Edit tour

Windows Analysis Report
systemConfigChecker.exe

Overview

General Information

Sample name:	systemConfigChecker.exe
Analysis ID:	1569875
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate network shares

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Detected potential crypto function

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Classification

Process Tree

System is w10x64

systemConfigChecker.exe (PID: 6176 cmdline: "C:\Users\user\Desktop\systemConfigChecker.exe" MD5: 218954F9DD70247E51AF8A30940D5C33)

conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: systemConfigChecker.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: systemConfigChecker.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: systemConfigChecker.exe

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF6B2703CD0 memset,NetUserEnum,NetApiBufferFree,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF6B2703CD0

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP/1.0Host: api.ipify.org

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /userdata HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WebKitFormBoundaryUser-Agent: WinHTTP/1.0Content-Length: 96727Host: 185.237.165.97

Source: systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/
Source: systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/twO
Source: systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/usdrdata
Source: systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/usdrdata_
Source: systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01F5000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1307992622.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata
Source: systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01F5000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1307992622.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata_
Source: systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97:80/userdata
Source: systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD019C000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01C8000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1276079294.0000016BD01C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:80/

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B2705D80	0_2_00007FF6B2705D80
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B2701B50	0_2_00007FF6B2701B50
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B2704E50	0_2_00007FF6B2704E50
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B2704A40	0_2_00007FF6B2704A40
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B2705510	0_2_00007FF6B2705510

Source: classification engine

Classification label: mal52.spyw.winEXE@2/1@1/2

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF6B2703780 GetLogicalDrives,memset,GetDiskFreeSpaceExA,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF6B2703780

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5940:120:WilError_03

Source: systemConfigChecker.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: systemConfigChecker.exe, 00000000.00000003.1281009929.0000016BD0254000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1281170793.0000016BD0224000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1281009929.0000016BD0239000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280743765.0000016BD0218000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280743765.0000016BD022E000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280468321.0000016BD0223000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1281009929.0000016BD024A000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1281305566.0000016BD0217000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\systemConfigChecker.exe "C:\Users\user\Desktop\systemConfigChecker.exe"
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: systemConfigChecker.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: systemConfigChecker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: systemConfigChecker.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: systemConfigChecker.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: systemConfigChecker.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: systemConfigChecker.exe

Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: systemConfigChecker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF6B2703AA0

Source: C:\Users\user\Desktop\systemConfigChecker.exe TID: 4048

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF6B2703560 GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF6B2703560

Source: systemConfigChecker.exe, 00000000.00000003.1307992622.0000016BD0206000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1275980221.0000016BD0206000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD019C000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD0206000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD0206000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF6B270BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6B270BFAC

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B270C150 SetUnhandledExceptionFilter,	0_2_00007FF6B270C150
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B270BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B270BFAC
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: 0_2_00007FF6B270BB00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6B270BB00

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6B2704640

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF6B270C1BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6B270C1BC

Source: C:\Users\user\Desktop\systemConfigChecker.exe

Code function: 0_2_00007FF6B2704180 GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF6B2704180

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_00007FF6B2705510
Source: C:\Users\user\Desktop\systemConfigChecker.exe	Code function: \AppData\Local\Chromium\User Data\Default\Login Data		0_2_00007FF6B2705510

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\systemConfigChecker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\systemConfigChecker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials In Files	2 System Time Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://185.237.165.97/usdrdata	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/twO	0%	Avira URL Cloud	safe
http://185.237.165.97:80/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata_	0%	Avira URL Cloud	safe
http://185.237.165.97/	0%	Avira URL Cloud	safe
http://185.237.165.97/usdrdata_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD019C000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/usdrdata	systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata_	systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01F5000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1307992622.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97:80/userdata	systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/twO	systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org:80/	systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01C8000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1276079294.0000016BD01C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/	systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata	systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01F5000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1307992622.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000003.1280544209.0000016BD01D7000.00000004.00000020.00020000.00000000.sdmp, systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/usdrdata_	systemConfigChecker.exe, 00000000.00000002.1576343890.0000016BD01F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.237.165.97	unknown	France		52195	AP-MEDIA-ASPL	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569875
Start date and time:	2024-12-06 10:57:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	systemConfigChecker.exe
Detection:	MAL
Classification:	mal52.spyw.winEXE@2/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 31 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: systemConfigChecker.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AP-MEDIA-ASPL	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.180
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.237.165.180
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	0o37tv6BhU.elf	Get hash	malicious	Mirai	Browse	46.149.221.189
	YZfB2vyTrR.elf	Get hash	malicious	Mirai	Browse	46.149.221.169
	pSWP8vqTi4.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.178
	ISd7zpfQxZ.elf	Get hash	malicious	Mirai	Browse	46.149.221.177
	o6Khx92Ipk.elf	Get hash	malicious	Mirai	Browse	46.149.221.156
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	2LKVPFub8Z.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	EeXJoO1J62.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	gcrY4QgzW9.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234

Process:	C:\Users\user\Desktop\systemConfigChecker.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1020
Entropy (8bit):	4.868069397782046
Encrypted:	false
SSDEEP:	24:8p5Kk89L5K889LM89oYeb89LDWD899LkpLL+89mX6nck:8pUksLU8sLMsoDbsLDWDs5kdL+smX6n5
MD5:	DA5B9D57676E6E29F1A38B7A2629E35D
SHA1:	0C95B300725BBA5238A9D60DC7A88DAEDD0A0004
SHA-256:	56D2B959A284B37F3C2EC635CF79846D7F66CA43BD9613DAB2BC4659F296B866
SHA-512:	88CF5111968624181237B1A518376D6E5C2313C5B619F881A445309F34AA3CF00511DC0C986E81EC5FE6CE400A9AC12B49F8B1AC6DA8A3EFB208365E98A96CA9
Malicious:	false
Reputation:	low
Preview:	File is found: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data..File is found: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data..File not found: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json..File is found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.json..?? ??????? ????????

