80eecd3004489e5bf71626562265b0df756ab6cd787f
Instruction ID: 9552e165fbc9e4453b37fe83fa27645d61ca73acbe7ab503c01ffd281580e773
Opcode Fuzzy Hash: b213ba185833639ae4cc80eecd3004489e5bf71626562265b0df756ab6cd787f
Instruction Fuzzy Hash: 40117922F18E4586E7508B52E85472966A0FB9AFF8F548334EA1DC77A8EF3CD8048744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D4B3, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

lstrlenA.KERNEL32 ref: 00007FF61DD8D4CD
htons.WS2_32 ref: 00007FF61DD8D4E0
send.WS2_32 ref: 00007FF61DD8D4F8
send.WS2_32 ref: 00007FF61DD8D50C

Strings

sending working directory <%s>, xrefs: 00007FF61DD8D4BA
j, xrefs: 00007FF61DD8D4D3

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: send$CurrentDebugOutputStringThreadhtonslstrlen
String ID: j$sending working directory <%s>
API String ID: 335249207-3008087598
Opcode ID: 0b2338b5b395f2dd2dbd567a9c310d4dcbc76a18e2f9be57ad9e23522349984e
Instruction ID: 5953eccd9fdde99fa9307e32916672c249d1f7e698b91d2dbc822fd6e14a0e67
Opcode Fuzzy Hash: 0b2338b5b395f2dd2dbd567a9c310d4dcbc76a18e2f9be57ad9e23522349984e
Instruction Fuzzy Hash: E0118F32F08A0699E705DF21E9509A83321EF59FA8F905232DD0E97654EF7DE44AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81500, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF61DD81511
FormatMessageA.KERNEL32 ref: 00007FF61DD81537
lstrlenA.KERNEL32 ref: 00007FF61DD81557
GetLastError.KERNEL32 ref: 00007FF61DD8156A
LocalFree.KERNEL32 ref: 00007FF61DD8159A

Strings

%s (0x%x), xrefs: 00007FF61DD81575

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLast$FormatFreeLocalMessagelstrlen
String ID: %s (0x%x)
API String ID: 80924633-3163169946
Opcode ID: 7c8f3b065a442e14f5b6d390d8302638ff150dfaaed60ad95d1aa587c9d609b2
Instruction ID: f1086465d87b19d53cba028b273ad7eb68acd073b2e47887ec0c064f0e3a2263
Opcode Fuzzy Hash: 7c8f3b065a442e14f5b6d390d8302638ff150dfaaed60ad95d1aa587c9d609b2
Instruction Fuzzy Hash: 4B115421E0CF4696E7118BA5F44466AA7A4FF89FA5F045335D98E82794EFBCD0488700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81000, Relevance: 9.1, APIs: 6, Instructions: 91stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF61DD81037
lstrlenA.KERNEL32 ref: 00007FF61DD81075
lstrcmpiA.KERNEL32 ref: 00007FF61DD810A9
lstrcatA.KERNEL32 ref: 00007FF61DD810E7
lstrcpyA.KERNEL32 ref: 00007FF61DD810F9
lstrcatA.KERNEL32 ref: 00007FF61DD81109

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcat$FileModuleNamelstrcmpilstrcpylstrlen
String ID:
API String ID: 171607471-0
Opcode ID: 1d096b19a57eebf351f3fa041d0d1a353cc23e9e4c511f4918330b6a2924325f
Instruction ID: 6ffddd604e8d7673c24ed0a48f4664a6c05304daf02ac0d61dffebd9b4fdecb3
Opcode Fuzzy Hash: 1d096b19a57eebf351f3fa041d0d1a353cc23e9e4c511f4918330b6a2924325f
Instruction Fuzzy Hash: DF31B222F18E8A86EF208B25E8543B96360FB89FA8F455335C98D83794FE3CD509C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8E150, Relevance: 9.1, APIs: 6, Instructions: 70networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF61DD8E1A1
wsprintfA.USER32 ref: 00007FF61DD8E1C4
getaddrinfo.WS2_32 ref: 00007FF61DD8E1D9
socket.WS2_32 ref: 00007FF61DD8E202
connect.WS2_32 ref: 00007FF61DD8E220
freeaddrinfo.WS2_32 ref: 00007FF61DD8E237

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: getaddrinfo$connectfreeaddrinfosocketwsprintf
String ID:
API String ID: 3813729492-0
Opcode ID: d5c94d0d1d8fb2a01182075e341d3d2295d7c36bcc3d32ef413245d35044f566
Instruction ID: 73c2e6e212ca492cff7e38114c830ad3bb220414e803b0b76898c6d3446b694d
Opcode Fuzzy Hash: d5c94d0d1d8fb2a01182075e341d3d2295d7c36bcc3d32ef413245d35044f566
Instruction Fuzzy Hash: 24315E72F04A5989F7008BB5C8447AC37B1BB49FB8F149335DE1D5A694EE38E585CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD97308, Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD97324
CreateThread.KERNEL32 ref: 00007FF61DD97368
GetLastError.KERNEL32 ref: 00007FF61DD97376
CloseHandle.KERNEL32(?,?,?,?,0004D458,00007FF61DD88F40,?,?,?,?,00000000,00000000,00000000,00007FF61DD8908E,?,?), ref: 00007FF61DD97395
FreeLibrary.KERNEL32(?,?,?,?,0004D458,00007FF61DD88F40,?,?,?,?,00000000,00000000,00000000,00007FF61DD8908E,?,?), ref: 00007FF61DD973A4
ResumeThread.KERNEL32 ref: 00007FF61DD973C7

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: efea3f799b553efc9d33fd01a4b4b4e1a594341760b503d5541f8a66f2d0a3a6
Instruction ID: 22083dda148dbd21dea522466e2f3de75dab8041f0a92dde7d2ae9c8d5efb894
Opcode Fuzzy Hash: efea3f799b553efc9d33fd01a4b4b4e1a594341760b503d5541f8a66f2d0a3a6
Instruction Fuzzy Hash: B9217225E09F4A92EF189B71A42427962A0AF45FB8F254735DE3D827E5FF3DE4048340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8CFEC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

WaitForMultipleObjects.KERNEL32 ref: 00007FF61DD8D05B
closesocket.WS2_32 ref: 00007FF61DD8D083
CloseHandle.KERNEL32 ref: 00007FF61DD8D092

Part of subcall function 00007FF61DD88BD0: SetEvent.KERNEL32 ref: 00007FF61DD88C1B

