Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DRAKETAX2023.EXE

Overview

General Information

Sample name:DRAKETAX2023.EXE
Analysis ID:1523773
MD5:5f78842863d480ceb757501585bbe0dd
SHA1:a3b6f8e2e7d32cfedc933b0b2a84832f81ab08cd
SHA256:2a3d437535627175832dfbbfb27c678512835d9d36f5ef94e68373cac72c6ec9

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • DRAKETAX2023.EXE (PID: 7272 cmdline: "C:\Users\user\Desktop\DRAKETAX2023.EXE" MD5: 5F78842863D480CEB757501585BBE0DD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: DRAKETAX2023.EXEStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: DRAKETAX2023.EXEStatic PE information: certificate valid
Source: DRAKETAX2023.EXEStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdbnnnGCTL source: DRAKETAX2023.EXE
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb source: DRAKETAX2023.EXE
Source: DRAKETAX2023.EXEString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: DRAKETAX2023.EXEString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: DRAKETAX2023.EXEString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: DRAKETAX2023.EXEString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: DRAKETAX2023.EXEString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: DRAKETAX2023.EXEString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: DRAKETAX2023.EXEString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: DRAKETAX2023.EXEString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: DRAKETAX2023.EXEString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: DRAKETAX2023.EXEString found in binary or memory: http://ocsp.digicert.com0
Source: DRAKETAX2023.EXEString found in binary or memory: http://ocsp.digicert.com0A
Source: DRAKETAX2023.EXEString found in binary or memory: http://ocsp.digicert.com0C
Source: DRAKETAX2023.EXEString found in binary or memory: http://ocsp.digicert.com0X
Source: DRAKETAX2023.EXEString found in binary or memory: http://www.digicert.com/CPS0
Source: DRAKETAX2023.EXEString found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: DRAKETAX2023.EXEString found in binary or memory: https://aka.ms/dotnet-core-applaunch?Architecture:
Source: DRAKETAX2023.EXEString found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: DRAKETAX2023.EXEStatic PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"
Source: DRAKETAX2023.EXE, 00000000.00000002.1644002875.0000000000D3B000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDrakeTax2023.dllF vs DRAKETAX2023.EXE
Source: DRAKETAX2023.EXEBinary or memory string: OriginalFilenameDrakeTax2023.dllF vs DRAKETAX2023.EXE
Source: DRAKETAX2023.EXEStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: clean2.winEXE@1/0@0/0
Source: DRAKETAX2023.EXEStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DRAKETAX2023.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: DRAKETAX2023.EXEString found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: C:\Users\user\Desktop\DRAKETAX2023.EXESection loaded: kernel.appcore.dllJump to behavior
Source: DRAKETAX2023.EXEStatic PE information: certificate valid
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: DRAKETAX2023.EXEStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: DRAKETAX2023.EXEStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdbnnnGCTL source: DRAKETAX2023.EXE
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb source: DRAKETAX2023.EXE
Source: DRAKETAX2023.EXEStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DRAKETAX2023.EXEStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DRAKETAX2023.EXEStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DRAKETAX2023.EXEStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DRAKETAX2023.EXEStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
DRAKETAX2023.EXE0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://aka.ms/dotnet/app-launch-failedDRAKETAX2023.EXEfalse
    		unknown
    https://aka.ms/dotnet-core-applaunch?DRAKETAX2023.EXEfalse
      		unknown
      https://aka.ms/dotnet-core-applaunch?Architecture:DRAKETAX2023.EXEfalse
        		unknown

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1523773
        Start date and time:2024-10-02 01:52:14 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 1m 27s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:1
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:DRAKETAX2023.EXE
        Detection:CLEAN
        Classification:clean2.winEXE@1/0@0/0
        Cookbook Comments:
        • Found application associated with file extension: .EXE
        • Stop behavior analysis, all processes terminated

        Warnings

        • VT rate limit hit for: DRAKETAX2023.EXE

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32 executable (GUI) Intel 80386, for MS Windows
        Entropy (8bit):4.156571664816142
        TrID:
        • Win32 Executable (generic) a (10002005/4) 99.96%
        • Generic Win/DOS Executable (2004/3) 0.02%
        • DOS Executable Generic (2002/1) 0.02%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:DRAKETAX2023.EXE
        File size:453'920 bytes
        MD5:5f78842863d480ceb757501585bbe0dd
        SHA1:a3b6f8e2e7d32cfedc933b0b2a84832f81ab08cd
        SHA256:2a3d437535627175832dfbbfb27c678512835d9d36f5ef94e68373cac72c6ec9
        SHA512:fc12211198075ddee6d5ca75ac3666028d21edc3bf06398cfece317fffff6490e8daf10dc41a23b5267cae9b5d17531c7d656d9de7694424baa11b9eb8c6ec6f
        SSDEEP:3072:oRr6HEUvvsPuIj2a5bhCj7Nlixx8UeUi0X2ySD029uAOWDm5U:aUv34kRUi0XyD8WX
        TLSH:13A4B4E1F7BF8C63E4530AB0D9E49AB17679BD244B6047DB33F8760949F01C126B1A26
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B\P..=>..=>..=>..B:..=>..B=..=>..B;.R=>..E...=>.ME?..=>..=?..=>.>.7..=>.>.<..=>.Rich.=>.................PE..L.....Ae...........