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.9784256378182175
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	systemConfigChecker.exe
File size:	81'920 bytes
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
SHA512:	335108a63a07d9d81240c40e67dc6375468bd5bae79edf413b0ec8913e43364b155fdebe0c972ab6150ae2c59779d75045108d9a257e2ce0b8c5ae78f819804e
SSDEEP:	1536:KRF3gVPu3b3X41IiaqGyB0+Hls+X7nTfRQP7K:yRE23zX41la+THls+m+
TLSH:	A2834947376A00ECD1ABA378D5A30A06D772BC05076193DF13A0A17A0FA67D1AE7FB51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.......a...b...a...e...a...d...a...`...a...`...a...`.r.a...h...a.......a...c...a.Rich..a........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000bae8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6729C700 [Tue Nov 5 07:19:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	066fb96ba163200488bf8cbd9705163e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBC4CAE1400h
dec eax
add esp, 28h
jmp 00007FBC4CAE0BA7h
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000025CFh]
dec eax
mov ecx, ebx
call dword ptr [000025BEh]
call dword ptr [000025C8h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000025BCh]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000025B0h]
test eax, eax
je 00007FBC4CAE0D39h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00009D26h]
call 00007FBC4CAE0DDEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00009E0Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00009D9Dh], eax
dec eax
mov eax, dword ptr [00009DF6h]
dec eax
mov dword ptr [00009C67h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00009D6Bh], eax
mov dword ptr [00009C41h], C0000409h
mov dword ptr [00009C3Bh], 00000001h
mov dword ptr [00009C45h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11ed4	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x16000	0x9f0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x10c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf7b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf670	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x630	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc077	0xc200	bb167b742e9c1e46cecec9663ad94a6e	False	0.48012644974226804	DIY-Thermocam raw data (Lepton 3.x), scale -14592-0, spot sensor temperature -0.000048, unit celsius, color scheme 0, calibration: offset 262144.000000, slope 171778.046875	6.1463104557320865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x6240	0x6400	a9c91b7191e54302f31a2135cbaafa16	False	0.3462109375	data	4.930625889732141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15000	0xda0	0x800	f49b7b400b3a9a593e0463969e69304e	False	0.19775390625	DOS executable (block device driver)	3.6357853761384584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x16000	0x9f0	0xa00	5859a68e779cdab4bed9be7147961d7c	False	0.493359375	data	4.82362794619983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1e0	0x200	2c9bc3c453765c5a8e37ea178e81aa1b	False	0.52734375	data	4.710061382693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x10c	0x200	9549c1cc6ee8d55da6140afe18223169	False	0.42578125	data	3.2295190100213778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x17060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetLocaleInfoA, OpenProcess, GetTimeZoneInformation, GetLastError, CloseHandle, K32GetModuleBaseNameA, GetSystemInfo, K32EnumProcesses, GlobalMemoryStatusEx, GetConsoleWindow, K32EnumProcessModules, GetDiskFreeSpaceExA, FindClose, InitializeSListHead, GetSystemTimeAsFileTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetLogicalDrives, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, RtlLookupFunctionEntry, GetModuleFileNameA, GetCurrentThreadId, RtlCaptureContext
USER32.dll	ShowWindow
ADVAPI32.dll	RegGetValueA, RegCloseKey, RegOpenKeyExA
MSVCP140.dll	?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z
IPHLPAPI.DLL	GetAdaptersInfo
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetGetJoinInformation
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpConnect, WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, _CxxThrowException, memset, __current_exception, __std_terminate, __std_exception_copy, memcpy, memcmp, memchr, memmove, __current_exception_context, __std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll	fread, fsetpos, ungetc, _fseeki64, _get_stream_buffer_pointers, setvbuf, fgetpos, fwrite, fflush, __p__commode, fputc, fgetc, fclose, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	free, malloc, _set_new_mode, _callnewh
api-ms-win-crt-string-l1-1-0.dll	isalnum
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_get_initial_narrow_environment, _initterm, _initterm_e, _cexit, _exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _crt_atexit, _register_onexit_function, _seh_filter_exe, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, exit, terminate, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:58:49.447566986 CET	49700	80	192.168.2.7	172.67.74.152
Dec 6, 2024 10:58:49.567533016 CET	80	49700	172.67.74.152	192.168.2.7
Dec 6, 2024 10:58:49.567622900 CET	49700	80	192.168.2.7	172.67.74.152
Dec 6, 2024 10:58:49.567924976 CET	49700	80	192.168.2.7	172.67.74.152
Dec 6, 2024 10:58:49.687644005 CET	80	49700	172.67.74.152	192.168.2.7
Dec 6, 2024 10:58:50.664830923 CET	80	49700	172.67.74.152	192.168.2.7
Dec 6, 2024 10:58:50.714219093 CET	49700	80	192.168.2.7	172.67.74.152
Dec 6, 2024 10:58:51.341677904 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.464106083 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.464201927 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.464443922 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.464538097 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.584963083 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585016012 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585037947 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585046053 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585076094 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585113049 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585120916 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585150003 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585171938 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585189104 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585206985 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585237980 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585256100 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585304022 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585306883 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585362911 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.585401058 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585427999 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.585485935 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.705322027 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.705358028 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.705398083 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.705411911 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.705454111 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.705492020 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.705504894 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.705539942 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.705559969 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.705573082 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.705625057 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.748625040 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.748773098 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.868664980 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:51.868748903 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:51.912614107 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:52.032602072 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:52.032655001 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:52.240596056 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:52.240686893 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:52.488708019 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:52.488903999 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:52.854886055 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:52.867866993 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:52.867923975 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:52.977538109 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:53.036657095 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:53.036854982 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:53.240983009 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:53.243292093 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:53.488629103 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:53.488722086 CET	49701	80	192.168.2.7	185.237.165.97
Dec 6, 2024 10:58:53.604432106 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:58:53.609297991 CET	80	49701	185.237.165.97	192.168.2.7
Dec 6, 2024 10:59:20.824614048 CET	49700	80	192.168.2.7	172.67.74.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:58:49.303191900 CET	58356	53	192.168.2.7	1.1.1.1
Dec 6, 2024 10:58:49.440721035 CET	53	58356	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 10:58:49.303191900 CET	192.168.2.7	1.1.1.1	0x7cbc	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 10:58:49.440721035 CET	1.1.1.1	192.168.2.7	0x7cbc	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:58:49.440721035 CET	1.1.1.1	192.168.2.7	0x7cbc	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:58:49.440721035 CET	1.1.1.1	192.168.2.7	0x7cbc	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.237.165.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	172.67.74.152	80	6176	C:\Users\user\Desktop\systemConfigChecker.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 10:58:49.567924976 CET	88	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: api.ipify.org
Dec 6, 2024 10:58:50.664830923 CET	429	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:58:50 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edb6b757b5d4394-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1646&rtt_var=823&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=88&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	185.237.165.97	80	6176	C:\Users\user\Desktop\systemConfigChecker.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 10:58:51.464443922 CET	185	OUT	POST /userdata HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WebKitFormBoundary User-Agent: WinHTTP/1.0 Content-Length: 96727 Host: 185.237.165.97
Dec 6, 2024 10:58:51.464538097 CET	11124	OUT	Data Raw: 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 79 73 69 6e 66 6f 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 Data Ascii: --WebKitFormBoundaryContent-Disposition: form-data; name="sysinfo"Content-Type: application/json{ "sysinfo": "MACHINE%20INFO%3a%0aMachine%20name%3a%20440BX%20Desktop%20Reference%20Platform%0aProcessor%20name%3a%20Intel%28R%29%20Core%28
Dec 6, 2024 10:58:51.585037947 CET	1236	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585076094 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585113049 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585171938 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585206985 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585237980 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585306883 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585362911 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 10:58:51.585485935 CET	4944	OUT	Data Raw: 74 65 5f 61 75 74 6f 69 6e 64 65 78 5f 70 61 73 73 77 6f 72 64 5f 6e 6f 74 65 73 5f 31 70 61 73 73 77 6f 72 64 5f 6e 6f 74 65 73 10 00 00 00 08 00 00 00 00 74 0b 07 17 2f 35 01 81 11 69 6e 64 65 78 66 6f 72 65 69 67 6e 5f 6b 65 79 5f 69 6e 64 65 Data Ascii: te_autoindex_password_notes_1password_notest/5indexforeign_key_indexinsecure_credentialsCREATE INDEX foreign_key_index ON insecure_credentials (parent_id)G[5indexsqlite_autoindex_insecure_credentials_1insecure_credentials

Target ID:	0
Start time:	04:58:47
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\systemConfigChecker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\systemConfigChecker.exe"
Imagebase:	0x7ff6b2700000
File size:	81'920 bytes
MD5 hash:	218954F9DD70247E51AF8A30940D5C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:58:47
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	32.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.5%
Total number of Nodes:	653
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF6B2701B50 Relevance: 178.3, APIs: 66, Strings: 35, Instructions: 1575COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B2701520: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270157F
Part of subcall function 00007FF6B2701520: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6B270159E
Part of subcall function 00007FF6B2701520: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B27015D2
Part of subcall function 00007FF6B2701520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF6B2701609
Part of subcall function 00007FF6B2701520: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6B2701648
Part of subcall function 00007FF6B2701520: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF6B270166D
Part of subcall function 00007FF6B2701520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF6B270169B

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2701C67
memcpy.VCRUNTIME140 ref: 00007FF6B2701CAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2701DB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2701E02
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2701E53
WinHttpOpen.WINHTTP ref: 00007FF6B2701E86
WinHttpConnect.WINHTTP ref: 00007FF6B2701EC2
memcpy.VCRUNTIME140 ref: 00007FF6B270207E
memcpy.VCRUNTIME140 ref: 00007FF6B27021A4
GetFileAttributesW.KERNELBASE ref: 00007FF6B2702254
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B27022A7
memcpy.VCRUNTIME140 ref: 00007FF6B27024FF
memcmp.VCRUNTIME140 ref: 00007FF6B2702597
memcpy.VCRUNTIME140 ref: 00007FF6B27027C6
memcpy.VCRUNTIME140 ref: 00007FF6B2702BF9

Part of subcall function 00007FF6B270A0C0: memcpy.VCRUNTIME140 ref: 00007FF6B270A0F8

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B270301F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270302A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703031
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703038
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270303F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703046
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270304D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703054
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270305B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703062
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703069
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703070
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703077
WinHttpCloseHandle.WINHTTP ref: 00007FF6B2703357
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270339F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6B27033C6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B27033D6
GetLastError.KERNEL32 ref: 00007FF6B27033A6

Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709AE6

WinHttpCloseHandle.WINHTTP ref: 00007FF6B27033E9
GetLastError.KERNEL32 ref: 00007FF6B27033F1
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6B2703411
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B2703421
WinHttpCloseHandle.WINHTTP ref: 00007FF6B270342A
GetLastError.KERNEL32 ref: 00007FF6B2703432
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270307E

Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A69
Part of subcall function 00007FF6B27099F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A89
Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A99
Part of subcall function 00007FF6B27099F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B7C
Part of subcall function 00007FF6B27099F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B83
Part of subcall function 00007FF6B27099F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B90

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703085
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270308C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B27023CE

Part of subcall function 00007FF6B270B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270B538
Part of subcall function 00007FF6B270B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270B53E