Strings

all level 1 threads have returned, xrefs: 00007FF61DD8D0B8
suspending services, xrefs: 00007FF61DD8CFEC

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CloseCurrentDebugEventHandleMultipleObjectsOutputStringThreadWaitclosesocket
String ID: all level 1 threads have returned$suspending services
API String ID: 1211340915-340281526
Opcode ID: c92e5b4940cbf664ffa6943cc4952fc57f364a92fa244aba7cc81580e4726c47
Instruction ID: d8309130cd1257dd3dc048d164d0a4d76b152bc74b3a025082033e952851c9ce
Opcode Fuzzy Hash: c92e5b4940cbf664ffa6943cc4952fc57f364a92fa244aba7cc81580e4726c47
Instruction Fuzzy Hash: 0B312B36E08E4A89E7119F69E8542B82360BB45FB8F555331D93D832D4EF7DE886D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D5BA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

htons.WS2_32 ref: 00007FF61DD8D63B
send.WS2_32 ref: 00007FF61DD8D653
send.WS2_32 ref: 00007FF61DD8D667

Strings

l, xrefs: 00007FF61DD8D634
sending running services, xrefs: 00007FF61DD8D5BA

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: send$CurrentDebugOutputStringThreadhtons
String ID: l$sending running services
API String ID: 1090704631-1351604320
Opcode ID: 3e27c6c52a9c35e4be68a16847769cd58854390f2039b388ef1cda487890741c
Instruction ID: eb24fd398435fe8f5382c37f9d61fb84a2f7af99283c201056fba5921b1d0c2a
Opcode Fuzzy Hash: 3e27c6c52a9c35e4be68a16847769cd58854390f2039b388ef1cda487890741c
Instruction Fuzzy Hash: C321D832E08909CAF722CF29E8047B833A5AF44B69F411236C90E935E4EF7DA885D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8CF35, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

WaitForMultipleObjects.KERNEL32 ref: 00007FF61DD8CF8C
closesocket.WS2_32 ref: 00007FF61DD8CFAA
CloseHandle.KERNEL32 ref: 00007FF61DD8CFB9

Part of subcall function 00007FF61DD88BD0: SetEvent.KERNEL32 ref: 00007FF61DD88C1B

Strings

all level 1 threads have returned, xrefs: 00007FF61DD8CFDB
stopping services, xrefs: 00007FF61DD8CF35

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CloseCurrentDebugEventHandleMultipleObjectsOutputStringThreadWaitclosesocket
String ID: all level 1 threads have returned$stopping services
API String ID: 1211340915-619220341
Opcode ID: cc588b149918eebfb5216ccced56ec0fafafbd04a6907ee82bfce4e20fb69729
Instruction ID: c5b9f0ce2ccf7293f94213cd1f11431060d0d2e2690bc3832ed0057bd93919ec
Opcode Fuzzy Hash: cc588b149918eebfb5216ccced56ec0fafafbd04a6907ee82bfce4e20fb69729
Instruction Fuzzy Hash: 8A213D36E04E0A85E7118B28E8542B82364EB45F78F555332DE7D836D4EF3DE886D350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8EC74, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42registrystringCOMMON

Download Yara Rule

APIs

RegisterEventSourceA.ADVAPI32 ref: 00007FF61DD8ECA2
lstrlenA.KERNEL32 ref: 00007FF61DD8ECB4
ReportEventA.ADVAPI32 ref: 00007FF61DD8ECEB
DeregisterEventSource.ADVAPI32 ref: 00007FF61DD8ECF6

Strings

Tftpd32, xrefs: 00007FF61DD8EC95

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event$Source$DeregisterRegisterReportlstrlen
String ID: Tftpd32
API String ID: 337067925-2153008962
Opcode ID: 74998509cfa025203f3c85de46c5c68583f0445875693d0471ba4aea2c89ffe3
Instruction ID: c6820968e30169d1da551d58410696c7a53cc1e0d9e1e79787e41254c63c28b6
Opcode Fuzzy Hash: 74998509cfa025203f3c85de46c5c68583f0445875693d0471ba4aea2c89ffe3
Instruction Fuzzy Hash: 71115A32B08B5982D7108B25F84846973A4FB48FF0B254335EAAD83798EF3DD9558B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D0E4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

htons.WS2_32 ref: 00007FF61DD8D0FC
send.WS2_32 ref: 00007FF61DD8D114
send.WS2_32 ref: 00007FF61DD8D128

Strings

sending DHCP settings, xrefs: 00007FF61DD8D0E4
i, xrefs: 00007FF61DD8D0F5

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: send$CurrentDebugOutputStringThreadhtons
String ID: i$sending DHCP settings
API String ID: 1090704631-869432291
Opcode ID: cd96583e876623591a7f3f7d0b34130da5e1b3c1e63c2b24c56d41ce49ea971c
Instruction ID: 110756790609fd17ee44c7bf4d99c1f0e0d99f015fafcb1dec029e5717cef201
Opcode Fuzzy Hash: cd96583e876623591a7f3f7d0b34130da5e1b3c1e63c2b24c56d41ce49ea971c
Instruction Fuzzy Hash: 2D019E32F04A0599F711DF21E411AAC3320FB49BA8F806232DE0E57A94EE3DE849C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D14B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

htons.WS2_32 ref: 00007FF61DD8D163
send.WS2_32 ref: 00007FF61DD8D17B
send.WS2_32 ref: 00007FF61DD8D18F

Strings

h, xrefs: 00007FF61DD8D15C
sending TFTP settings, xrefs: 00007FF61DD8D14B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: send$CurrentDebugOutputStringThreadhtons
String ID: h$sending TFTP settings
API String ID: 1090704631-1445145195
Opcode ID: d976d1f7d1f7b4c8c1699b7695977b5f92dd184c8e7b1b09288b060baee3f9c9
Instruction ID: 67eaba26ddc156270ab6c2436449d527104e003595423f2e79096c7a6ed6f0f9
Opcode Fuzzy Hash: d976d1f7d1f7b4c8c1699b7695977b5f92dd184c8e7b1b09288b060baee3f9c9
Instruction Fuzzy Hash: 0B015E33F14A1599F711DF25E450AAC3361EB89BA8F815232DE0E57A94EE3ED84AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8D3FE, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

RegDeleteKeyA.ADVAPI32 ref: 00007FF61DD8D418
RegDeleteKeyA.ADVAPI32 ref: 00007FF61DD8D42C