        File Icon

        Icon Hash:176d48c9cc4c2b97

        Static PE Info

        General

        Entrypoint:0x40e590
        Entrypoint Section:.text
        Digitally signed:true
        Imagebase:0x400000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
        Time Stamp:0x65410000 [Tue Oct 31 13:24:16 2023 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:6
        OS Version Minor:0
        File Version Major:6
        File Version Minor:0
        Subsystem Version Major:6
        Subsystem Version Minor:0
        Import Hash:a075a59db5a698d8bc78c00dfa213c20

        Authenticode Signature

        Signature Valid:true
        Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
        Signature Validation Error:The operation completed successfully
        Error Number:0
        Not Before, Not After
        • 24/08/2022 01:00:00 24/08/2025 00:59:59
        Subject Chain
        • CN="Drake Software, LLC", O="Drake Software, LLC", L=Franklin, S=North Carolina, C=US
        Version:3
        Thumbprint MD5:9EC5AFC70F2A7574513B314779B7C043
        Thumbprint SHA-1:B4D4EE74455E2718B4F45FC30343CFF3748A42F5
        Thumbprint SHA-256:8BBECA315F29FEC97E85580A7445176D7BA0E1CAE4A64D325EF6CB63419F6030
        Serial:0376FD24C4A883A58095A86563C111D3

        Entrypoint Preview

        Instruction
        call 00007F0198DADBD2h
        jmp 00007F0198DAD42Dh
        mov ecx, dword ptr [ebp-0Ch]
        mov dword ptr fs:[00000000h], ecx
        pop ecx
        pop edi
        pop edi
        pop esi
        pop ebx
        mov esp, ebp
        pop ebp
        push ecx
        ret
        push eax
        push dword ptr fs:[00000000h]
        lea eax, dword ptr [esp+0Ch]
        sub esp, dword ptr [esp+0Ch]
        push ebx
        push esi
        push edi
        mov dword ptr [eax], ebp
        mov ebp, eax
        mov eax, dword ptr [0041A014h]
        xor eax, ebp
        push eax
        push dword ptr [ebp-04h]
        mov dword ptr [ebp-04h], FFFFFFFFh
        lea eax, dword ptr [ebp-0Ch]
        mov dword ptr fs:[00000000h], eax
        ret
        push eax
        push dword ptr fs:[00000000h]
        lea eax, dword ptr [esp+0Ch]
        sub esp, dword ptr [esp+0Ch]
        push ebx
        push esi
        push edi
        mov dword ptr [eax], ebp
        mov ebp, eax
        mov eax, dword ptr [0041A014h]
        xor eax, ebp
        push eax
        mov dword ptr [ebp-10h], esp
        push dword ptr [ebp-04h]
        mov dword ptr [ebp-04h], FFFFFFFFh
        lea eax, dword ptr [ebp-0Ch]
        mov dword ptr fs:[00000000h], eax
        ret
        int3
        int3
        int3
        int3
        int3
        int3
        int3
        int3
        int3
        push ebp
        mov ebp, esp
        and dword ptr [0041AB80h], 00000000h
        sub esp, 24h
        or dword ptr [0041A020h], 01h
        push 0000000Ah
        call dword ptr [004130BCh]
        test eax, eax
        je 00007F0198DAD772h
        and dword ptr [ebp-10h], 00000000h
        xor eax, eax
        push ebx
        push esi
        push edi
        xor ecx, ecx
        lea edi, dword ptr [ebp-24h]
        push ebx
        cpuid
        mov esi, ebx

        Rich Headers

        Programming Language:
        • [IMP] VS2008 SP1 build 30729

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x18fa80x104.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1d0000x52468.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
        IMAGE_DIRECTORY_ENTRY_SECURITY0x6c6000x2720.rsrc
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1b0000x1080.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x173500x54.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x173c00x18.rdata
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x172900x40.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x130000x1fc.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x112aa0x1140067be996cc497ddc5879936f4947766d1False0.4977638134057971data6.437144653107767IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0x130000x6c060x6e0053d875ff81c38a143fe1d28610cf9174False0.3489701704545455data4.432650710645495IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x1a0000xfec0x800f49b397124e7d440e8f29e1f8d451f2dFalse0.20068359375DOS executable (block device driver \377\377\377\377\261)2.66254945529702IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .reloc0x1b0000x10800x12007140776eceee7e55c32f7f897ab817b7False0.7599826388888888data6.368522938616639IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        .rsrc0x1d0000x524680x526002f527ce8d1c8bf83c0650498f874927bFalse0.0630749715477997data2.7583716327680143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