WinHttpOpenRequest.WINHTTP ref: 00007FF6B2701F1F

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

memcpy.VCRUNTIME140 ref: 00007FF6B27030E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270313F
WinHttpSendRequest.WINHTTP ref: 00007FF6B270318B
WinHttpReceiveResponse.WINHTTP ref: 00007FF6B270319E
WinHttpQueryHeaders.WINHTTP ref: 00007FF6B27031D5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6B270324A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B270325A
WinHttpCloseHandle.WINHTTP ref: 00007FF6B2703263
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27032A2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27032F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703338
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6B2703452
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B2703462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703494
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27034DC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2703519
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270351F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2703525
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2703537
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270353D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2703549

Strings

?????? ???????? ?????? WinHTTP: , xrefs: 00007FF6B270343A
chrome, xrefs: 00007FF6B27022B8
opera, xrefs: 00007FF6B2702324
?? ??????? ???????? ????? ?? ???????., xrefs: 00007FF6B2703215
?????? ???????? ???????: , xrefs: 00007FF6B2703232
/userdata, xrefs: 00007FF6B2701ED8
", "ip": ", xrefs: 00007FF6B2701CBE
fo": ", xrefs: 00007FF6B2701C91
brave, xrefs: 00007FF6B2702312
?? ??????? ????????? ??????. HTTP ?????? ???: , xrefs: 00007FF6B2703201
?????? ???????? HTTP-???????: , xrefs: 00007FF6B27033AE
POST, xrefs: 00007FF6B2701F15
operagx, xrefs: 00007FF6B2702333
msedge, xrefs: 00007FF6B27022FD
chromebeta, xrefs: 00007FF6B27022D0
?????? ?????????? ? ????????: , xrefs: 00007FF6B27033F9
"; filename="login_data, xrefs: 00007FF6B27027E7, 00007FF6B2702C08
--WebKitFormBoundary, xrefs: 00007FF6B2701F72
.json", xrefs: 00007FF6B2702835
Content-Type: application/x-sqlite3, xrefs: 00007FF6B2702DE1
, xrefs: 00007FF6B27021A9
File is found: , xrefs: 00007FF6B2702271
.sqlite", xrefs: 00007FF6B2702C4F
Content-Disposition: form-data; name="sysinfo", xrefs: 00007FF6B2702095
chromium, xrefs: 00007FF6B27022E8
firefox, xrefs: 00007FF6B2702357, 00007FF6B2702590
yandex, xrefs: 00007FF6B2702348
Content-Type: multipart/form-data; boundary=WebKitFormBoundary, xrefs: 00007FF6B270317D
name=", xrefs: 00007FF6B27027A8, 00007FF6B2702BDB
WinHTTP/1.0, xrefs: 00007FF6B2701E7F
Content-Type: application/json, xrefs: 00007FF6B27020AE, 00007FF6B2702A47
FileData is empty, xrefs: 00007FF6B27023B1
File not found: , xrefs: 00007FF6B2702FE9
?????? ??????? ??????????. HTTP ?????? ???: , xrefs: 00007FF6B27031EE
" }, xrefs: 00007FF6B2701D4C

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@$Http$Concurrency::cancel_current_taskmemcpy$V01@@$CloseHandle$ErrorLastU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@OpenRequest$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?setw@std@@?sputc@?$basic_streambuf@?uncaught_exception@std@@AttributesConnectD@std@@@1@_FileHeadersJ@1@_Osfx@?$basic_ostream@_QueryReceiveResponseSendSmanip@_U?$_V12@V21@@V?$basic_streambuf@Vios_base@1@isalnummallocmemcmp
String ID: $" }$", "ip": "$"; filename="login_data$--WebKitFormBoundary$.json"$.sqlite"$/userdata$?? ??????? ???????? ????? ?? ???????.$?? ??????? ????????? ??????. HTTP ?????? ???: $?????? ??????? ??????????. HTTP ?????? ???: $?????? ???????? ?????? WinHTTP: $?????? ???????? ???????: $?????? ???????? HTTP-???????: $?????? ?????????? ? ????????: $Content-Disposition: form-data; name="sysinfo"$Content-Type: application/json$Content-Type: application/x-sqlite3$Content-Type: multipart/form-data; boundary=WebKitFormBoundary$File is found: $File not found: $FileData is empty$POST$WinHTTP/1.0$brave$chrome$chromebeta$chromium$firefox$fo": "$msedge$name="$opera$operagx$yandex
API String ID: 3244378811-4092172495
Opcode ID: e5d21f8269266fc38fbdbaff60fb5f9290399c69a2913e43641f2a0b35d44255
Instruction ID: ba236a275807096572db7c4d6fe6aa25c938961b57a902eadaf2b27b8d20326a
Opcode Fuzzy Hash: e5d21f8269266fc38fbdbaff60fb5f9290399c69a2913e43641f2a0b35d44255
Instruction Fuzzy Hash: 4EE2B762E18B8685EB12CB2DD4403FE23A1EB46798F505631DB6C876D5DFBDE189C308

Function 00007FF6B2705D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF6B2705DC1
ShowWindow.USER32 ref: 00007FF6B2705DCF

Part of subcall function 00007FF6B2709610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6B2701CCF), ref: 00007FF6B2709656

Part of subcall function 00007FF6B2704A40: memset.VCRUNTIME140(?), ref: 00007FF6B2704A96
Part of subcall function 00007FF6B2704A40: memset.VCRUNTIME140(?), ref: 00007FF6B2704AAA
Part of subcall function 00007FF6B2704A40: memset.VCRUNTIME140(?), ref: 00007FF6B2704ABE
Part of subcall function 00007FF6B2704A40: memset.VCRUNTIME140(?), ref: 00007FF6B2704AD2
Part of subcall function 00007FF6B2704A40: memset.VCRUNTIME140(?), ref: 00007FF6B2704AE3
Part of subcall function 00007FF6B2704A40: RegOpenKeyExA.KERNELBASE(?), ref: 00007FF6B2704B13
Part of subcall function 00007FF6B2704A40: RegGetValueA.KERNELBASE ref: 00007FF6B2704B4C
Part of subcall function 00007FF6B2704A40: RegCloseKey.KERNELBASE ref: 00007FF6B2704B89
Part of subcall function 00007FF6B2704A40: RegOpenKeyExA.KERNELBASE ref: 00007FF6B2704BB8
Part of subcall function 00007FF6B2704A40: RegGetValueA.KERNELBASE ref: 00007FF6B2704BF1

Part of subcall function 00007FF6B27083C0: memcpy.VCRUNTIME140 ref: 00007FF6B2708417

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2705E4F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2705EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2705F2B
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF6B2705F5A
memset.VCRUNTIME140 ref: 00007FF6B2705F6C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF6B2705F9A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B270607C
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2706089
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270613E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27061AC
memcpy.VCRUNTIME140 ref: 00007FF6B27062B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2706340
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270637F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27063ED
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270645B

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27064B3
memset.VCRUNTIME140 ref: 00007FF6B27064CB

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

GetModuleFileNameA.KERNEL32 ref: 00007FF6B27064E9

Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A69
Part of subcall function 00007FF6B27099F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A89
Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A99
Part of subcall function 00007FF6B27099F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B7C
Part of subcall function 00007FF6B27099F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B83
Part of subcall function 00007FF6B27099F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B90

Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709AE6

Part of subcall function 00007FF6B27099F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B0F
Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B36

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B27065E3
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B27065F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27066A5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270672C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270676E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27067C0

Part of subcall function 00007FF6B2701310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6B270131B

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2706804

Part of subcall function 00007FF6B2701270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B270B543), ref: 00007FF6B27012B4

Strings

Total Physical Memory: , xrefs: 00007FF6B2705F84
@, xrefs: 00007FF6B2705F4D
MACHINE INFO:, xrefs: 00007FF6B2705DF3
185.237.165.97, xrefs: 00007FF6B27066C8
CPU INFO:, xrefs: 00007FF6B2705ECF
IP: , xrefs: 00007FF6B270629C
LOCALE INFO:, xrefs: 00007FF6B2705E61
USERS INFO:, xrefs: 00007FF6B2706391
PROCESSES RUNNING:, xrefs: 00007FF6B2706649
Executable Path: , xrefs: 00007FF6B27064EF
ADAPTERS INFO:, xrefs: 00007FF6B2706150
RAM INFO:, xrefs: 00007FF6B2705F3D
DOMAIN AND TZ INFO:, xrefs: 00007FF6B27063FF
MB, xrefs: 00007FF6B2705FA3
DISK INFO:, xrefs: 00007FF6B27060E2