Part of subcall function 00007FF61DD9E9A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9E9C4

Part of subcall function 00007FF61DD9E880: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9E8A2

Strings

SOFTWARE\TFTPD32, xrefs: 00007FF61DD8D41E
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD8D40A
restore default settings, xrefs: 00007FF61DD8D3FE

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Delete_invalid_parameter_noinfo$CurrentDebugOutputStringThread
String ID: SOFTWARE\TFTPD32$SOFTWARE\TFTPD32\DHCP$restore default settings
API String ID: 2984085891-781422392
Opcode ID: 88958107ffcbfa43270d9edc5230adf5a7cfc81cf94d4e9e5c5fb5f58355e6a5
Instruction ID: 8a35b4c4097119226ad0c4fabf9d15f62e080db08965e0dfe251aa25553db464
Opcode Fuzzy Hash: 88958107ffcbfa43270d9edc5230adf5a7cfc81cf94d4e9e5c5fb5f58355e6a5
Instruction Fuzzy Hash: 90015625E18D4A98FB11DB65E8112B82324AF45FB8F905332DD1D832D5EF3DE446D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8F790, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30synchronizationsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,00000001,00007FF61DD8746B), ref: 00007FF61DD8F7B6
WaitForSingleObject.KERNEL32(?,?,00000001,00007FF61DD8746B), ref: 00007FF61DD8F7C4
ReleaseMutex.KERNEL32(?,?,00000001,00007FF61DD8746B), ref: 00007FF61DD8F7F0

Part of subcall function 00007FF61DD9F17C: _set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

Strings

C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c, xrefs: 00007FF61DD8F7D4
Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD8F7DB

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: MutexObjectReleaseSingleSleepWait_set_error_mode
String ID: C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c$Rc==WAIT_OBJECT_0
API String ID: 1893696194-3943162538
Opcode ID: b1af5233d81499bb0c6313b592431cb56dd04cc15bef264c2f7b1e540146840e
Instruction ID: c8afbc0ec50fb1e6dc793d4f3c233da2feca05b498733be31d6475f6a592d017
Opcode Fuzzy Hash: b1af5233d81499bb0c6313b592431cb56dd04cc15bef264c2f7b1e540146840e
Instruction Fuzzy Hash: D9011E22E14E4A81FA119B25E8457766360FB85FA4F545335D79E876A4EF3CE441C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD92A38, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF61DD92A54
GetProcAddress.KERNEL32 ref: 00007FF61DD92A6A
FreeLibrary.KERNEL32 ref: 00007FF61DD92A87

Strings

mscoree.dll, xrefs: 00007FF61DD92A4B
CorExitProcess, xrefs: 00007FF61DD92A63

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c18b25283c5fdd6101e470345d29259ecda0bb84b7aacc2f6f0290e803425300
Instruction ID: a3cd3fe107a904df31da1db37c9fab10afe204330ea7374f80a5681e0115a886
Opcode Fuzzy Hash: c18b25283c5fdd6101e470345d29259ecda0bb84b7aacc2f6f0290e803425300
Instruction Fuzzy Hash: 9BF05462F19E4A81EB685F60E8D43752764AF49FA8F445339D40FC66A4EF3CD488C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD84C40, Relevance: 7.6, APIs: 5, Instructions: 143networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32 ref: 00007FF61DD84CF5
SetLastError.KERNEL32 ref: 00007FF61DD84D05
WSAGetLastError.WS2_32 ref: 00007FF61DD84D72

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLast$Ioctl
String ID:
API String ID: 431296074-0
Opcode ID: ce816586932219f2ecb09d3f4b90984025f735220a9ac7d6e896cccf17ddb434
Instruction ID: 2565a34da3722147612f71cb91cc38e397432d44520d69e3744ded7c671c6143
Opcode Fuzzy Hash: ce816586932219f2ecb09d3f4b90984025f735220a9ac7d6e896cccf17ddb434
Instruction Fuzzy Hash: 9C619172E08B8586EB21CF65E4406AD77A1FB84BA8F144339DA5D87B94EF3CE545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8AD30, Relevance: 7.6, APIs: 5, Instructions: 63networkstringCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF61DD8AD67
htons.WS2_32 ref: 00007FF61DD8AD74
lstrcpyA.KERNEL32(?,?,?,00007FF61DD8AC72), ref: 00007FF61DD8ADC2
lstrlenA.KERNEL32(?,?,?,00007FF61DD8AC72), ref: 00007FF61DD8ADCC
send.WS2_32 ref: 00007FF61DD8ADEC

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: htons$lstrcpylstrlensend
String ID:
API String ID: 71767863-0
Opcode ID: 2329f00d339e044810c41bc6a5c14cb72a7980ef8ba30821172b1dd14547d224
Instruction ID: aca7cf92b10948697f226ca2aa019d2b9c8006e02681731ad124b701e5df75af
Opcode Fuzzy Hash: 2329f00d339e044810c41bc6a5c14cb72a7980ef8ba30821172b1dd14547d224
Instruction Fuzzy Hash: 29214422B14E4686EB518F39E48016D77A0FB45BA9B146339EA5EC76A8FF38D4508700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDB02C4, Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF61DDB02EC
_set_statfp.LIBCMT ref: 00007FF61DDB0307
_set_statfp.LIBCMT ref: 00007FF61DDB0323
_set_statfp.LIBCMT ref: 00007FF61DDB035F

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction ID: 9c17c7de8c4268cfdafe5c85964f3fa22aaf85650f02195c99be1b19bf64180d
Opcode Fuzzy Hash: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction Fuzzy Hash: AE114F22E5CE3B42F6741528E54937D10506F5BF7CE44C734EA7E8A7E6EE2CA9414300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD863E0, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 00007FF61DD86419
lstrcpyA.KERNEL32 ref: 00007FF61DD86441
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF61DD87974), ref: 00007FF61DD864A7

Strings

SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD8640F
Lease_NumLeases, xrefs: 00007FF61DD86437

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: lstrcpy
String ID: Lease_NumLeases$SOFTWARE\TFTPD32\DHCP
API String ID: 3722407311-3429096845
Opcode ID: 9450e23f99bd0aa198855aa32b36cbde403857eee9072f6926b07b31b685b684
Instruction ID: f35d8946b8502510194b57675edb083a9f7cfc255d54c3cd59dfb1c38e6c4031
Opcode Fuzzy Hash: 9450e23f99bd0aa198855aa32b36cbde403857eee9072f6926b07b31b685b684
Instruction Fuzzy Hash: D2215974D0EF4A92EE15DB14E45027922A4AF84F74F445738E65D863C1FE7CE044CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA5C00, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA5EA9