        Resources

        NameRVASizeTypeLanguageCountryZLIB Complexity
        RT_ICON0x1d1f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.45390070921985815
        RT_ICON0x1d6580x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.3372093023255814
        RT_ICON0x1dd100x988Device independent bitmap graphic, 24 x 48 x 32, image size 00.28114754098360656
        RT_ICON0x1e6980x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.2171669793621013
        RT_ICON0x1f7400x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 00.21760355029585798
        RT_ICON0x211a80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.18692946058091287
        RT_ICON0x237500x3a48Device independent bitmap graphic, 60 x 120 x 32, image size 00.1524798927613941
        RT_ICON0x271980x5488Device independent bitmap graphic, 72 x 144 x 32, image size 00.12818853974121996
        RT_ICON0x2c6200x42028Device independent bitmap graphic, 256 x 512 x 32, image size 00.035247211290942985
        RT_GROUP_ICON0x6e6480x84data0.7272727272727273
        RT_VERSION0x6e6cc0x400MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"0.4169921875
        RT_MANIFEST0x6eacc0x8d9XML 1.0 document, ASCII text, with CRLF line terminators0.35673289183222956

        Imports

        DLLImport
        KERNEL32.dllFreeLibrary, LoadLibraryExW, OutputDebugStringW, FindFirstFileExW, EnterCriticalSection, GetFullPathNameW, FindNextFileW, GetCurrentProcess, GetModuleHandleExW, GetModuleFileNameW, LeaveCriticalSection, GetEnvironmentVariableW, GetModuleHandleW, MultiByteToWideChar, GetFileAttributesExW, LoadLibraryA, DeleteCriticalSection, WideCharToMultiByte, IsWow64Process, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, GetProcAddress, GetWindowsDirectoryW, FindResourceW, GetLastError, ActivateActCtx, FindClose, CreateActCtxW, SetLastError, RaiseException, RtlUnwind, InitializeSListHead, GetCurrentProcessId, IsDebuggerPresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsProcessorFeaturePresent, GetStringTypeW, SwitchToThread, GetCurrentThreadId, InitializeCriticalSectionEx, EncodePointer, DecodePointer, LCMapStringEx, QueryPerformanceCounter, GetSystemTimeAsFileTime
        USER32.dllMessageBoxW
        SHELL32.dllShellExecuteW
        ADVAPI32.dllRegOpenKeyExW, RegGetValueW, DeregisterEventSource, RegisterEventSourceW, ReportEventW, RegCloseKey
        api-ms-win-crt-runtime-l1-1-0.dll_invalid_parameter_noinfo_noreturn, _exit, exit, _initterm_e, _initterm, _get_initial_wide_environment, _initialize_wide_environment, _configure_wide_argv, _set_app_type, _seh_filter_exe, _cexit, _crt_atexit, _errno, _register_onexit_function, _initialize_onexit_table, abort, __p___wargv, _c_exit, _register_thread_local_exe_atexit_callback, terminate, _controlfp_s, __p___argc
        api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func, fputwc, __p__commode, _set_fmode, fputws, _wfsopen, fflush, __stdio_common_vfwprintf, __stdio_common_vsnwprintf_s, __stdio_common_vswprintf, setvbuf
        api-ms-win-crt-heap-l1-1-0.dll_callnewh, free, malloc, calloc, _set_new_mode
        api-ms-win-crt-string-l1-1-0.dlltoupper, _wcsdup, wcsncmp, wcsnlen, strcpy_s
        api-ms-win-crt-convert-l1-1-0.dll_wtoi, wcstoul
        api-ms-win-crt-time-l1-1-0.dll_gmtime64_s, _time64, wcsftime
        api-ms-win-crt-locale-l1-1-0.dll___mb_cur_max_func, ___lc_codepage_func, ___lc_locale_name_func, __pctype_func, setlocale, _configthreadlocale, _unlock_locales, _lock_locales
        api-ms-win-crt-math-l1-1-0.dll__setusermatherr

        Network Behavior

        ⊘No network behavior found

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:19:53:02
        Start date:01/10/2024
        Path:C:\Users\user\Desktop\DRAKETAX2023.EXE
        Wow64 process (32bit):true
        Commandline:"C:\Users\user\Desktop\DRAKETAX2023.EXE"
        Imagebase:0xd20000
        File size:453'920 bytes
        MD5 hash:5F78842863D480CEB757501585BBE0DD
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        Disassembly

        ⊘No disassembly