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@$memset$U?$char_traits@_W@std@@@std@@memcpy$??1?$basic_ios@??1?$basic_iostream@?good@ios_base@std@@?sputc@?$basic_streambuf@OpenValueWindow$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@CloseConcurrency::cancel_current_taskConsoleD@std@@@1@@FileGlobalMemoryModuleNameOsfx@?$basic_ostream@_ShowStatusV01@_V12@V?$basic_streambuf@Xlength_error@std@@__std_exception_copymalloc
String ID: ADAPTERS INFO:$CPU INFO:$DISK INFO:$DOMAIN AND TZ INFO:$LOCALE INFO:$PROCESSES RUNNING:$RAM INFO:$USERS INFO:$ IP: $ MB$185.237.165.97$@$Executable Path: $MACHINE INFO:$Total Physical Memory:
API String ID: 2962708308-876331821
Opcode ID: 2b01728597835d1c08395949a5c84a0a3799b4b4f0304258a8e711e13eb79b4b
Instruction ID: c345aa9757ed54ac0375e1ce9706b7898e47268704ea6c572eb4448ebd9637d1
Opcode Fuzzy Hash: 2b01728597835d1c08395949a5c84a0a3799b4b4f0304258a8e711e13eb79b4b
Instruction Fuzzy Hash: 5552E662F14A4685EB11DB68D4503AF23A1FF467ACF405632EB6D83AD9DFADD188C304

Function 00007FF6B2705510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6B2705552
GetEnvironmentVariableW.KERNEL32 ref: 00007FF6B2705580
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6B2705599
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2705604
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270568F

Strings

\logins.json, xrefs: 00007FF6B2705817, 00007FF6B2705839
\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data, xrefs: 00007FF6B27056D6
\AppData\Roaming\Opera Software\Opera Stable\Login Data, xrefs: 00007FF6B2705739
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00007FF6B27057B5, 00007FF6B27058B4
defa, xrefs: 00007FF6B2705380
rele, xrefs: 00007FF6B27052E1
\AppData\Roaming\Opera Software\Opera GX Stable\Login Data, xrefs: 00007FF6B2705754
\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF6B270576F
\AppData\Roaming\Mozilla\Firefox\Profiles, xrefs: 00007FF6B270559F, 00007FF6B2705624
\times.json, xrefs: 00007FF6B2705916, 00007FF6B2705938
\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 00007FF6B270571E
\AppData\Local\Chromium\User Data\Default\Login Data, xrefs: 00007FF6B27056EE
USERPROFILE, xrefs: 00007FF6B2705579
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF6B27056BE
\AppData\Local\Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF6B2705706
?????? ??????: , xrefs: 00007FF6B2705165
rele, xrefs: 00007FF6B27053F0

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$EnvironmentVariablefreemalloc
String ID: ?????? ??????: $USERPROFILE$\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data$\AppData\Local\Chromium\User Data\Default\Login Data$\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data$\AppData\Local\Google\Chrome\User Data\Default\Login Data$\AppData\Local\Microsoft\Edge\User Data\Default\Login Data$\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data$\AppData\Roaming\Mozilla\Firefox\Profiles$\AppData\Roaming\Mozilla\Firefox\Profiles\$\AppData\Roaming\Opera Software\Opera GX Stable\Login Data$\AppData\Roaming\Opera Software\Opera Stable\Login Data$\logins.json$\times.json$defa$rele$rele
API String ID: 716798019-1786275549
Opcode ID: 945badb9ec5cdd080a3f4387013dcbc219eeff5c8b0478921573e240f6d3476d
Instruction ID: 8d155dd781267955ac49a664ec7ba553d32a967fadf3ecc8637e45a10299271a
Opcode Fuzzy Hash: 945badb9ec5cdd080a3f4387013dcbc219eeff5c8b0478921573e240f6d3476d
Instruction Fuzzy Hash: CF32D672A24BC695EB21CF68D8443EE23A1FB46798F405232D75C57B99DFB9D288C304

Function 00007FF6B2704A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?), ref: 00007FF6B2704A96
memset.VCRUNTIME140(?), ref: 00007FF6B2704AAA
memset.VCRUNTIME140(?), ref: 00007FF6B2704ABE
memset.VCRUNTIME140(?), ref: 00007FF6B2704AD2
memset.VCRUNTIME140(?), ref: 00007FF6B2704AE3

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

RegOpenKeyExA.KERNELBASE(?), ref: 00007FF6B2704B13
RegGetValueA.KERNELBASE ref: 00007FF6B2704B4C
RegCloseKey.KERNELBASE ref: 00007FF6B2704B89
RegOpenKeyExA.KERNELBASE ref: 00007FF6B2704BB8
RegGetValueA.KERNELBASE ref: 00007FF6B2704BF1
RegCloseKey.ADVAPI32 ref: 00007FF6B2704C2E
RegOpenKeyExA.KERNELBASE ref: 00007FF6B2704C5D
RegGetValueA.KERNELBASE ref: 00007FF6B2704C9A
RegGetValueA.KERNELBASE ref: 00007FF6B2704D01
RegCloseKey.KERNELBASE ref: 00007FF6B2704D3E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2704E0F
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2704E19

Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A69
Part of subcall function 00007FF6B27099F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A89
Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A99
Part of subcall function 00007FF6B27099F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B7C
Part of subcall function 00007FF6B27099F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B83
Part of subcall function 00007FF6B27099F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B90

Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709AE6

Part of subcall function 00007FF6B27099F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B0F
Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B36

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00007FF6B2704BAA
BaseBoardProduct, xrefs: 00007FF6B2704B3E
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF6B2704B05
Processor name: , xrefs: 00007FF6B2704BFB
OS display version: , xrefs: 00007FF6B2704D0B
ProcessorNameString, xrefs: 00007FF6B2704BE3
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6B2704C4F
Machine name: , xrefs: 00007FF6B2704B56
DisplayVersion, xrefs: 00007FF6B2704CF3
ProductName, xrefs: 00007FF6B2704C8C
OS name: , xrefs: 00007FF6B2704CA4

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memset$Value$CloseOpenU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@Osfx@?$basic_ostream@_V12@V?$basic_streambuf@
String ID: BaseBoardProduct$DisplayVersion$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Machine name: $OS display version: $OS name: $Processor name: $ProcessorNameString$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 20268565-1502927450
Opcode ID: 621b55e935ff6405d9fe05d3b75cbcd6982443e8c92c0c421b99860315d121c5
Instruction ID: e0b9a833eaafaf2b3bb25af7f8b734204988af051f11af9ad5a4a1165ad292db
Opcode Fuzzy Hash: 621b55e935ff6405d9fe05d3b75cbcd6982443e8c92c0c421b99860315d121c5
Instruction Fuzzy Hash: C8B19032A18B4186EB21CB29E8502EA73E4FB8578CF404236DB8D87769EF7DD149C744

Function 00007FF6B2704E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B270A0C0: memcpy.VCRUNTIME140 ref: 00007FF6B270A0F8

WinHttpOpen.WINHTTP ref: 00007FF6B2704EC6
WinHttpConnect.WINHTTP ref: 00007FF6B2704EEB
WinHttpOpenRequest.WINHTTP ref: 00007FF6B2704F20
WinHttpSendRequest.WINHTTP ref: 00007FF6B2704F4C
WinHttpReceiveResponse.WINHTTP ref: 00007FF6B2704F5F
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF6B2704F7A
memset.VCRUNTIME140 ref: 00007FF6B2704FA4
WinHttpReadData.WINHTTP ref: 00007FF6B2704FBE

Part of subcall function 00007FF6B270A0C0: memcpy.VCRUNTIME140 ref: 00007FF6B270A198

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270507D
WinHttpCloseHandle.WINHTTP ref: 00007FF6B2705094
WinHttpCloseHandle.WINHTTP ref: 00007FF6B270509D
WinHttpCloseHandle.WINHTTP ref: 00007FF6B27050A6

Strings

Unable to get IP, xrefs: 00007FF6B2704E9E
WinHTTP/1.0, xrefs: 00007FF6B2704EBF
GET, xrefs: 00007FF6B2704F16
api.ipify.org, xrefs: 00007FF6B2704EE1

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequestmemcpy$AvailableConnectQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturnmemset
String ID: GET$Unable to get IP$WinHTTP/1.0$api.ipify.org
API String ID: 849217320-4095685055
Opcode ID: 23648efb205baca81fbdab06176de54150f29ea8efcdd1e0d08f0531ae66fc50
Instruction ID: e7c0bf99d47da8e7ccad27e193c049f878617e033c4614286c4ab063fc4cab23
Opcode Fuzzy Hash: 23648efb205baca81fbdab06176de54150f29ea8efcdd1e0d08f0531ae66fc50
Instruction Fuzzy Hash: 65619632A1874182EA15CB29E44076F77E1FB8AB88F144535EB8C43B54DFBED489CB44

Function 00007FF6B2704640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE ref: 00007FF6B2704695
GetLocaleInfoA.KERNEL32 ref: 00007FF6B2704717

Part of subcall function 00007FF6B270A0C0: memcpy.VCRUNTIME140 ref: 00007FF6B270A0F8

memset.VCRUNTIME140 ref: 00007FF6B27047F0
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2704804
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6B2704821
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2704852
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2704990
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B270499A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27049D5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2704A33