Part of subcall function 00007FF61DDACE28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDACE45

Strings

UTF-16LEUNICODE, xrefs: 00007FF61DDA5E4D
UTF-8, xrefs: 00007FF61DDA5E2C
ccs, xrefs: 00007FF61DDA5DF5

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: a21f786edc4389317a1608b944f782c8653ecd4359a6744fb074c5c302ac4db7
Instruction ID: 230020f9c981f7a0fa2f0dbb1283f88933c0763210e9a12102ed45d430ccbcb4
Opcode Fuzzy Hash: a21f786edc4389317a1608b944f782c8653ecd4359a6744fb074c5c302ac4db7
Instruction Fuzzy Hash: D981D572D0CA8A89FFB58A6885483392B909B16F78F95D635C60AC31F8FF1DB9018301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD93DDC, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD93E08
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD93E3A

Strings

, xrefs: 00007FF61DD93F8D
*, xrefs: 00007FF61DD93F38

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 5ef8426ab6bd8e833a10324dd68a95dd9bf863965a021dbda539ed56aa46eae3
Instruction ID: afa6418d48f64d61e7a9aedd44cbead3780529d0e97c9028c5b00f94eb576996
Opcode Fuzzy Hash: 5ef8426ab6bd8e833a10324dd68a95dd9bf863965a021dbda539ed56aa46eae3
Instruction Fuzzy Hash: 8B614572D0CA4A86EB6C9E28806527C3BB1EB15F68F142335D64A852DDEF3AE449C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9420C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD94241
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD9440D

Strings

*, xrefs: 00007FF61DD94341
, xrefs: 00007FF61DD94396

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 65cd5bd468c6c4199e23853e1c7ffbc6fafd7dc1606ec754e945b314127f3548
Instruction ID: 76899a615e1fdbc92c8c3515d32a6b60ead5cdea5020d0691f95cdbccb60cf6b
Opcode Fuzzy Hash: 65cd5bd468c6c4199e23853e1c7ffbc6fafd7dc1606ec754e945b314127f3548
Instruction Fuzzy Hash: E9615272D4CA4E86E76C9E34816537C37A0FB45F69F141335CA4A822DAEF6AE481C708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA3DB8, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDA3DFB

Strings

-, xrefs: 00007FF61DDA3EF2
e+000, xrefs: 00007FF61DDA3EA0
gfff, xrefs: 00007FF61DDA3F1D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: bc7dc4fa0e8b2f60e11a4794f47deb6f5c527a521627f7a4bebf841baffbb6b9
Instruction ID: 04ae62584b87e2b794df630b4c24b4deded5635eef14f5e18b86b0c746edad49
Opcode Fuzzy Hash: bc7dc4fa0e8b2f60e11a4794f47deb6f5c527a521627f7a4bebf841baffbb6b9
Instruction Fuzzy Hash: F4511762F18BCA46E7258B799841369AB92E741FA0F48D331D79C87AE5EF7CD444C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD81360, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32 ref: 00007FF61DD813C9

Part of subcall function 00007FF61DD815B0: GetLastError.KERNEL32 ref: 00007FF61DD815E3
Part of subcall function 00007FF61DD815B0: RegisterEventSourceA.ADVAPI32 ref: 00007FF61DD815F8
Part of subcall function 00007FF61DD815B0: ReportEventA.ADVAPI32 ref: 00007FF61DD81667
Part of subcall function 00007FF61DD815B0: DeregisterEventSource.ADVAPI32 ref: 00007FF61DD81670

SetServiceStatus.ADVAPI32 ref: 00007FF61DD8149D

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

Strings

reporting service status %d, xrefs: 00007FF61DD81391, 00007FF61DD81483
SetServiceStatus, xrefs: 00007FF61DD813D3, 00007FF61DD814A9

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Event$ServiceSourceStatus$CurrentDebugDeregisterErrorLastOutputRegisterReportStringThread
String ID: SetServiceStatus$reporting service status %d
API String ID: 930536559-3563048423
Opcode ID: adc96c25b224bd91fe4a463eb85d8da6706e92aab44e8f4eb8b79f260d3b37e0
Instruction ID: e2c5863dfc1a389f9d459ba12aa5dd0ff19e8303319dca51a35500870ad47dff
Opcode Fuzzy Hash: adc96c25b224bd91fe4a463eb85d8da6706e92aab44e8f4eb8b79f260d3b37e0
Instruction Fuzzy Hash: A8414EB0E09D0E8AFB259F25A89017537E4FF0AB65F506339C40DC26A4FE3CB4499B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8F6A8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,00007FF61DD88547), ref: 00007FF61DD8F6EE
ReleaseMutex.KERNEL32(?,?,?,00007FF61DD88547), ref: 00007FF61DD8F738

Strings

Rc==WAIT_OBJECT_0, xrefs: 00007FF61DD8F705
C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c, xrefs: 00007FF61DD8F6FE

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait
String ID: C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c$Rc==WAIT_OBJECT_0
API String ID: 2017088797-3943162538
Opcode ID: 2cc4fd6bf76c2a977022f8d7af0e5260aed5c66824c7bfeaaee586f32f43d3dd
Instruction ID: 82e3cb4f5f2dca23ec8ad806cf7d8302bf9694eba6af72dc5c41a2cd9b8c4f2a
Opcode Fuzzy Hash: 2cc4fd6bf76c2a977022f8d7af0e5260aed5c66824c7bfeaaee586f32f43d3dd
Instruction Fuzzy Hash: 4C210836E18E4A92EA019F22D98473AB3A4FB54FE0F159231EA5C87794EF38D441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8AF90, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF61DD8B002
GetLastError.KERNEL32 ref: 00007FF61DD8B01D

Strings

select, xrefs: 00007FF61DD8B039
File <%s> : error %d in system call %s %s, xrefs: 00007FF61DD8B032

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLastselect
String ID: File <%s> : error %d in system call %s %s$select
API String ID: 215497628-693340174
Opcode ID: da40d1d4cd19d7843acc4ff8239e545b65b31dc7fb5742ba89f5825a591da377
Instruction ID: a41c3be23ff9aa3ad3bccc9d3ba37908ab42fd60de57e44f1599d870309366e4
Opcode Fuzzy Hash: da40d1d4cd19d7843acc4ff8239e545b65b31dc7fb5742ba89f5825a591da377
Instruction Fuzzy Hash: C1218372E0CE4986EB609B24F4857AA73A0FB49B68F502335E64DC7B94EF3DD0458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD829B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00007FF61DD82A14
inet_addr.WS2_32 ref: 00007FF61DD82A76