Strings

Language: , xrefs: 00007FF6B270486E
Country: , xrefs: 00007FF6B270489A
Failed to get locale, xrefs: 00007FF6B27046B3, 00007FF6B2704739

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$InfoLocale_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@D@std@@@1@_V?$basic_streambuf@memcpymemset
String ID: Country: $Failed to get locale$Language:
API String ID: 3095796567-568146128
Opcode ID: 7904306417eea5db5be8cc27ab08f575789e8ddbba3484a0836349cafbead015
Instruction ID: d1f4ca3158287622d9f0e84057b119b3b86ad2c8abc8df7cacfaae340a14ec6e
Opcode Fuzzy Hash: 7904306417eea5db5be8cc27ab08f575789e8ddbba3484a0836349cafbead015
Instruction Fuzzy Hash: C1B1C172B18B8185EB11CF68D4503AE33A0FB86B98F505236DB5C93B98DFB9D189C704

Function 00007FF6B2703780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00007FF6B27037C5
memset.VCRUNTIME140 ref: 00007FF6B27037DA

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A69
Part of subcall function 00007FF6B27099F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A89
Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A99
Part of subcall function 00007FF6B27099F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B7C
Part of subcall function 00007FF6B27099F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B83
Part of subcall function 00007FF6B27099F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B90

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF6B27038F6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF6B270392B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27039D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27039DE
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2703A59
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2703A63

Part of subcall function 00007FF6B2709610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6B2701CCF), ref: 00007FF6B2709656

Strings

GB, xrefs: 00007FF6B2703934
Available Drives: , xrefs: 00007FF6B27037E9

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@D@std@@@1@@DiskDrivesFreeLogicalOsfx@?$basic_ostream@_SpaceV01@_V12@V?$basic_streambuf@memcpymemset
String ID: GB$Available Drives:
API String ID: 2435906160-4081138596
Opcode ID: c8601fb43c653ddf6b0af4f5e75bc3de50e7d25d23a1f5c1362283a91e556e70
Instruction ID: d3337fc42db6ba32ddd51f796083f825bef623d26b56cc2da223febedf237827
Opcode Fuzzy Hash: c8601fb43c653ddf6b0af4f5e75bc3de50e7d25d23a1f5c1362283a91e556e70
Instruction Fuzzy Hash: 9A91D662A18B8186EB11CB69D4403AE77A0FB8679CF505231DF8D837A5DFBDD189C708

Function 00007FF6B2703AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6B2703AEB
memset.VCRUNTIME140 ref: 00007FF6B2703B01

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

GetAdaptersInfo.IPHLPAPI ref: 00007FF6B2703B19
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6B2703B28
GetAdaptersInfo.IPHLPAPI ref: 00007FF6B2703B39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6B2703BC0
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2703C8E
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2703C98

Strings

IP Address: , xrefs: 00007FF6B2703B7F
Adapter: , xrefs: 00007FF6B2703B50

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$AdaptersInfomalloc$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@V?$basic_streambuf@freememset
String ID: Adapter: $IP Address:
API String ID: 1136092572-1613687433
Opcode ID: 06b27aec4c232e626f636c09154849647e9ee1243f3ad1ae019303bbe33ba379
Instruction ID: 56e69e36e491ddf51aab24e4f22dab318e177ecb993f16db212333f6218249cc
Opcode Fuzzy Hash: 06b27aec4c232e626f636c09154849647e9ee1243f3ad1ae019303bbe33ba379
Instruction Fuzzy Hash: 1D51B362A19B8182EB12DB19D4402AF73A1FB86B88F404132DF4D87B55DFBDD48AC708

Function 00007FF6B2703560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FF6B270359E
memset.VCRUNTIME140 ref: 00007FF6B27035B0

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A69
Part of subcall function 00007FF6B27099F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A89
Part of subcall function 00007FF6B27099F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A99
Part of subcall function 00007FF6B27099F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B7C
Part of subcall function 00007FF6B27099F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B83
Part of subcall function 00007FF6B27099F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B90

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z.MSVCP140 ref: 00007FF6B27035D7

Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709AE6

Part of subcall function 00007FF6B27099F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B0F
Part of subcall function 00007FF6B27099F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B36

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6B2703603
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B27036DC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B27036E6

Strings

Number of Cores: , xrefs: 00007FF6B27035EC
Processor Architecture: , xrefs: 00007FF6B27035BF

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@?good@ios_base@std@@?sputc@?$basic_streambuf@V01@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@InfoOsfx@?$basic_ostream@_SystemV12@V?$basic_streambuf@memset
String ID: Number of Cores: $Processor Architecture:
API String ID: 777187999-1490948189
Opcode ID: db8688cd583bdc27e0cdb5cc254e17eb9a2918b1e2afa49accf7bbecb9bde412
Instruction ID: b19259dea02a88acc9d09b40a41f00966f3ade024173c6686a733a72f1a10307
Opcode Fuzzy Hash: db8688cd583bdc27e0cdb5cc254e17eb9a2918b1e2afa49accf7bbecb9bde412
Instruction Fuzzy Hash: C351A062A14A818AEB11CF69D8502EE33B0FB8AB8CF404136DB4D97769DF7DD149C744

Function 00007FF6B2703CD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6B2703D2C

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

NetUserEnum.NETAPI32 ref: 00007FF6B2703D6B
NetApiBufferFree.NETAPI32 ref: 00007FF6B2703E4A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2703E9F
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2703F1A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2703F24

Strings

User: , xrefs: 00007FF6B2703DBD

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BufferD@std@@@1@@EnumFreeUserV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: User:
API String ID: 429987867-381282118
Opcode ID: a64873103b06ffc4200cda270a07e11e7e197258626d2288af55902c3a0a6a1e
Instruction ID: 75b77c8a8ff16809f571433cb3b78fd53850b72d7797a89fd66afdb45d7e9666
Opcode Fuzzy Hash: a64873103b06ffc4200cda270a07e11e7e197258626d2288af55902c3a0a6a1e
Instruction Fuzzy Hash: 0771C572A18B8186EB11CF69D4402AE77E1FB86788F504136DB4D93BA8DF7DD489C708

Function 00007FF6B2704180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE ref: 00007FF6B27041BD
memset.VCRUNTIME140 ref: 00007FF6B27041D0

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270427D
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2704351
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B270435B

Strings

Time Zone: , xrefs: 00007FF6B270420A

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationTimeV?$basic_streambuf@Zone_invalid_parameter_noinfo_noreturnmemset
String ID: Time Zone:
API String ID: 35776714-1239252231
Opcode ID: 9680c93f22244c1f102b1dcea7ae030f4aea4ed922c954592cfa34c9f968cfaf
Instruction ID: 37965556c52621a150437bd2ae6cd865aa351054474986f07d622e4f580f2127
Opcode Fuzzy Hash: 9680c93f22244c1f102b1dcea7ae030f4aea4ed922c954592cfa34c9f968cfaf
Instruction Fuzzy Hash: FB51F272A18B8581EB21CF68E4502AF73A1FB8A798F505132EB4D83759DFBDD489C704

Function 00007FF6B2701820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6B2701865
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B27018CD
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140 ref: 00007FF6B2701910
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z.MSVCP140 ref: 00007FF6B2701927
memset.VCRUNTIME140 ref: 00007FF6B27019A9

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z.MSVCP140 ref: 00007FF6B27019CD
??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B27019DD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6B2701A04
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2701A3E
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2701A8D
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2701A97
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2701AC7
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2701B2C

Strings

Couldn't open the file, xrefs: 00007FF6B27018B0
Couldn't read the file, xrefs: 00007FF6B27019E7

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??1?$basic_istream@??6?$basic_ostream@V01@@memset$??1?$basic_ios@??7ios_base@std@@?read@?$basic_istream@?seekg@?$basic_istream@?tellg@?$basic_istream@Concurrency::cancel_current_taskMbstatet@@@2@V12@V12@_V?$fpos@_invalid_parameter_noinfo_noreturnmalloc
String ID: Couldn't open the file$Couldn't read the file
API String ID: 2898521299-2967168750
Opcode ID: 8854638d1394e1158c67c410b5d485f915181e4be3706a2316ebb181cbf7b6c2
Instruction ID: ca85312f901b5138242ea67ba224e53244141cf68869d8f66fe4d31102f02211
Opcode Fuzzy Hash: 8854638d1394e1158c67c410b5d485f915181e4be3706a2316ebb181cbf7b6c2
Instruction Fuzzy Hash: FE91A032A18B8582EB11CF19E8402AE73A1FB86B98F544632DF5D837A4DF7DE149C704

Function 00007FF6B2701520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270157F
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6B270159E
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B27015D2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF6B2701609
isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6B2701648
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF6B270166D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF6B270169B
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2701782
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B270178C

Part of subcall function 00007FF6B2709820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B270986D
Part of subcall function 00007FF6B2709820: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6B270988D
Part of subcall function 00007FF6B2709820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B270989D
Part of subcall function 00007FF6B2709820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B27098FD
Part of subcall function 00007FF6B2709820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B2709926
Part of subcall function 00007FF6B2709820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B270995D

Strings

_, xrefs: 00007FF6B2701659
~, xrefs: 00007FF6B270165E

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?sputc@?$basic_streambuf@$??6?$basic_ostream@?good@ios_base@std@@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@?flush@?$basic_ostream@_?setw@std@@D@std@@@1@_J@1@_Smanip@_U?$_U?$char_traits@_V12@V21@@V?$basic_streambuf@Vios_base@1@W@std@@@std@@isalnum
String ID: _$~
API String ID: 2365617078-3740536066
Opcode ID: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction ID: 51588c973e287cc9942c6f36a489c46982d8297e22e201d82af43c2d047cdbb7
Opcode Fuzzy Hash: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction Fuzzy Hash: 3E718132A18A8186EB11CF59E8502AFB7A0FB86B98F444136DF4D93768DFBDD449C704

Function 00007FF6B27089E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B2701881), ref: 00007FF6B2708A20
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6B2708A3F
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2708A71
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6B2708A8C
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF6B2708AB6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6B2708AD3
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6B2708AFA
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z.MSVCP140 ref: 00007FF6B2708B21
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF6B2708B45

Part of subcall function 00007FF6B2709FB0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6B2709FDD
Part of subcall function 00007FF6B2709FB0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6B2709FF7
Part of subcall function 00007FF6B2709FB0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6B270A029
Part of subcall function 00007FF6B2709FB0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6B270A054
Part of subcall function 00007FF6B2709FB0: std::_Facet_Register.LIBCPMT ref: 00007FF6B270A06D
Part of subcall function 00007FF6B2709FB0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6B270A08C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B2708B5A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6B2708B71
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6B2708BB0

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@_U_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3818078705-0
Opcode ID: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction ID: a09af43967429975d7fee0fe81163bd77f9486b53d24168d12048c4373c07d5c
Opcode Fuzzy Hash: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction Fuzzy Hash: 7D515F32608B8586EB05CF29E55436A77E1FB86B89F044435DB8D83B24DF7DE06AC748

Function 00007FF6B2704390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6B27043E7

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

K32EnumProcesses.KERNEL32 ref: 00007FF6B2704405
memset.VCRUNTIME140 ref: 00007FF6B27044AC
OpenProcess.KERNEL32 ref: 00007FF6B27044BB
K32EnumProcessModules.KERNEL32 ref: 00007FF6B27044DC
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF6B27044FB
CloseHandle.KERNELBASE ref: 00007FF6B2704524
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B27045FC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2704606

Part of subcall function 00007FF6B270A0C0: memcpy.VCRUNTIME140 ref: 00007FF6B270A0F8

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$EnumProcessmemset$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BaseCloseD@std@@@1@@HandleModuleModulesNameOpenProcessesV?$basic_streambuf@memcpy
String ID:
API String ID: 3444793848-0
Opcode ID: 176818b9055dcd18f90ea10054250413a06e4f11656990404fb4c7ffa63b3a2d
Instruction ID: 8d95018ccc6590bad85a6bc0dc796658832288f98f85eb4479b853269a86f7fe
Opcode Fuzzy Hash: 176818b9055dcd18f90ea10054250413a06e4f11656990404fb4c7ffa63b3a2d
Instruction Fuzzy Hash: 6A719272A18B8586EB21CF29D4502AE73A0FB86B88F504136DF8D93B58DF7DD189C704

Function 00007FF6B2709C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B2709C8A
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6B2709CAA
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B2709CBA
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF6B2709D07
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6B2709D31
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF6B2709D56
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6B2709D9D
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6B2709DA4
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6B2709DB1

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction ID: a32688eeafba83e71467b0fe1cd8232f53203ba93c7df19c85c7a54a7eab17cd
Opcode Fuzzy Hash: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction Fuzzy Hash: AD510232609A41C2EB258F1ED59023AB7E0FB86F99B15C531CF5E837A0CF7AD44A8304

Function 00007FF6B27099F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A69
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A89
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709A99
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709AE6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B0F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B36
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B83
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6B27019FA), ref: 00007FF6B2709B90

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction ID: 7684aa0eb165f36041df942c41d5b3ad32f37c7215225267c394cec9bb67b207
Opcode Fuzzy Hash: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction Fuzzy Hash: C0510622609941C2EB158F1ED59423AA7E0FF86F99F15C531CB5E837A1CFBAD446C348

Function 00007FF6B270B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B0EB
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B10B
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B11B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B168
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B196
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B1B7
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B1FE
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B205
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6B2701AD2), ref: 00007FF6B270B212

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction ID: 3a2df819140c1fa04dd2082373f63ba5a4edea9567b680c27e5fe0559c00734e
Opcode Fuzzy Hash: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction Fuzzy Hash: 7B511232608A4182EB25CF1DE59463AA7E1FF86F89B159431CF4E83764CF7ED94A8304

Function 00007FF6B270B96C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6B270B995
__scrt_release_startup_lock.LIBCMT ref: 00007FF6B270BA03
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270BA51
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270BA56
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270BA5E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270BA66
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270BA88
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270BAE2

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction ID: 74b084c599cee4090dc019497b892bf1dd30298a85963195487abbc1314c4e1b
Opcode Fuzzy Hash: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction Fuzzy Hash: 7E315D21A1810381FA16AB6D94553BB23D2AF4778CF44653AE70DC72DBCEAEB54D830D

Function 00007FF6B2703F60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6B2703FAC

Part of subcall function 00007FF6B2706810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B270684A
Part of subcall function 00007FF6B2706810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6B2706866
Part of subcall function 00007FF6B2706810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6B2706898

NetGetJoinInformation.NETAPI32 ref: 00007FF6B2703FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2704071
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B2704143
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6B270414D

Strings

Domain: , xrefs: 00007FF6B2703FFE

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationJoinV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: Domain:
API String ID: 3601429228-3214134553
Opcode ID: f59fd3a113323076913b019393b9ca434df01870f7828c91c6ce386d03f2384e
Instruction ID: 69ec6cdcc0f456767029caffa4d1cd976f607972568d749cb3dcf4bbd4e60637
Opcode Fuzzy Hash: f59fd3a113323076913b019393b9ca434df01870f7828c91c6ce386d03f2384e
Instruction Fuzzy Hash: A651E472A18B8181EB11CB69D4502AE73E1FB8AB98F504132EB4D93B58DFBDD189C704

Function 00007FF6B2709FB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6B2709FDD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6B2709FF7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6B270A029
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6B270A054
std::_Facet_Register.LIBCPMT ref: 00007FF6B270A06D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6B270A08C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270A0B7

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction ID: 0c2c579066fdaca7a8e6286071b42e80f738907ca3bcd52dad697cead52d925e
Opcode Fuzzy Hash: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction Fuzzy Hash: 2D31C732608B4581EB158F19E4401AA77A0FB9EF9CF480631EB9D87768DFBDE449C708

Function 00007FF6B2701000 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF6B2701011

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF6B2701088
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF6B27010AD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6B27010BD
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF6B27010CC
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF6B27010E0

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: f87d893e3fb1d93d24334a2d4759e64544bcba3001e0ab39bcc40b4c639590f2
Instruction ID: 57d4672f8f4a1bfdb2c4f55dcfa6f7e3393398442e9556a3f715fee8f20b5113
Opcode Fuzzy Hash: f87d893e3fb1d93d24334a2d4759e64544bcba3001e0ab39bcc40b4c639590f2
Instruction Fuzzy Hash: 0A413F31928B5282E70ACB69E85033973E0FF4AB89F544135DB4E83760DFBDE1998348

Function 00007FF6B2707A10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2707C03

Strings

, xrefs: 00007FF6B2707A93

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: b6637dcdd66c50c0683920060a48064bb7072bc3cfe5a88b8d918cdd62cc5f9d
Instruction ID: a4190825c93d8067fed42f3d1a830b9ce2d5c9fe9bb0edd8e5ad460167ae5281
Opcode Fuzzy Hash: b6637dcdd66c50c0683920060a48064bb7072bc3cfe5a88b8d918cdd62cc5f9d
Instruction Fuzzy Hash: 48516D72608B4596EB168F2ED45026D33A0FB49B98F544532CB4D83BA4DFBEE0A5C308

Function 00007FF6B27096C0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6B27096F0
memcpy.VCRUNTIME140 ref: 00007FF6B27097B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2709805
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2709812