Strings

%02X%c, xrefs: 00007FF61DD82A04
SOFTWARE\TFTPD32\DHCP, xrefs: 00007FF61DD82A52

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: inet_addrwsprintf
String ID: %02X%c$SOFTWARE\TFTPD32\DHCP
API String ID: 597441753-3735375762
Opcode ID: cc5fc33d7c265ad075578086e2cc20ed77ec45607b11ab1b54b9b2edfff40000
Instruction ID: 2f42d3dffee3399eb3da1867015c53ad9cea4d8135226c1a26dc217e6330f169
Opcode Fuzzy Hash: cc5fc33d7c265ad075578086e2cc20ed77ec45607b11ab1b54b9b2edfff40000
Instruction Fuzzy Hash: 47219531E0CE8691EB21DB15E45026977A1EB85F64F945236EA8C837A4EF3DD146CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD88500, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF61DD8852C
Sleep.KERNEL32 ref: 00007FF61DD88537
ResetEvent.KERNEL32 ref: 00007FF61DD885B8

Part of subcall function 00007FF61DD8F2E8: CreateFileA.KERNEL32 ref: 00007FF61DD8F344
Part of subcall function 00007FF61DD8F2E8: CloseHandle.KERNEL32 ref: 00007FF61DD8F353
Part of subcall function 00007FF61DD8F2E8: lstrcpyA.KERNEL32 ref: 00007FF61DD8F374
Part of subcall function 00007FF61DD8F2E8: wsprintfA.USER32 ref: 00007FF61DD8F3A1
Part of subcall function 00007FF61DD8F2E8: WritePrivateProfileStringA.KERNEL32 ref: 00007FF61DD8F3BF

Strings

end of registry thread, xrefs: 00007FF61DD885D5

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CloseCreateEventFileHandleObjectPrivateProfileResetSingleSleepStringWaitWritelstrcpywsprintf
String ID: end of registry thread
API String ID: 1102736310-994001429
Opcode ID: c045bd88e43dc2356f1f3cf4ff3f8147309574c8ed76e9bba898cc3ab5138773
Instruction ID: 997d4d51b8398d2d03698a674e84323abc9eeae76500c8591e5f34d778865f50
Opcode Fuzzy Hash: c045bd88e43dc2356f1f3cf4ff3f8147309574c8ed76e9bba898cc3ab5138773
Instruction Fuzzy Hash: 12212F65E09E0A82FB05AB35E4112796365AF84F64F101335DA0D873D6FE6CE840C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA26FC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA272F
try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2756

Part of subcall function 00007FF61DDA1DC4: GetProcAddress.KERNEL32(?,?,00000006,00007FF61DDA22FA,?,?,?,00007FF61DDA3822,?,?,?,00007FF61DDA1CF5), ref: 00007FF61DDA1F1C

Strings

GetUserObjectInformationW, xrefs: 00007FF61DDA273C, 00007FF61DDA274F
GetProcessWindowStation, xrefs: 00007FF61DDA2715, 00007FF61DDA2728

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: GetProcessWindowStation$GetUserObjectInformationW
API String ID: 1640347226-2732317663
Opcode ID: fc98bd3c5ae51aae6332c417a22e613e810639b1f502bf61c9ea32fea35456aa
Instruction ID: 389348da48fc51de12591e887718375377ca9b7599607ba6d537ec4eb4c6b574
Opcode Fuzzy Hash: fc98bd3c5ae51aae6332c417a22e613e810639b1f502bf61c9ea32fea35456aa
Instruction Fuzzy Hash: D9119031E18F8A91EA408B25E8502B527A0AF45FB4F44973AD94D867A4EF3DE505C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA2650, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2670
try_get_function.LIBVCRUNTIME ref: 00007FF61DDA26A2

Part of subcall function 00007FF61DDA1DC4: GetProcAddress.KERNEL32(?,?,00000006,00007FF61DDA22FA,?,?,?,00007FF61DDA3822,?,?,?,00007FF61DDA1CF5), ref: 00007FF61DDA1F1C

Strings

GetLastActivePopup, xrefs: 00007FF61DDA2688, 00007FF61DDA269B
GetActiveWindow, xrefs: 00007FF61DDA2656, 00007FF61DDA2669

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: GetActiveWindow$GetLastActivePopup
API String ID: 1640347226-3742175580
Opcode ID: a2cec305deb224cfa07a0a3112e47bd21f3a9ff59c27ac35af88caec3b02d38f
Instruction ID: 354457c2e1c047fa32eeae88bb44a4fd48696e591033184d2c20f24471d0aa72
Opcode Fuzzy Hash: a2cec305deb224cfa07a0a3112e47bd21f3a9ff59c27ac35af88caec3b02d38f
Instruction Fuzzy Hash: 10F0F950E1AE0F92FE54AB6198502B01290AF49FA8F8C9A35CD0C863F1FE3CB585D350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA25E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2610
try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2632

Part of subcall function 00007FF61DDA1DC4: GetProcAddress.KERNEL32(?,?,00000006,00007FF61DDA22FA,?,?,?,00007FF61DDA3822,?,?,?,00007FF61DDA1CF5), ref: 00007FF61DDA1F1C

Strings

MessageBoxW, xrefs: 00007FF61DDA261A, 00007FF61DDA2628
MessageBoxA, xrefs: 00007FF61DDA25F8, 00007FF61DDA2606

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: MessageBoxA$MessageBoxW
API String ID: 1640347226-1053882329
Opcode ID: 49d7eef0ceff0c80d532de6265c1862a127f58b46a82c3492ed624aee4082e94
Instruction ID: fc1bd0649de6a13970715864ccf047cc2b9e0385233bb3d8d74dbda1c0df93cf
Opcode Fuzzy Hash: 49d7eef0ceff0c80d532de6265c1862a127f58b46a82c3492ed624aee4082e94
Instruction Fuzzy Hash: 13F03161D08A8FA5EB049FB0E8814E42351EB01B68B889337D94C821B5EE7CF949D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA79B4, Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF61DDA7AA1
_get_daylight.LIBCMT ref: 00007FF61DDA7AB2
_get_daylight.LIBCMT ref: 00007FF61DDA7AC3
_isindst.LIBCMT ref: 00007FF61DDA7B89