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 61f8509d56303d48883bdc27f9f7ac28063982bea9f0e33860e9bb2ac2d2f064
Instruction ID: 9f8469579cf7af1d4b89d65412bc6e84f2b7cd39bf5630b2c958cc71563659e2
Opcode Fuzzy Hash: 61f8509d56303d48883bdc27f9f7ac28063982bea9f0e33860e9bb2ac2d2f064
Instruction Fuzzy Hash: 4031E262B0965684FE169F1995003BE13C19B46FECF540A31DB2D87BC5EEBEE489C308

Function 00007FF6B2706DA0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction ID: d7e478c78b249ff464f7708513fc889bef265f83da6c8af7130731a204671bb7
Opcode Fuzzy Hash: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction Fuzzy Hash: 5331A632705B9286EE668F2AE4143BAA390FB49BD8F484435CF4D87750DE7DE49A8304

Function 00007FF6B270B508 Relevance: 4.5, APIs: 3, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270B538

Part of subcall function 00007FF6B270BCA4: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B270BCAD
Part of subcall function 00007FF6B270BCA4: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF6B270B53D,?,?,?,00007FF6B270107B), ref: 00007FF6B270BCBE

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270B53E

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: 238c82254a5a0dd3bfdcea07084a0eea4643be32c8ba11d6a235a5ec125aee32
Instruction ID: a14afb2f12b4422c0213e2626f979ae5de9606ac7018844dd2de5b300c2001a1
Opcode Fuzzy Hash: 238c82254a5a0dd3bfdcea07084a0eea4643be32c8ba11d6a235a5ec125aee32
Instruction Fuzzy Hash: 21E0EC40E1A21752FE6A2279251607B03C20F5B7B8E1C2B70EB7EC43C6AD9FA55D451C

Function 00007FF6B2709BD0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF6B2709BE5
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF6B2709BF1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6B2709BFA

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@V12@$?flush@?$basic_ostream@_?put@?$basic_ostream@?widen@?$basic_ios@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2670548386-0
Opcode ID: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction ID: 5808b4f1487e191a4562177f3425f5299c46a7d8d7daa6434fdcbdfd8b625c2a
Opcode Fuzzy Hash: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction Fuzzy Hash: 7CD01221A4460683DA0D5F1AB8540352350AF4EF49B085431DE0F46310CD7DD45E8204

Function 00007FF6B2709DF0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF6B2709E05
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF6B2709E11
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6B2709E1A

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?put@?$basic_ostream@_?widen@?$basic_ios@_V12@V12@_
String ID:
API String ID: 2094784882-0
Opcode ID: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction ID: bdb0c808e2f0ff5e780d9aac76b4e5b6c6fd40c9b08e1abcdc7445ee0621050b
Opcode Fuzzy Hash: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction Fuzzy Hash: 30D05B24B4460683EE0D9F2ABC541352361DF4EF59B4C5030CE4F87310CD3DD49A8304

Function 00007FF6B2706BC0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6B2706C31
fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6B2706C47

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction ID: da25efa6ed66b7208c9ed08f75dbabd8ba9a386ee2a45f155e239375efe00384
Opcode Fuzzy Hash: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction Fuzzy Hash: AF314D72605B4181EB628F2AD56432A23E0FB59B9CF008131CF5CC7794EF79E49A8304

Function 00007FF6B2707530 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6B2701A88), ref: 00007FF6B27075C6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF6B2701A88), ref: 00007FF6B27075D7

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: baf789e10b114cee5e0dc2a749248d1481134e019c89cdd30f75a30e5dac250a
Instruction ID: 42d1538501c7694271381d887fc8c13b70e6d9f20eb103eb305e160d8e6e8878
Opcode Fuzzy Hash: baf789e10b114cee5e0dc2a749248d1481134e019c89cdd30f75a30e5dac250a
Instruction Fuzzy Hash: 0B21CE32A09B4185EB468F3EE4543A937A4F749F4CF048036CA4D8B368DF7AC49AC754

Function 00007FF6B27083C0 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6B2708417

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ff8da17e9ad61dbf7719b97cca7bcf2c3e620e3851f2e18b518f5e34869978b3
Instruction ID: 03b7b369dbfb37e818b9a7bba03e92a1297908af1eb69fa71413071151118b69
Opcode Fuzzy Hash: ff8da17e9ad61dbf7719b97cca7bcf2c3e620e3851f2e18b518f5e34869978b3
Instruction Fuzzy Hash: D5019E76B08B5481DA009F1AF20006EA3B1F789FC8B148972EF5C47B59DF79D5A28344

Non-executed Functions

Function 00007FF6B270BFAC Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6B270BFC8
memset.VCRUNTIME140 ref: 00007FF6B270BFEC
RtlCaptureContext.KERNEL32 ref: 00007FF6B270BFF5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B270C00F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B270C050
memset.VCRUNTIME140 ref: 00007FF6B270C083
IsDebuggerPresent.KERNEL32 ref: 00007FF6B270C0A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B270C0C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B270C0CC

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction ID: c7d0d002384112a2ad07fac08acc290f58b99fd556a1ba713c463dd75d2e8758
Opcode Fuzzy Hash: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction Fuzzy Hash: E1319372608B8186EB658F64E8407EE73A0FB86308F04403ADB4D83B94DF79D54CC714

Function 00007FF6B270C1BC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B270C1E8
GetCurrentThreadId.KERNEL32 ref: 00007FF6B270C1F6
GetCurrentProcessId.KERNEL32 ref: 00007FF6B270C202
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B270C212

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction ID: 74c04a5d5d9e3d4740e484773aea4a2178ca1954e3c487f7ef612eeef14d16e7
Opcode Fuzzy Hash: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction Fuzzy Hash: 25111832B14B018AEB00CBA4E8552A933A4FB5A758F441E35DB6D867A4DFB8D5998380

Function 00007FF6B270C150 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction ID: 3b4a285beadc1102413f7d948eb5e36de4daf554bf5d73a1c001185f444c697b
Opcode Fuzzy Hash: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction Fuzzy Hash: D5A0026190CC0AD1E6468B08E85453333B0FB6674CB504536E60EC11A0DFFEA819C30C

Function 00007FF6B2708BE0 Relevance: 15.3, APIs: 10, Instructions: 333COMMON

Download Yara Rule

APIs

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF6B2708CC0
memcpy.VCRUNTIME140 ref: 00007FF6B2708D7D
memcpy.VCRUNTIME140 ref: 00007FF6B2708FA9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2708FDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270901D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2709060
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2709099
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270909F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B27090A5

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$memcpy$?out@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 4130688501-0
Opcode ID: 2b9501c16fc8f87c1c24aa571445dab11a5c62af2750a3bf7ecf3f5afa55e55d
Instruction ID: aef593bc84a90278f099fa30ed0466a9a711412b80fb425117ee569a75608680
Opcode Fuzzy Hash: 2b9501c16fc8f87c1c24aa571445dab11a5c62af2750a3bf7ecf3f5afa55e55d
Instruction Fuzzy Hash: C3D1C322F19B4285EB02CB68D4503BE23A1AB4A79CF404671DF5D92BD5DFBDE5898308

Function 00007FF6B2709820 Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B270986D
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6B270988D
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B270989D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B27098FD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B2709926
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B270995D
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6B27099A1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6B27099A8
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6B27099B5

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: ?sputc@?$basic_streambuf@D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 569342377-0
Opcode ID: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction ID: b28e5601730f11c4a4d70c32122c942511427e1d8523077fd5cdb91b37f3babf
Opcode Fuzzy Hash: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction Fuzzy Hash: 4E514432A09A81C6EB118F19D5D0139B7E0FB85F99B158531CF5E877A0CF7AD45AC344

Function 00007FF6B270B250 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B270B2B5
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6B270B2D5
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6B270B2E5
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B270B32C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6B270B359
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6B270B37A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6B270B3C0
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6B270B3C7
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6B270B3D4

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction ID: ffb304ac25aa81f592369a7bbc755b8d519c57ce2873af4c867d0beb6a82d262
Opcode Fuzzy Hash: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction Fuzzy Hash: 52512332608A4182EB218F1ED59023EA7E1FB86F99B15D531DF5E83764CF7ED54A8308

Function 00007FF6B27090C0 Relevance: 10.8, APIs: 7, Instructions: 273COMMON

Download Yara Rule

APIs

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF6B27091A6
memcpy.VCRUNTIME140 ref: 00007FF6B270925E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2709353
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270946E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B27094BE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B27094C5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B27094CB