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: b08e8ab649710f0702bf84911307a1dd81953373b0fd9c98fd1fd8c5d17ca81d
Instruction ID: 4d84beb1ac6a6394e0018a307eebe84a2b2835d50cb29ae1a4484f307e5e19b5
Opcode Fuzzy Hash: b08e8ab649710f0702bf84911307a1dd81953373b0fd9c98fd1fd8c5d17ca81d
Instruction Fuzzy Hash: E25107B3F0491A9AFF14CB74D9916BC2765AB407A8F518236DD1E97AE5EF38F8018700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAD2AC, Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAD2ED
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAD36D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDAD3C1
_get_daylight.LIBCMT ref: 00007FF61DDAD419

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 0a488fbf64944a83cc79d370c135f4718d5e10afa6a2dfeed06ede88d5b27c7d
Instruction ID: ef4010ac7887877d792b022c4fef051e2cc32d9a5dcd1bffae280f741028fc9f
Opcode Fuzzy Hash: 0a488fbf64944a83cc79d370c135f4718d5e10afa6a2dfeed06ede88d5b27c7d
Instruction Fuzzy Hash: 6951AC32E08E0B87F7695A2C94153BD6690AB40F74F19C735DA19C62FAFE6CE9408742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9FC9C, Relevance: 6.1, APIs: 4, Instructions: 117pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF61DD9FCCF
GetFileInformationByHandle.KERNEL32 ref: 00007FF61DD9FD2C
GetLastError.KERNEL32 ref: 00007FF61DD9FDBD
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000030,00000000,?,00007FF61DD9FBC0), ref: 00007FF61DD9FE09

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 77d47b62fd6710c42dee886b01f3abeb13cf0632083838cab8b6c90503807202
Instruction ID: 818e7e9ce737934758aa9956496164b72236a1dae2aa0bb2205815afa9b461df
Opcode Fuzzy Hash: 77d47b62fd6710c42dee886b01f3abeb13cf0632083838cab8b6c90503807202
Instruction Fuzzy Hash: DE416B27E08A0A8AFB18DFB1D4613BD33A1AB44FA8F148635DE0987699EF39D4518740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD834AD, Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF61DD834CA
inet_addr.WS2_32 ref: 00007FF61DD834F0
inet_addr.WS2_32 ref: 00007FF61DD83529
inet_addr.WS2_32 ref: 00007FF61DD8353C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: inet_addr
String ID:
API String ID: 1393076350-0
Opcode ID: a078aac8d55924c3de4226ddff689d1970830b88aa7adcf1b6a59b7b364b94c5
Instruction ID: 82ec2c2a87be7559a8b0c2c96c59d1d0b75696444a857da49c5d66eb8de7d047
Opcode Fuzzy Hash: a078aac8d55924c3de4226ddff689d1970830b88aa7adcf1b6a59b7b364b94c5
Instruction Fuzzy Hash: B8315061F08E4A86FB16CF68A95037926909B40F74F045335CA6EC66E1FE7CE845D344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD835F9, Relevance: 6.1, APIs: 4, Instructions: 64filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD861D0: lstrcpynA.KERNEL32 ref: 00007FF61DD86235
Part of subcall function 00007FF61DD861D0: inet_ntoa.WS2_32 ref: 00007FF61DD8623D
Part of subcall function 00007FF61DD861D0: lstrcatA.KERNEL32 ref: 00007FF61DD8624B
Part of subcall function 00007FF61DD861D0: lstrcatA.KERNEL32 ref: 00007FF61DD8631E
Part of subcall function 00007FF61DD861D0: lstrcpynA.KERNEL32 ref: 00007FF61DD86332

CreateFileA.KERNEL32 ref: 00007FF61DD83642
GetFileSize.KERNEL32 ref: 00007FF61DD8365F
htons.WS2_32 ref: 00007FF61DD8366B
CloseHandle.KERNEL32 ref: 00007FF61DD8367C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Filelstrcatlstrcpyn$CloseCreateHandleSizehtonsinet_ntoa
String ID:
API String ID: 1366628434-0
Opcode ID: fc7c5d4f3b5a6144c3a7082b009791548ac2e142792e7d2fcd12e3acd55ec5e3
Instruction ID: a76bde8fd280a28343e100866a9f800d1f0226712bf5b04d501f6106a2db205c
Opcode Fuzzy Hash: fc7c5d4f3b5a6144c3a7082b009791548ac2e142792e7d2fcd12e3acd55ec5e3
Instruction Fuzzy Hash: 8E219421E08D4A81EB15CF24E8143B92360EB80B79F005335DA5E876E4FF3CE446C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8E5E4, Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF61DD8E61D

Part of subcall function 00007FF61DD8EB04: DestroyIcon.USER32(?,?,?,00007FF61DD8E649), ref: 00007FF61DD8EB34
Part of subcall function 00007FF61DD8EB04: DestroyWindow.USER32(?,?,?,00007FF61DD8E649), ref: 00007FF61DD8EB43
Part of subcall function 00007FF61DD8EB04: DestroyWindow.USER32(?,?,?,00007FF61DD8E649), ref: 00007FF61DD8EB82

GetDC.USER32 ref: 00007FF61DD8E650
DrawIcon.USER32 ref: 00007FF61DD8E66B
ReleaseDC.USER32 ref: 00007FF61DD8E677

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Destroy$IconWindow$DialogDrawRelease
String ID:
API String ID: 1760091040-0
Opcode ID: 120f45886502cb2a6b661bf6c2c03b81e7e0b769d80ddc5e54d3c0ce54a1a1fe
Instruction ID: a8ecb37e364f4633fba6f27dad73c09853683e6eff3617c91f5b1261298b9c50
Opcode Fuzzy Hash: 120f45886502cb2a6b661bf6c2c03b81e7e0b769d80ddc5e54d3c0ce54a1a1fe
Instruction Fuzzy Hash: 7301A161E0CD0E81EA139B2299491B912A2AF4DFE0F009735C80EC7799FD2DE0489B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8E410, Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF61DD8E425
closesocket.WS2_32 ref: 00007FF61DD8E436
freeaddrinfo.WS2_32 ref: 00007FF61DD8E444
SetLastError.KERNEL32 ref: 00007FF61DD8E44C

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorLast$closesocketfreeaddrinfo
String ID:
API String ID: 80054576-0
Opcode ID: 655ee11370c103ccde0328ff2980669b9d59a2643b629ead60ae495e4e7609f6
Instruction ID: 2a5f719db3b8fc6d0967f0c6c700748f5a58520b7c5411ee2aa77169b7125b73
Opcode Fuzzy Hash: 655ee11370c103ccde0328ff2980669b9d59a2643b629ead60ae495e4e7609f6
Instruction Fuzzy Hash: 5AF03021F18E8682EA145B35F9444396365AF4AFF4B5C9330EA7E877E4EF2CD4968700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD94684, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD946BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DD948F6

Strings

*, xrefs: 00007FF61DD947C9

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 06c5a9e7a25d0447302b4e1feba016f2bf581ddea531111f2311e3e72ad67fd1
Instruction ID: 70bf95a4f6ef0021ad07462fbf1146d0498429b133b54a0ae5758f2012049534
Opcode Fuzzy Hash: 06c5a9e7a25d0447302b4e1feba016f2bf581ddea531111f2311e3e72ad67fd1
Instruction Fuzzy Hash: 4A71A772D0DA5AC6E76C8F28806007C37A0FB45F68F141336DA49C229AFF7AD481D758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD905BC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112timenetworkCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF61DD905F4
WSAGetLastError.WS2_32 ref: 00007FF61DD90662

Part of subcall function 00007FF61DD90734: lstrlenA.KERNEL32 ref: 00007FF61DD90758

Part of subcall function 00007FF61DD8E260: htons.WS2_32 ref: 00007FF61DD8E284

Part of subcall function 00007FF61DD8E344: htons.WS2_32 ref: 00007FF61DD8E39E

Strings

Error %d receiving on socket %d, xrefs: 00007FF61DD9066B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Timehtons$ErrorFileLastSystemlstrlen
String ID: Error %d receiving on socket %d
API String ID: 3937490843-910186022
Opcode ID: c44a6e81dee25f9f7251bb28df821808ecb9a2a6515d107a357bc6f8a3d92f74
Instruction ID: 5f79576da070255edb4f8456b0d59ae6c9562fe1c792bc3c23cfe258a2985fc0
Opcode Fuzzy Hash: c44a6e81dee25f9f7251bb28df821808ecb9a2a6515d107a357bc6f8a3d92f74
Instruction Fuzzy Hash: 7841B422F08A699AF714DB75E451AFC2361AB44BB8F404334EE1DD7AC5EE39E50AD700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDAA978, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF61DDAAA8F
GetLastError.KERNEL32 ref: 00007FF61DDAAAB1

Strings

U, xrefs: 00007FF61DDAAA3B

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a1d1b92ea24507794c0b389abaae95294f8100e103a16f9f872406f305504655
Instruction ID: 701c109b4e77c86ee8b937f30c73bdec1c9437e67b0fe3b0999ab81317fc13f9
Opcode Fuzzy Hash: a1d1b92ea24507794c0b389abaae95294f8100e103a16f9f872406f305504655
Instruction Fuzzy Hash: 3C41A332B19E9585DB208F25E4443AA67A0FB88BA4F849235EE4DC7798EF3CD441CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA6E7C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF61DDA6EBC
GetCurrentDirectoryW.KERNEL32 ref: 00007FF61DDA6F0F

Strings

:, xrefs: 00007FF61DDA6ED5

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8f702a23c76295a5152a25fbabd09494252dd11dc49d9125727849de83ddd3c
Instruction ID: f63874ae8cab991959d421c04893ecbf62e2e179b5332e287d9ac91e09ade9fa
Opcode Fuzzy Hash: e8f702a23c76295a5152a25fbabd09494252dd11dc49d9125727849de83ddd3c
Instruction Fuzzy Hash: AB219126E08E4AC1FB209B61D04427963A5EB84FA4F85C335DA5C87694EF7CE985C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD9F17C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF61DD9F1A3

Strings

C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c, xrefs: 00007FF61DD9F201
pmsg != NULL, xrefs: 00007FF61DD9F200

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _set_error_mode
String ID: C:\Users\ark\source\repos\tftpd64\src\_libs\linked_list\linked_list.c$pmsg != NULL
API String ID: 1949149715-3902498152
Opcode ID: 8c2a3c10a0ccb831a711b4ff7c9f30015e6e588bd4d151ed9493dac1814a35c7
Instruction ID: a895735d24cd215fde49d4f5acff38c1361ca81f68c74b0c9fc9097adb20731e
Opcode Fuzzy Hash: 8c2a3c10a0ccb831a711b4ff7c9f30015e6e588bd4d151ed9493dac1814a35c7
Instruction Fuzzy Hash: 7D110672F18F5581E7289B12A950069A664EB84FE0F184231EF4C83FA5DE3DD591C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD8BD60, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF61DD8E468: GetCurrentThreadId.KERNEL32 ref: 00007FF61DD8E4A0
Part of subcall function 00007FF61DD8E468: OutputDebugStringA.KERNEL32 ref: 00007FF61DD8E4FA

htons.WS2_32 ref: 00007FF61DD8BD9B
lstrcpyA.KERNEL32 ref: 00007FF61DD8BE4F

Strings

starting transfer %d, xrefs: 00007FF61DD8BD81

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadhtonslstrcpy
String ID: starting transfer %d
API String ID: 2739088543-2691431343
Opcode ID: c8e799b20c985402c1f6ff69904786c3d3dcece4450b9835f4e9b3fdbfd7caec
Instruction ID: 6457c1efde440865ca195695aba285811c6e6d7aad07f043867326348cfb0261
Opcode Fuzzy Hash: c8e799b20c985402c1f6ff69904786c3d3dcece4450b9835f4e9b3fdbfd7caec
Instruction Fuzzy Hash: 6B310E62D08AC481E3224F38E4027E97374FF99B59F44A231EF8816157FF39A1D58B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA2118, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2151
CompareStringW.KERNEL32 ref: 00007FF61DDA21D9

Strings

CompareStringEx, xrefs: 00007FF61DDA2134, 00007FF61DDA2145

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: 584e1ecb451b6092604f3fb7adedb1ada995e76114d0efe26108b8225a8508d5
Instruction ID: 97d1c08530820c6237305e4d0abae7072e6c41ed126c6ef55df83307ed82616b
Opcode Fuzzy Hash: 584e1ecb451b6092604f3fb7adedb1ada995e76114d0efe26108b8225a8508d5
Instruction Fuzzy Hash: B2111F36A08F8586D760CB16F4402AAB7A4FBC9BD4F548236EE8D83B59DF3CD5408B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA23CC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2405
LCMapStringW.KERNEL32 ref: 00007FF61DDA248D

Strings

LCMapStringEx, xrefs: 00007FF61DDA23E8, 00007FF61DDA23F9

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: f185d12321e6d03a235d4bdfaf62f452b7bce42f0c62123bc19f37e38a338651
Instruction ID: 8f26cea7764096f425084d1c70776ba51ee8d40cc8e598984f41b16a89e58f17
Opcode Fuzzy Hash: f185d12321e6d03a235d4bdfaf62f452b7bce42f0c62123bc19f37e38a338651
Instruction Fuzzy Hash: 94110E36A08B8586D760CB56F4402AAB7A5FBC9FD4F548236EE8D83B59DF3CD4448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDADC30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF61DDADC60

Strings

:, xrefs: 00007FF61DDADC78

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: d55ce9f59378acb66b0218760885dca6f03beb653127901273080f1e1300c9a7
Instruction ID: f5f80b567e8c28282c4aac753444fe306f2be36e01e306ac5fe504a2f3851252
Opcode Fuzzy Hash: d55ce9f59378acb66b0218760885dca6f03beb653127901273080f1e1300c9a7
Instruction Fuzzy Hash: 5F01D661D1CA0A82F720AF60985127E73A0EF48FA4F815735D54DC66A5FF3CE5448B18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA2368, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA2399
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF61DDA5BCA,?,?,?,00007FF61DDA5AC2,?,?,00000080,00007FF61DD9E949), ref: 00007FF61DDA23B3

Strings

InitializeCriticalSectionEx, xrefs: 00007FF61DDA237A, 00007FF61DDA238D

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: f8faebe83fde4d38670ade666f166a85684692ec5c9c026194eb5361ee577ab8
Instruction ID: aeb369b3329114680abf9d2b12cfd3e571cf7c8641143e6f83f07d9a756663d9
Opcode Fuzzy Hash: f8faebe83fde4d38670ade666f166a85684692ec5c9c026194eb5361ee577ab8
Instruction Fuzzy Hash: 8BF0B421E18E9981EB048B51E8404A43661AF49FE0F48D336DD0E43794EE7CE844C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DD92648, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DD92671
TlsSetValue.KERNEL32(?,?,?,00007FF61DD9231D,?,?,?,?,00007FF61DD921A4,?,?,?,?,00007FF61DD90DF3), ref: 00007FF61DD92688

Strings

FlsSetValue, xrefs: 00007FF61DD92655, 00007FF61DD9265E

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: bb2f03fbf2354a29de0b1393cb2f432b1aa366f109832d4e5a9fcde2e3f75e65
Instruction ID: e0d151ec469a94a828bd757e9ed78ed0d597d4a04404fa59b156aaf429120624
Opcode Fuzzy Hash: bb2f03fbf2354a29de0b1393cb2f432b1aa366f109832d4e5a9fcde2e3f75e65
Instruction Fuzzy Hash: 1DE06561E19D4A92EB084F60F8500B46221AF48FF4F988335D91D862D4EE3CD444C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA22CC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA22F5
TlsSetValue.KERNEL32(?,?,?,00007FF61DDA3822,?,?,?,00007FF61DDA1CF5,?,?,?,?,00007FF61DD96FA3), ref: 00007FF61DDA230C

Strings

FlsSetValue, xrefs: 00007FF61DDA22D9, 00007FF61DDA22E2

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 28a9a9b3b772d9c0c78880d7300bfe6987b032711848728981982c3737c35a2b
Instruction ID: c92ac1d4a2caf16e4acd8efde03a57f1d669463ed87dd35b0d34deeb8152b65a
Opcode Fuzzy Hash: 28a9a9b3b772d9c0c78880d7300bfe6987b032711848728981982c3737c35a2b
Instruction Fuzzy Hash: 5DE06561E1CD4AD1EE044B61E8400B42221AF49FE4F48D735D91D862E4EE3CE455C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF61DDA24A8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF61DDA24D1
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00007FF61DDA24E8

Strings

LocaleNameToLCID, xrefs: 00007FF61DDA24B4, 00007FF61DDA24BE

Memory Dump Source

Source File: 00000000.00000002.263196757.00007FF61DD81000.00000020.00020000.sdmp, Offset: 00007FF61DD80000, based on PE: true

Associated: 00000000.00000002.263192905.00007FF61DD80000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263217249.00007FF61DDB1000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.263228114.00007FF61DDC1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263232517.00007FF61DDC2000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.263236145.00007FF61DDC3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.263240782.00007FF61DDCE000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff61dd80000_tftpd64_svc.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: a30bbcd7df7678d83c040fb0a688a04864384833ec0656cfb52ae65649c74f5a
Instruction ID: 9eb90edef5cc429a554432fd54308dd85254191be8139bfb8e77f5c07d062aac
Opcode Fuzzy Hash: a30bbcd7df7678d83c040fb0a688a04864384833ec0656cfb52ae65649c74f5a
Instruction Fuzzy Hash: 86E09221E0CD4BD2FE149BA5F8400F92221AF89FA4F58D332D90D462E1EE7CE845D300

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report tftpd64_svc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Boot Survival:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: tftpd64_svc.exe PID: 2588 Parent PID: 6136

General

Chronological Activities

Analysis Process: conhost.exe PID: 1544 Parent PID: 2588

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: tftpd64_svc.exe PID: 2588 Parent PID: 6136 tftpd64_svc.exeCOMMON

Function 00007FF61DD816A0, Relevance: 100.0, APIs: 28, Strings: 29, Instructions: 240
servicesleepstringCOMMON

Function 00007FF61DD90B68, Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Function 00007FF61DD815B0, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47
registryCOMMON

Function 00007FF61DD90B84, Relevance: 9.1, APIs: 6, Instructions: 94
COMMON

Function 00007FF61DDAABD4, Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Function 00007FF61DD90AA0, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Function 00007FF61DD8E468, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
threadCOMMON

Function 00007FF61DD929EC, Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Function 00007FF61DDA1F9C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Function 00007FF61DDA90A0, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Function 00007FF61DDAA758, Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Function 00007FF61DDA2D40, Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 00007FF61DDAAAE8, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 00007FF61DD92930, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Function 00007FF61DD96F78, Relevance: 1.5, APIs: 1, Instructions: 38
COMMON