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$?in@?$codecvt@Mbstatet@@Mbstatet@@@std@@memcpy
String ID:
API String ID: 281699261-0
Opcode ID: c32ee648c69035889f8e0650f685f1d6b72f3f4abed251812f6324048fb66d7b
Instruction ID: bb5903554fc138b146019cb72087224d8f42ef150c564a74ac538b6f41e12773
Opcode Fuzzy Hash: c32ee648c69035889f8e0650f685f1d6b72f3f4abed251812f6324048fb66d7b
Instruction Fuzzy Hash: D3B1B062F18A45D5EB01CB68D4543AE33A1EB4AB9CF404631DB5D93BD8EFB9D188C348

Function 00007FF6B2706EF0 Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6B2706FA2

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: f0efb582e9fd0d0aec3b92626ce79b77502db8850f48cde8c95ecbadf30f19f3
Instruction ID: f923fd33925cb57aff0a09b9865b428317999b0fb4191fc93befdd064a0ef571
Opcode Fuzzy Hash: f0efb582e9fd0d0aec3b92626ce79b77502db8850f48cde8c95ecbadf30f19f3
Instruction Fuzzy Hash: F4819932B14A8189EB11CF68D4803AD37B0FB49B68F541632DB5D93B98DF79D499C304

Function 00007FF6B270AE70 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6B270AF04
memcpy.VCRUNTIME140 ref: 00007FF6B270AF48
memcpy.VCRUNTIME140 ref: 00007FF6B270AF60
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270AFE8
memcpy.VCRUNTIME140 ref: 00007FF6B270B015
memcpy.VCRUNTIME140 ref: 00007FF6B270B030
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270B053

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: c2ecc101523887dfbce848d0c382d276e7dab405c5916f86757184a1f49b3e57
Instruction ID: e39d9f4573353596a56ff995ea13600b92073445e570803f9b27449a3651bc7f
Opcode Fuzzy Hash: c2ecc101523887dfbce848d0c382d276e7dab405c5916f86757184a1f49b3e57
Instruction Fuzzy Hash: 2B51E763A04B8181EB11DF29D1042AE23A1FB16BCCF104636DF2C97395CFBAE699D344

Function 00007FF6B270AC60 Relevance: 10.6, APIs: 7, Instructions: 145COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF6B27057DE), ref: 00007FF6B270ACF7
memcpy.VCRUNTIME140(?,?,?,00007FF6B27057DE), ref: 00007FF6B270AD42
memcpy.VCRUNTIME140(?,?,?,00007FF6B27057DE), ref: 00007FF6B270AD5A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6B27057DE), ref: 00007FF6B270ADF9

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

memcpy.VCRUNTIME140(?,?,?,00007FF6B27057DE), ref: 00007FF6B270AE29
memcpy.VCRUNTIME140(?,?,?,00007FF6B27057DE), ref: 00007FF6B270AE47
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270AE6A

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 3b1734b16001e6aae9ffa7fa666c80b4a0036caafceed5919fb728048b8fe9a5
Instruction ID: 7853c8449a8e8954718d5053e28529747af058e80a40e77cef562f433c9d4600
Opcode Fuzzy Hash: 3b1734b16001e6aae9ffa7fa666c80b4a0036caafceed5919fb728048b8fe9a5
Instruction Fuzzy Hash: 9851D222E04B4191EB11AF29D4042AE33A0FB56B98F644B36DF6C933C5DFB9E198C344

Function 00007FF6B27084B0 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6B2708E38), ref: 00007FF6B2708580

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

Part of subcall function 00007FF6B2701310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6B270131B

memcpy.VCRUNTIME140(?,?,?,00007FF6B2708E38), ref: 00007FF6B27085A1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B27085BC

Part of subcall function 00007FF6B2701270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B270B543), ref: 00007FF6B27012B4

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF6B2708E38), ref: 00007FF6B2708625
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF6B2708E38), ref: 00007FF6B270862E

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_taskXlength_error@std@@__std_exception_copy_invalid_parameter_noinfo_noreturnmallocmemcpy
String ID:
API String ID: 2733788171-0
Opcode ID: cc599559b1e2dc559bef56f8741a9cfb5031f2f9e9da837cb50f94ad93c65c76
Instruction ID: a9ad5b29094bc888eb412543f0860ce36705abcf76fd29f03675756cc9c0b0d5
Opcode Fuzzy Hash: cc599559b1e2dc559bef56f8741a9cfb5031f2f9e9da837cb50f94ad93c65c76
Instruction Fuzzy Hash: 4A41C332B05B5281EB559B29E4403BE3391EB45BACF148632DB2C837D6DEB9D4DA8704

Function 00007FF6B270CF76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF6B270CFAB
__current_exception_context.VCRUNTIME140 ref: 00007FF6B270CFBF
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B270CFC7

Strings

csm, xrefs: 00007FF6B270CF97

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction ID: 9473f1e1b167d7cba1ef3f5972aa375f613c0297a7c6d17e783910e0fb1ea108
Opcode Fuzzy Hash: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction Fuzzy Hash: B1F04937615B40CAC3119F25E8840AC33A4F74DB8CB4A6235FB4D87755CF39D8948305

Function 00007FF6B270A570 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270A6CB

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1ef9cebed11aa757f790f007fe67e90c90a9a1ada4030d4e0cebe6aba601f67a
Instruction ID: e5500b86edf763e88fce1e012a830ece2891c1cfbac3ed17785e514b0e23aebc
Opcode Fuzzy Hash: 1ef9cebed11aa757f790f007fe67e90c90a9a1ada4030d4e0cebe6aba601f67a
Instruction Fuzzy Hash: 3121C610B2429A59ED192A7F49054A707516F26FF8F384B30FF3C47BD2DDA9E4468708

Function 00007FF6B2707330 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction ID: 40facb2893308862fe7a3320687d24d2759ebedfabda147977cf59df65c5a642
Opcode Fuzzy Hash: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction Fuzzy Hash: 77518332608A8185DB558F6CE45036EB7E0FB85B98F544236EB9D87798DF7DC448C704

Function 00007FF6B2709E30 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF6B2705133), ref: 00007FF6B2709F3A

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6B2705133), ref: 00007FF6B2709F65
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6B2705133), ref: 00007FF6B2709F75
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B2709FA9

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: aaed713836a9e07829c7c5aa24cae673d9406276abb4a7650c50821929c431c8
Instruction ID: 5ad1a3b996a53505a83780a376434e743b49c1c29191ad0429bd23839b729498
Opcode Fuzzy Hash: aaed713836a9e07829c7c5aa24cae673d9406276abb4a7650c50821929c431c8
Instruction Fuzzy Hash: 3641CF22B18A5181EA11DB16A40026A6394EB4AFF8F544731EF7D877C4EEBDE489C304

Function 00007FF6B2708280 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6B27082EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6B2708370
memcpy.VCRUNTIME140 ref: 00007FF6B2708396
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B27083BA

Part of subcall function 00007FF6B270B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6B270107B), ref: 00007FF6B270B522

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 02b2daf3b4cdd67512b4dcb332c80498ab88a7d2536f8d74dc2c416b8924f1bd
Instruction ID: ee4e4ebad461a951a4dca3d50bbae1c31815514dfc4b70f0bd5c77d1c4a22723
Opcode Fuzzy Hash: 02b2daf3b4cdd67512b4dcb332c80498ab88a7d2536f8d74dc2c416b8924f1bd
Instruction Fuzzy Hash: 5E31E622A09B4181E9159B19950027E63D1EB46BB8F240B34DF7D877D0DFBDE4868348

Function 00007FF6B270A0C0 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6B270A0F8
memcpy.VCRUNTIME140 ref: 00007FF6B270A198
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B270A1B6

Memory Dump Source

Source File: 00000000.00000002.1576590528.00007FF6B2701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2700000, based on PE: true

Associated: 00000000.00000002.1576574673.00007FF6B2700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576612753.00007FF6B270E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576635338.00007FF6B2715000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1576665489.00007FF6B2716000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2700000_systemConfigChecker.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: 1b4f2082b6732203ba004f792acabdaaba1c17f9c324c4eb6b640517a242389a
Instruction ID: 3e857386a0e3dcf12c3af1f008a08cf5422c9b55130c88bfb5831f806a1189a6
Opcode Fuzzy Hash: 1b4f2082b6732203ba004f792acabdaaba1c17f9c324c4eb6b640517a242389a
Instruction Fuzzy Hash: FE21D822B0974249EB169B19A5403FE23E09F067F8F140730DF6D877C6DEBD99968304

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report systemConfigChecker.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
systemConfigChecker.exe

Function 00007FF6B2705D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Function 00007FF6B2705510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Function 00007FF6B2704A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Function 00007FF6B2704E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Function 00007FF6B2704640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Function 00007FF6B2703780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Function 00007FF6B2703AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Function 00007FF6B2703560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Function 00007FF6B2701820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Function 00007FF6B2701520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 173
COMMON

Function 00007FF6B27089E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Function 00007FF6B2704390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Function 00007FF6B2709C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Function 00007FF6B27099F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Function 00007FF6B270B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON