Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe
Analysis ID:1429005
MD5:a55b12fe926fe729cab1e8a49ef53dd7
SHA1:b54c1d78895dbcf36ecb2c449fd5cddedfcda956
SHA256:6945efb2872ae57d20573a8ad5e99a0b8ecfa6120435262f58d706caa61b2d84
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to inject threads in other processes
Detected potential crypto function
PE file contains more sections than normal
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeReversingLabs: Detection: 18%
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE147500_2_00007FF71AE14750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE159300_2_00007FF71AE15930
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: Number of sections : 20 > 10
Source: classification engineClassification label: mal52.evad.winEXE@2/1@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE115F0 CreateToolhelp32Snapshot,Process32First,CloseHandle,FindCloseChangeNotification,0_2_00007FF71AE115F0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4768:120:WilError_03
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeReversingLabs: Detection: 18%
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: .xdata
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /4
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /19
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /31
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /45
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /57
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /70
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /81
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /97
Source: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeStatic PE information: section name: /113
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeProcess information queried: ProcessInformationJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE11180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,0_2_00007FF71AE11180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE1F358 SetUnhandledExceptionFilter,TlsGetValue,0_2_00007FF71AE1F358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE11F61 SetUnhandledExceptionFilter,0_2_00007FF71AE11F61

HIPS / PFW / Operating System Protection Evasion

barindex
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exeCode function: 0_2_00007FF71AE11806 SetConsoleTitleA,SetConsoleTitleA,GetStdHandle,SetConsoleTextAttribute,SetConsoleTextAttribute,SetConsoleCtrlHandler,Sleep,SleepEx,SetConsoleTextAttribute,SetConsoleTextAttribute,GetCurrentDirectoryA,fopen,SetConsoleTextAttribute,SetConsoleTextAttribute,SetConsoleTextAttribute,getchar,_fgetchar,OpenProcess,SetConsoleTextAttribute,getchar,strlen,VirtualAllocEx,SetConsoleTextAttribute,getchar,strlen,WriteProcessMemory,SetConsoleTextAttribute,getchar,GetModuleHandleA,GetProcAddress,CreateRemoteThread,SetConsoleTextAttribute,getchar,CloseHandle,VirtualFreeEx,OpenProcess,WaitForSingleObject,SetConsoleTextAttribute,CloseHandle,getchar,0_2_00007FF71AE11806

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception11
Process Injection		11
Process Injection		OS Credential Dumping2
Process Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe18%ReversingLabsWin64.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1429005
Start date and time:2024-04-20 01:32:06 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 56s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe
Detection:MAL
Classification:mal52.evad.winEXE@2/1@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 5
  • Number of non-executed functions: 16
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File
Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):90
Entropy (8bit):4.8686608475575435
Encrypted:false
SSDEEP:3:wPLsFgWMND9I2TG584Za7I9+SZMLDnNv:wPLsFgWOa2O8B7IPMnnNv
MD5:3486D9F186227928FD5F839525883943
SHA1:4625A1FB2EA090B40299C5083D1A98432D07E70A
SHA-256:B54F05208EA30042B495E72F4BE4007C777F840C09CA36C2CEA3F5655DFC0DD6
SHA-512:6E2412BAE9512EDD76153A8705443B14F782E63CC761941DE05E99C1901D8D886698F5C49293D7AFE9CC107F4179BF6E9861A4F3ACC890444B0D5DFCE058A252
Malicious:false
Reputation:low
Preview:[*] Waiting for Rustclient.exe.....[*] Successfully got PID: 0..[!] Couldn't Find Smeg?...

Static File Info

General

File type:PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):5.822891632607638
TrID:
  • Win64 Executable Console (202006/5) 92.65%
  • Win64 Executable (generic) (12005/4) 5.51%
  • Generic Win/DOS Executable (2004/3) 0.92%
  • DOS Executable Generic (2002/1) 0.92%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe
File size:262'755 bytes
MD5:a55b12fe926fe729cab1e8a49ef53dd7
SHA1:b54c1d78895dbcf36ecb2c449fd5cddedfcda956
SHA256:6945efb2872ae57d20573a8ad5e99a0b8ecfa6120435262f58d706caa61b2d84
SHA512:5597268a45130be61f55b5131509d9592739bd262fba1bcda25b34b0988442ba6f1c85896f59ab5ca054598875f697af86af9147069461d89585fca49aaf6c5d
SSDEEP:3072:zNtIm4G+xUBPfZY7BFkFifxSwmn1Om1sgIkDHQton1CWFZdr7uDxuz3TsOcrCtnA:8dfxk6gAf6nQS1jFB3TsOcreNBM
TLSH:16445AC1FBC9ACDAC7155235899F83693338FAD007975B132E2A73341E17AD0AE86647
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....fe.N..d.....&....(.x.....................@............................. ............`... ............................

File Icon

Icon Hash:00928e8e8686b000

Static PE Info

General

Entrypoint:0x1400013f0
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x140000000
Subsystem:windows cui
Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:0x656680AF [Wed Nov 29 00:07:11 2023 UTC]
TLS Callbacks:0x40002110, 0x1, 0x400020e0, 0x1
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:288919fe5cb331e1097ebdebffe68a14

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000096A5h]
mov dword ptr [eax], 00000000h
call 00007F3D48679A8Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F3D48680EB4h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F3D48679CE9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
push ebx
dec eax
sub esp, 38h
dec eax
lea ebp, dword ptr [esp+30h]
dec eax
mov dword ptr [ebp+20h], ecx
dec eax
mov dword ptr [ebp+28h], edx
dec esp
mov dword ptr [ebp+30h], eax
dec esp
mov dword ptr [ebp+38h], ecx
dec eax
lea eax, dword ptr [ebp+28h]
dec eax
mov dword ptr [ebp-10h], eax
dec eax
mov ebx, dword ptr [ebp-10h]
mov ecx, 00000001h
dec eax
mov eax, dword ptr [00007C3Dh]
call eax
dec eax
mov ecx, eax
dec eax
mov eax, dword ptr [ebp+20h]
dec ecx
mov eax, ebx
dec eax
mov edx, eax
call 00007F3D4867B91Eh
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 38h
pop ebx
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov dword ptr [ebp+10h], ecx
dec eax
mov dword ptr [ebp+18h], edx
dec eax
mov edx, dword ptr [ebp+10h]

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0xf0000xaa8.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x120000x4e8.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0xc0000x4bc.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x130000x84.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0xa3600x28.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0xf2a80x258.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x76f80x7800005588ca27e683100865eca7986f0726False0.57255859375data6.229149819522027IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x90000xd00x20038714103042774f37e8ccd432a423646False0.146484375data0.9349841751373522IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata0xa0000x13400x140082bee0116a8a36cc2a2cfa211cba6e76False0.2923828125data5.250736990296306IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata0xc0000x4bc0x600790f5ccc7f710daf35a98ea6aa41a7deFalse0.4264322916666667data3.512868987612826IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata0xd0000x4800x600e9e47acf8ad6964c9c5f7de43d1e93e1False0.283203125data3.677201001454678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss0xe0000xb800x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata0xf0000xaa80xc0083a5ba6e65c11bef1f51c06400625e65False0.3238932291666667data3.7495059248319142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT0x100000x600x200e88054fd8d8c089af4feb0d63f87d25bFalse0.06640625data0.28508543466005165IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls0x110000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0x120000x4e80x60008d63de6c16dc89e1209ee48225e35dfFalse0.3326822916666667data4.776848300740951IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc0x130000x840x200aae73d2e989105ed103af7039b04dc37False0.255859375data1.511514119161658IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/40x140000x6200x800ae82c4c6e8126cb26b24c4bf3d9812d7False0.18017578125data1.4523370873255197IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/190x150000x11ee20x12000e79e8104b2f027469969d2aac619edf7False0.4268663194444444data5.7821636287769085IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/310x270000x32110x340023f3f232af3fe16014a06473275aa577False0.24489182692307693data4.774011686655647IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/450x2b0000x690f0x6a00dab718e178a2156bd3943121b401fe24False0.5267909787735849data5.090598659903541IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/570x320000x21200x2200b6fa2b38df37df31df527700e247c2c6False0.22093290441176472data3.5742441644001346IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/700x350000x39d0x4007525f1145b47b06d73d7667bb1386b5fFalse0.435546875data4.6233906248986IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/810x360000x29970x2a004217cdf4eb7f96986c8617a34ef99f88False0.09756324404761904data4.743102064571958IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/970x390000x787d0x7a00b6823d3ca099f5facdec927fe3caafb1False0.5150806864754098data5.824323962581455IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/1130x410000x5260x60067efb8bbc40d346fc101be21c97c0d10False0.6341145833333334data5.267177788741966IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_MANIFEST0x120580x48fXML 1.0 document, ASCII text0.40102827763496146

Imports

DLLImport
KERNEL32.dllCloseHandle, CreateRemoteThread, CreateToolhelp32Snapshot, DeleteCriticalSection, DeleteFileW, EnterCriticalSection, ExitProcess, GetCurrentDirectoryA, GetLastError, GetModuleHandleA, GetProcAddress, GetStdHandle, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, OpenProcess, Process32First, Process32Next, SetConsoleCtrlHandler, SetConsoleTextAttribute, SetConsoleTitleA, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, VirtualAllocEx, VirtualFreeEx, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, WriteProcessMemory, __C_specific_handler
msvcrt.dll___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _lock, _onexit, _unlock, abort, calloc, exit, fclose, fopen, fprintf, fputc, free, fwrite, getchar, localeconv, malloc, memcpy, memset, signal, strcmp, strerror, strlen, strncmp, vfprintf, wcslen
USER32.dllMessageBoxA

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:01:32:53
Start date:20/04/2024
Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe
Wow64 process (32bit):false
Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.71649694.17364.11303.exe"
Imagebase:0x7ff71ae10000
File size:262'755 bytes
MD5 hash:A55B12FE926FE729CAB1E8A49EF53DD7
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:false

General

Target ID:1
Start time:01:32:53
Start date:20/04/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:false

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:6.5%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:18.2%
    Total number of Nodes:654
    Total number of Limit Nodes:6
    execution_graph 3188 7ff71ae1530a 3189 7ff71ae131e0 fputc 3188->3189 3190 7ff71ae1531c 3189->3190 3190->3190 3191 7ff71ae18689 LeaveCriticalSection 3192 7ff71ae11010 3194 7ff71ae1104b 3192->3194 3193 7ff71ae1106d __set_app_type 3195 7ff71ae11077 3193->3195 3194->3193 3194->3195 3196 7ff71ae12110 3197 7ff71ae12122 3196->3197 3199 7ff71ae12132 3197->3199 3201 7ff71ae12b60 3197->3201 3200 7ff71ae12185 3202 7ff71ae12b6e 3201->3202 3203 7ff71ae12c20 3201->3203 3204 7ff71ae12b74 3202->3204 3205 7ff71ae12bc0 3202->3205 3207 7ff71ae12b82 3202->3207 3203->3200 3206 7ff71ae12c40 InitializeCriticalSection 3204->3206 3204->3207 3205->3207 3208 7ff71ae12bf9 DeleteCriticalSection 3205->3208 3209 7ff71ae12be8 free 3205->3209 3206->3207 3207->3200 3208->3207 3209->3208 3209->3209 3213 7ff71ae17d90 3214 7ff71ae17380 6 API calls 3213->3214 3215 7ff71ae17dac 3214->3215 3216 7ff71ae15094 3217 7ff71ae152e9 3216->3217 3218 7ff71ae150ab 3216->3218 3219 7ff71ae145d0 30 API calls 3217->3219 3220 7ff71ae150c0 3218->3220 3227 7ff71ae145d0 3218->3227 3222 7ff71ae15305 3219->3222 3223 7ff71ae15287 3220->3223 3224 7ff71ae14450 28 API calls 3220->3224 3225 7ff71ae14450 28 API calls 3223->3225 3224->3220 3226 7ff71ae152a3 3225->3226 3228 7ff71ae146e8 3227->3228 3229 7ff71ae145e9 3227->3229 3231 7ff71ae13570 3 API calls 3228->3231 3230 7ff71ae130f0 15 API calls 3229->3230 3232 7ff71ae14611 3230->3232 3233 7ff71ae1470f 3231->3233 3232->3228 3234 7ff71ae14624 3232->3234 3233->3220 3235 7ff71ae14690 3234->3235 3238 7ff71ae14638 3234->3238 3236 7ff71ae1469f 3235->3236 3237 7ff71ae14694 strlen 3235->3237 3241 7ff71ae14380 11 API calls 3236->3241 3237->3236 3239 7ff71ae14720 strlen 3238->3239 3240 7ff71ae14640 3238->3240 3239->3240 3242 7ff71ae13fa0 11 API calls 3240->3242 3243 7ff71ae146b4 3241->3243 3244 7ff71ae14657 3242->3244 3243->3220 3245 7ff71ae1467a 3244->3245 3246 7ff71ae131e0 fputc 3244->3246 3245->3220 3246->3244 3247 7ff71ae15277 3248 7ff71ae15287 3247->3248 3249 7ff71ae150c0 3247->3249 3251 7ff71ae14450 28 API calls 3248->3251 3249->3248 3250 7ff71ae14450 28 API calls 3249->3250 3250->3249 3252 7ff71ae152a3 3251->3252 3253 7ff71ae150fa 3254 7ff71ae15287 3253->3254 3258 7ff71ae150c0 3253->3258 3256 7ff71ae14450 28 API calls 3254->3256 3255 7ff71ae14450 28 API calls 3255->3258 3257 7ff71ae152a3 3256->3257 3258->3253 3258->3255 3264 7ff71ae18500 ___mb_cur_max_func ___lc_codepage_func 3265 7ff71ae18220 4 API calls 3264->3265 3266 7ff71ae1854d 3265->3266 3270 7ff71ae14e83 3271 7ff71ae14e88 3270->3271 3272 7ff71ae13610 6 API calls 3271->3272 3272->3271 3276 7ff71ae15069 3277 7ff71ae1507f 3276->3277 3281 7ff71ae15089 3276->3281 3286 7ff71ae13520 3277->3286 3279 7ff71ae155ab 3283 7ff71ae13240 4 API calls 3279->3283 3280 7ff71ae1547b 3282 7ff71ae13240 4 API calls 3280->3282 3281->3279 3281->3280 3284 7ff71ae15495 3282->3284 3285 7ff71ae155c2 3283->3285 3285->3285 3287 7ff71ae13560 strlen 3286->3287 3288 7ff71ae13545 3286->3288 3287->3288 3288->3287 3289 7ff71ae183f0 ___lc_codepage_func ___mb_cur_max_func 3290 7ff71ae18449 3289->3290 3291 7ff71ae18430 3289->3291 3291->3290 3292 7ff71ae18441 3291->3292 3295 7ff71ae184b0 3291->3295 3292->3290 3294 7ff71ae18220 4 API calls 3292->3294 3293 7ff71ae18220 4 API calls 3293->3295 3294->3292 3295->3290 3295->3293 2754 7ff71ae113f0 2757 7ff71ae11180 2754->2757 2756 7ff71ae11406 2758 7ff71ae111b0 2757->2758 2759 7ff71ae111b9 Sleep 2758->2759 2760 7ff71ae111cd 2758->2760 2759->2758 2761 7ff71ae1134c _initterm 2760->2761 2762 7ff71ae11200 2760->2762 2765 7ff71ae112ee 2760->2765 2761->2762 2775 7ff71ae124a0 2762->2775 2764 7ff71ae11228 SetUnhandledExceptionFilter 2766 7ff71ae1124b 2764->2766 2768 7ff71ae11180 26 API calls 2765->2768 2774 7ff71ae11302 2765->2774 2767 7ff71ae11250 malloc 2766->2767 2767->2765 2769 7ff71ae1127a 2767->2769 2770 7ff71ae113e6 2768->2770 2771 7ff71ae11280 strlen malloc memcpy 2769->2771 2770->2756 2771->2771 2772 7ff71ae112b2 2771->2772 2797 7ff71ae11806 2772->2797 2774->2756 2777 7ff71ae124d8 2775->2777 2796 7ff71ae124c1 2775->2796 2776 7ff71ae127b0 2778 7ff71ae127b9 2776->2778 2776->2796 2777->2776 2779 7ff71ae126ce 2777->2779 2785 7ff71ae12552 2777->2785 2777->2796 2782 7ff71ae127dd 2778->2782 2901 7ff71ae12330 2778->2901 2779->2782 2787 7ff71ae126e9 2779->2787 2781 7ff71ae127ee 2783 7ff71ae122c0 8 API calls 2781->2783 2786 7ff71ae122c0 8 API calls 2782->2786 2784 7ff71ae127fa 2783->2784 2784->2764 2785->2779 2785->2781 2785->2782 2785->2787 2790 7ff71ae126fa 2785->2790 2792 7ff71ae125b0 2785->2792 2785->2796 2786->2781 2787->2790 2788 7ff71ae12330 8 API calls 2788->2790 2790->2787 2790->2788 2873 7ff71ae122c0 2790->2873 2791 7ff71ae12330 8 API calls 2791->2792 2792->2785 2792->2790 2792->2791 2793 7ff71ae12658 2792->2793 2794 7ff71ae12660 2792->2794 2793->2794 2795 7ff71ae12692 VirtualProtect 2794->2795 2794->2796 2795->2794 2796->2764 2929 7ff71ae120b0 2797->2929 2800 7ff71ae1183e SetConsoleTextAttribute 2801 7ff71ae11875 2800->2801 2931 7ff71ae11450 2801->2931 2803 7ff71ae11884 2935 7ff71ae115f0 2803->2935 2806 7ff71ae118ba SetConsoleTextAttribute 2807 7ff71ae11450 2 API calls 2806->2807 2808 7ff71ae118e9 2807->2808 2809 7ff71ae119e9 SetConsoleTextAttribute 2808->2809 2813 7ff71ae11ab7 2808->2813 2810 7ff71ae11450 2 API calls 2809->2810 2811 7ff71ae11a10 2810->2811 2939 7ff71ae1153f 2811->2939 2815 7ff71ae11b68 strlen 2813->2815 2816 7ff71ae11afe 2813->2816 2820 7ff71ae11ba3 2815->2820 2821 7ff71ae11450 2 API calls 2816->2821 2819 7ff71ae11aa8 getchar 2844 7ff71ae11b5e 2819->2844 2822 7ff71ae11c1e strlen 2820->2822 2823 7ff71ae11bb4 2820->2823 2824 7ff71ae11b25 getchar 2821->2824 2827 7ff71ae11c5d 2822->2827 2828 7ff71ae11450 2 API calls 2823->2828 2825 7ff71ae1153f DeleteFileW 2824->2825 2829 7ff71ae11b44 2825->2829 2826 7ff71ae11450 2 API calls 2830 7ff71ae11a76 2826->2830 2831 7ff71ae11c61 2827->2831 2841 7ff71ae11ccb 2827->2841 2832 7ff71ae11bdb getchar 2828->2832 2833 7ff71ae1155d DeleteFileW 2829->2833 2834 7ff71ae11450 2 API calls 2830->2834 2839 7ff71ae11450 2 API calls 2831->2839 2835 7ff71ae1153f DeleteFileW 2832->2835 2833->2844 2836 7ff71ae11a8f 2834->2836 2837 7ff71ae11bfa 2835->2837 2838 7ff71ae11450 2 API calls 2836->2838 2840 7ff71ae1155d DeleteFileW 2837->2840 2838->2819 2842 7ff71ae11c88 getchar 2839->2842 2840->2844 2847 7ff71ae11dbb 2841->2847 2848 7ff71ae11d51 2841->2848 2843 7ff71ae1153f DeleteFileW 2842->2843 2845 7ff71ae11ca7 2843->2845 2844->2765 2846 7ff71ae1155d DeleteFileW 2845->2846 2846->2844 2852 7ff71ae11450 2 API calls 2847->2852 2849 7ff71ae11450 2 API calls 2848->2849 2850 7ff71ae11d78 getchar 2849->2850 2851 7ff71ae1153f DeleteFileW 2850->2851 2853 7ff71ae11d97 2851->2853 2854 7ff71ae11e03 2852->2854 2855 7ff71ae1155d DeleteFileW 2853->2855 2856 7ff71ae11e3f 2854->2856 2858 7ff71ae11450 2 API calls 2854->2858 2855->2844 2857 7ff71ae11450 2 API calls 2856->2857 2859 7ff71ae11e4e 2857->2859 2858->2856 2860 7ff71ae11450 2 API calls 2859->2860 2861 7ff71ae11e84 2860->2861 2862 7ff71ae11450 2 API calls 2861->2862 2863 7ff71ae11e93 2862->2863 2864 7ff71ae1155d DeleteFileW 2863->2864 2865 7ff71ae11ead 2864->2865 2866 7ff71ae11eb1 2865->2866 2867 7ff71ae11ec2 2865->2867 2868 7ff71ae11450 2 API calls 2866->2868 2870 7ff71ae11450 2 API calls 2867->2870 2869 7ff71ae11ec0 2868->2869 2871 7ff71ae1153f DeleteFileW 2869->2871 2870->2869 2872 7ff71ae11f16 getchar 2871->2872 2872->2844 2879 7ff71ae122ec 2873->2879 2874 7ff71ae123fe 2874->2790 2875 7ff71ae12482 2876 7ff71ae122c0 4 API calls 2875->2876 2885 7ff71ae12491 2876->2885 2877 7ff71ae123bd VirtualQuery 2878 7ff71ae12467 2877->2878 2877->2879 2880 7ff71ae122c0 4 API calls 2878->2880 2879->2874 2879->2875 2879->2877 2882 7ff71ae12410 VirtualProtect 2879->2882 2880->2875 2881 7ff71ae124c1 2881->2790 2882->2874 2883 7ff71ae12448 GetLastError 2882->2883 2884 7ff71ae122c0 4 API calls 2883->2884 2884->2879 2885->2881 2886 7ff71ae126ce 2885->2886 2889 7ff71ae127b0 2885->2889 2898 7ff71ae12552 2885->2898 2890 7ff71ae127dd 2886->2890 2896 7ff71ae126e9 2886->2896 2887 7ff71ae12330 4 API calls 2887->2889 2888 7ff71ae127ee 2891 7ff71ae122c0 4 API calls 2888->2891 2889->2881 2889->2887 2889->2890 2893 7ff71ae122c0 4 API calls 2890->2893 2892 7ff71ae127fa 2891->2892 2892->2790 2893->2888 2894 7ff71ae12330 VirtualQuery VirtualProtect GetLastError VirtualProtect 2894->2896 2895 7ff71ae122c0 4 API calls 2895->2896 2896->2894 2896->2895 2897 7ff71ae12330 VirtualQuery VirtualProtect GetLastError VirtualProtect 2897->2898 2898->2881 2898->2886 2898->2888 2898->2890 2898->2896 2898->2897 2899 7ff71ae12658 2898->2899 2899->2881 2900 7ff71ae12692 VirtualProtect 2899->2900 2900->2899 2907 7ff71ae12349 2901->2907 2902 7ff71ae123fe 2902->2778 2903 7ff71ae12482 2904 7ff71ae122c0 4 API calls 2903->2904 2912 7ff71ae12491 2904->2912 2905 7ff71ae123bd VirtualQuery 2906 7ff71ae12467 2905->2906 2905->2907 2908 7ff71ae122c0 4 API calls 2906->2908 2907->2902 2907->2903 2907->2905 2909 7ff71ae12410 VirtualProtect 2907->2909 2908->2903 2909->2902 2910 7ff71ae12448 GetLastError 2909->2910 2911 7ff71ae122c0 4 API calls 2910->2911 2911->2907 2913 7ff71ae126ce 2912->2913 2914 7ff71ae12552 2912->2914 2917 7ff71ae127b0 2912->2917 2928 7ff71ae124c1 2912->2928 2918 7ff71ae127dd 2913->2918 2924 7ff71ae126e9 2913->2924 2914->2913 2916 7ff71ae127ee 2914->2916 2914->2918 2914->2924 2925 7ff71ae12330 VirtualQuery VirtualProtect GetLastError VirtualProtect 2914->2925 2926 7ff71ae12658 2914->2926 2914->2928 2915 7ff71ae12330 4 API calls 2915->2917 2919 7ff71ae122c0 4 API calls 2916->2919 2917->2915 2917->2918 2917->2928 2920 7ff71ae122c0 4 API calls 2918->2920 2922 7ff71ae127fa 2919->2922 2920->2916 2921 7ff71ae122c0 4 API calls 2921->2924 2922->2778 2923 7ff71ae12330 VirtualQuery VirtualProtect GetLastError VirtualProtect 2923->2924 2924->2921 2924->2923 2925->2914 2927 7ff71ae12692 VirtualProtect 2926->2927 2926->2928 2927->2926 2928->2778 2930 7ff71ae1181d SetConsoleTitleA 2929->2930 2930->2800 2932 7ff71ae11485 2931->2932 2945 7ff71ae130a0 2932->2945 2934 7ff71ae11497 2934->2803 2938 7ff71ae11620 2935->2938 2936 7ff71ae1169f SleepEx 2936->2803 2936->2806 2937 7ff71ae1168c FindCloseChangeNotification 2937->2936 2938->2936 2938->2937 2958 7ff71ae114ec 2939->2958 2942 7ff71ae1155d 2943 7ff71ae114ec DeleteFileW 2942->2943 2944 7ff71ae11575 2943->2944 2944->2819 2944->2826 2946 7ff71ae130b5 2945->2946 2949 7ff71ae14bf0 2946->2949 2948 7ff71ae130cd 2948->2934 2950 7ff71ae14c1b 2949->2950 2951 7ff71ae14d40 fputc 2950->2951 2953 7ff71ae14d9f 2950->2953 2954 7ff71ae131e0 2950->2954 2951->2950 2953->2948 2955 7ff71ae131f0 2954->2955 2956 7ff71ae13220 fputc 2955->2956 2957 7ff71ae13200 2955->2957 2956->2950 2957->2950 2962 7ff71ae114a4 2958->2962 2961 7ff71ae1152a 2961->2942 2963 7ff71ae114e5 DeleteFileW 2962->2963 2963->2961 3304 7ff71ae14ef2 3305 7ff71ae155ea 3304->3305 3306 7ff71ae14f08 3304->3306 3306->3305 3307 7ff71ae15287 3306->3307 3308 7ff71ae14450 28 API calls 3306->3308 3309 7ff71ae14450 28 API calls 3307->3309 3308->3306 3310 7ff71ae152a3 3309->3310 3311 7ff71ae12958 signal 3312 7ff71ae1296a signal 3311->3312 3313 7ff71ae12871 3311->3313 3316 7ff71ae128d6 3312->3316 3314 7ff71ae129bb signal 3313->3314 3315 7ff71ae128bb signal 3313->3315 3313->3316 3314->3316 3315->3313 3317 7ff71ae129a7 signal 3315->3317 3317->3316 3318 7ff71ae152d9 3319 7ff71ae152e9 3318->3319 3320 7ff71ae150ab 3318->3320 3321 7ff71ae145d0 30 API calls 3319->3321 3322 7ff71ae150c0 3320->3322 3323 7ff71ae145d0 30 API calls 3320->3323 3324 7ff71ae15305 3321->3324 3325 7ff71ae15287 3322->3325 3326 7ff71ae14450 28 API calls 3322->3326 3323->3322 3327 7ff71ae14450 28 API calls 3325->3327 3326->3322 3328 7ff71ae152a3 3327->3328 3329 7ff71ae12a5b 3330 7ff71ae12a80 3329->3330 3331 7ff71ae12a76 3329->3331 3330->3331 3332 7ff71ae12a97 EnterCriticalSection LeaveCriticalSection 3330->3332 3332->3331 3333 7ff71ae120e0 3334 7ff71ae120e9 3333->3334 3335 7ff71ae120ed 3334->3335 3336 7ff71ae12b60 3 API calls 3334->3336 3337 7ff71ae12105 3336->3337 3338 7ff71ae12ce0 strlen 3339 7ff71ae12d70 3338->3339 3342 7ff71ae12cf5 3338->3342 3340 7ff71ae12d5e 3341 7ff71ae12d49 strncmp 3341->3340 3341->3342 3342->3339 3342->3340 3342->3341 3346 7ff71ae11f61 SetUnhandledExceptionFilter 3352 7ff71ae150cc 3353 7ff71ae152b8 3352->3353 3354 7ff71ae150e3 3352->3354 3355 7ff71ae144f0 29 API calls 3353->3355 3363 7ff71ae144f0 3354->3363 3358 7ff71ae152d4 3355->3358 3357 7ff71ae150c0 3359 7ff71ae15287 3357->3359 3360 7ff71ae14450 28 API calls 3357->3360 3361 7ff71ae14450 28 API calls 3359->3361 3360->3357 3362 7ff71ae152a3 3361->3362 3364 7ff71ae14504 3363->3364 3365 7ff71ae130f0 15 API calls 3364->3365 3366 7ff71ae14533 3365->3366 3367 7ff71ae145b0 3366->3367 3368 7ff71ae14544 3366->3368 3369 7ff71ae13570 3 API calls 3367->3369 3370 7ff71ae13fa0 11 API calls 3368->3370 3371 7ff71ae145bf 3369->3371 3372 7ff71ae14553 3370->3372 3371->3357 3372->3371 3373 7ff71ae14598 fputc 3372->3373 3373->3372 3374 7ff71ae12ad0 3375 7ff71ae12af0 EnterCriticalSection 3374->3375 3376 7ff71ae12ae2 3374->3376 3377 7ff71ae12b33 LeaveCriticalSection 3375->3377 3378 7ff71ae12b0c 3375->3378 3378->3377 3379 7ff71ae12b2e free 3378->3379 3379->3377 3383 7ff71ae14ed4 3384 7ff71ae14ee0 3383->3384 3385 7ff71ae13520 strlen 3384->3385 3386 7ff71ae14eed 3385->3386 3386->3386 3392 7ff71ae15456 3393 7ff71ae1545a 3392->3393 3394 7ff71ae155ab 3393->3394 3395 7ff71ae1547b 3393->3395 3397 7ff71ae13240 4 API calls 3394->3397 3396 7ff71ae13240 4 API calls 3395->3396 3398 7ff71ae15495 3396->3398 3399 7ff71ae155c2 3397->3399 3399->3399 3400 7ff71ae14e38 3401 7ff71ae15599 3400->3401 3403 7ff71ae14e4e 3400->3403 3402 7ff71ae13ac0 5 API calls 3402->3403 3403->3402 2964 7ff71ae14dc0 2965 7ff71ae15552 2964->2965 2966 7ff71ae14dd2 2964->2966 2976 7ff71ae13ac0 2965->2976 2966->2965 2967 7ff71ae15630 2966->2967 2969 7ff71ae14e05 2966->2969 2989 7ff71ae13610 2969->2989 2971 7ff71ae14e12 2972 7ff71ae15287 2971->2972 3002 7ff71ae14450 2971->3002 2974 7ff71ae14450 28 API calls 2972->2974 2975 7ff71ae152a3 2974->2975 2978 7ff71ae13af5 2976->2978 2977 7ff71ae13bea memset 2979 7ff71ae13c00 2977->2979 2978->2977 2978->2979 2980 7ff71ae13c47 2979->2980 2981 7ff71ae13dd2 2979->2981 2986 7ff71ae13c3a 2979->2986 2983 7ff71ae13cad fputc 2980->2983 2985 7ff71ae13c66 2980->2985 2981->2980 2982 7ff71ae13de3 memset 2981->2982 2982->2980 2983->2980 2983->2985 2984 7ff71ae13d18 2984->2967 2985->2984 2988 7ff71ae13d00 fputc 2985->2988 2986->2980 2987 7ff71ae131e0 fputc 2986->2987 2987->2986 2988->2985 2994 7ff71ae13634 2989->2994 2998 7ff71ae136ca 2989->2998 2990 7ff71ae138c2 fputc 2993 7ff71ae138d5 2990->2993 3000 7ff71ae137af 2990->3000 2991 7ff71ae13780 memset 2991->2998 2992 7ff71ae139fa memset 2992->2998 2992->3000 2995 7ff71ae1391f fputc 2993->2995 2996 7ff71ae137f0 2993->2996 2994->2991 2994->2998 2995->2993 2996->2971 2997 7ff71ae131e0 fputc 2999 7ff71ae13849 2997->2999 2998->2992 2998->2999 2998->3000 3001 7ff71ae13a9c memset 2998->3001 2999->2997 2999->3000 3000->2990 3000->2993 3000->2996 3001->2998 3003 7ff71ae14464 3002->3003 3012 7ff71ae130f0 3003->3012 3006 7ff71ae1449b 3016 7ff71ae14380 3006->3016 3007 7ff71ae144d0 3022 7ff71ae13570 3007->3022 3010 7ff71ae144df 3010->2971 3013 7ff71ae13114 3012->3013 3026 7ff71ae15930 3013->3026 3015 7ff71ae1317d 3015->3006 3015->3007 3017 7ff71ae143ae 3016->3017 3100 7ff71ae13fa0 3017->3100 3019 7ff71ae14413 3020 7ff71ae131e0 fputc 3019->3020 3021 7ff71ae14434 3020->3021 3023 7ff71ae13584 3022->3023 3180 7ff71ae133d0 3023->3180 3027 7ff71ae15bf0 3026->3027 3031 7ff71ae15997 3026->3031 3029 7ff71ae15c5a 3027->3029 3062 7ff71ae17470 3027->3062 3028 7ff71ae15c38 3068 7ff71ae15700 3028->3068 3029->3015 3031->3027 3031->3028 3055 7ff71ae17380 3031->3055 3034 7ff71ae159cd 3034->3027 3046 7ff71ae15a90 3034->3046 3035 7ff71ae156c0 6 API calls 3035->3046 3036 7ff71ae16045 3036->3015 3037 7ff71ae17940 8 API calls 3037->3046 3039 7ff71ae174e0 8 API calls 3039->3046 3040 7ff71ae16d78 3042 7ff71ae17380 6 API calls 3040->3042 3041 7ff71ae17470 5 API calls 3043 7ff71ae16178 3041->3043 3044 7ff71ae16d85 memcpy 3042->3044 3045 7ff71ae15f7b 3043->3045 3049 7ff71ae17470 5 API calls 3043->3049 3085 7ff71ae17940 3044->3085 3050 7ff71ae17470 5 API calls 3045->3050 3046->3035 3046->3036 3046->3037 3046->3039 3046->3040 3046->3045 3048 7ff71ae175a0 6 API calls 3046->3048 3051 7ff71ae1614f 3046->3051 3052 7ff71ae177c0 11 API calls 3046->3052 3054 7ff71ae17470 Sleep InitializeCriticalSection InitializeCriticalSection EnterCriticalSection LeaveCriticalSection 3046->3054 3072 7ff71ae17aa0 3046->3072 3079 7ff71ae17660 3046->3079 3048->3046 3049->3045 3050->3029 3051->3041 3052->3046 3054->3046 3093 7ff71ae17250 3055->3093 3058 7ff71ae173a7 3060 7ff71ae17407 3058->3060 3061 7ff71ae173b7 LeaveCriticalSection 3058->3061 3059 7ff71ae173ea malloc 3059->3058 3059->3060 3060->3034 3061->3060 3063 7ff71ae1747d 3062->3063 3064 7ff71ae174b6 3062->3064 3065 7ff71ae17250 4 API calls 3063->3065 3064->3028 3066 7ff71ae17497 3065->3066 3066->3064 3067 7ff71ae174c0 LeaveCriticalSection 3066->3067 3069 7ff71ae15713 3068->3069 3070 7ff71ae17380 6 API calls 3069->3070 3071 7ff71ae15734 3070->3071 3071->3029 3073 7ff71ae17af9 3072->3073 3074 7ff71ae17ac3 3072->3074 3075 7ff71ae17380 6 API calls 3073->3075 3074->3073 3076 7ff71ae17c40 3074->3076 3078 7ff71ae17b08 3075->3078 3077 7ff71ae17380 6 API calls 3076->3077 3077->3078 3078->3046 3080 7ff71ae17683 3079->3080 3081 7ff71ae17380 6 API calls 3080->3081 3082 7ff71ae176a8 3081->3082 3083 7ff71ae176c4 memset 3082->3083 3084 7ff71ae176e7 3082->3084 3083->3084 3084->3046 3086 7ff71ae17970 3085->3086 3087 7ff71ae17380 6 API calls 3086->3087 3088 7ff71ae1797f 3087->3088 3089 7ff71ae17a2e 3088->3089 3090 7ff71ae17993 memset 3088->3090 3091 7ff71ae179a7 3088->3091 3089->3051 3090->3091 3092 7ff71ae17470 5 API calls 3091->3092 3092->3089 3094 7ff71ae17268 3093->3094 3095 7ff71ae1726c 3093->3095 3094->3095 3098 7ff71ae172b7 InitializeCriticalSection InitializeCriticalSection 3094->3098 3096 7ff71ae172e6 EnterCriticalSection 3095->3096 3097 7ff71ae1729b 3095->3097 3099 7ff71ae17280 Sleep 3095->3099 3096->3095 3097->3058 3097->3059 3098->3095 3099->3095 3099->3099 3113 7ff71ae13fc0 3100->3113 3101 7ff71ae14043 3104 7ff71ae14258 3101->3104 3105 7ff71ae1404f 3101->3105 3102 7ff71ae14116 3103 7ff71ae131e0 fputc 3102->3103 3117 7ff71ae14057 3103->3117 3107 7ff71ae131e0 fputc 3104->3107 3108 7ff71ae14350 3105->3108 3105->3117 3106 7ff71ae1403b 3106->3101 3106->3102 3107->3117 3109 7ff71ae131e0 fputc 3108->3109 3111 7ff71ae140d7 3109->3111 3110 7ff71ae14073 3112 7ff71ae14180 3110->3112 3123 7ff71ae1407b 3110->3123 3119 7ff71ae13e50 10 API calls 3111->3119 3121 7ff71ae141a0 3111->3121 3129 7ff71ae140e1 3111->3129 3114 7ff71ae131e0 fputc 3112->3114 3113->3101 3113->3102 3113->3106 3115 7ff71ae131e0 fputc 3113->3115 3114->3111 3115->3113 3116 7ff71ae131e0 fputc 3116->3117 3117->3110 3117->3116 3118 7ff71ae131e0 fputc 3118->3123 3119->3121 3120 7ff71ae14374 3120->3120 3121->3120 3124 7ff71ae131e0 fputc 3121->3124 3127 7ff71ae14140 3121->3127 3122 7ff71ae140d0 3122->3111 3125 7ff71ae14138 3122->3125 3123->3118 3123->3122 3132 7ff71ae13240 3123->3132 3124->3121 3142 7ff71ae13e50 3125->3142 3128 7ff71ae14170 3127->3128 3131 7ff71ae131e0 fputc 3127->3131 3128->3019 3129->3019 3131->3127 3157 7ff71ae180e0 3132->3157 3134 7ff71ae1335a 3134->3123 3135 7ff71ae1332d 3135->3134 3138 7ff71ae131e0 fputc 3135->3138 3136 7ff71ae180e0 2 API calls 3140 7ff71ae13289 3136->3140 3137 7ff71ae131e0 fputc 3139 7ff71ae1326f 3137->3139 3138->3135 3139->3137 3139->3140 3140->3134 3140->3135 3140->3136 3141 7ff71ae13306 fputc 3140->3141 3141->3140 3143 7ff71ae13e6c 3142->3143 3144 7ff71ae13f40 3142->3144 3145 7ff71ae13e79 3143->3145 3146 7ff71ae13f20 3143->3146 3166 7ff71ae18380 ___mb_cur_max_func ___lc_codepage_func 3144->3166 3150 7ff71ae180e0 2 API calls 3145->3150 3147 7ff71ae131e0 fputc 3146->3147 3148 7ff71ae13f2d 3147->3148 3148->3127 3151 7ff71ae13ea9 3150->3151 3152 7ff71ae13f66 3151->3152 3155 7ff71ae13eb1 3151->3155 3153 7ff71ae131e0 fputc 3152->3153 3154 7ff71ae13f0b 3153->3154 3154->3127 3155->3154 3156 7ff71ae13ef5 fputc 3155->3156 3156->3154 3156->3155 3158 7ff71ae180fd 3157->3158 3161 7ff71ae18050 3158->3161 3160 7ff71ae18115 3160->3139 3162 7ff71ae18080 WideCharToMultiByte 3161->3162 3163 7ff71ae18064 3161->3163 3162->3163 3165 7ff71ae180c4 _errno 3162->3165 3164 7ff71ae1806b 3163->3164 3163->3165 3164->3160 3165->3160 3169 7ff71ae18220 3166->3169 3168 7ff71ae183db 3168->3152 3170 7ff71ae18235 3169->3170 3171 7ff71ae182f8 3169->3171 3170->3171 3172 7ff71ae182d8 3170->3172 3175 7ff71ae18269 IsDBCSLeadByteEx 3170->3175 3178 7ff71ae18284 3170->3178 3171->3168 3173 7ff71ae18330 MultiByteToWideChar 3172->3173 3174 7ff71ae182e3 3172->3174 3173->3174 3177 7ff71ae1835c _errno 3173->3177 3174->3168 3175->3172 3175->3178 3176 7ff71ae182ae MultiByteToWideChar 3176->3177 3179 7ff71ae182c8 3176->3179 3177->3171 3178->3171 3178->3176 3179->3168 3182 7ff71ae134b8 3180->3182 3184 7ff71ae133fb 3180->3184 3181 7ff71ae134a5 3181->3010 3183 7ff71ae131e0 fputc 3182->3183 3182->3184 3183->3182 3184->3181 3185 7ff71ae13455 fputc 3184->3185 3186 7ff71ae13460 3184->3186 3185->3184 3186->3181 3187 7ff71ae13496 fputc 3186->3187 3187->3186 3404 7ff71ae15240 3405 7ff71ae1524f 3404->3405 3406 7ff71ae13240 4 API calls 3405->3406 3407 7ff71ae15272 3406->3407 3407->3407 3413 7ff71ae12843 3414 7ff71ae12871 3413->3414 3415 7ff71ae129bb signal 3414->3415 3416 7ff71ae128bb signal 3414->3416 3417 7ff71ae128d6 3414->3417 3415->3417 3416->3414 3418 7ff71ae129a7 signal 3416->3418 3418->3417 3419 7ff71ae152a8 3420 7ff71ae152b8 3419->3420 3421 7ff71ae150e3 3419->3421 3422 7ff71ae144f0 29 API calls 3420->3422 3423 7ff71ae144f0 29 API calls 3421->3423 3424 7ff71ae152d4 3422->3424 3426 7ff71ae150c0 3423->3426 3425 7ff71ae15287 3428 7ff71ae14450 28 API calls 3425->3428 3426->3425 3427 7ff71ae14450 28 API calls 3426->3427 3427->3426 3429 7ff71ae152a3 3428->3429 3435 7ff71ae116ae 3436 7ff71ae116c6 3435->3436 3442 7ff71ae117ea 3435->3442 3437 7ff71ae115f0 FindCloseChangeNotification 3436->3437 3438 7ff71ae116fa 3437->3438 3439 7ff71ae11450 2 API calls 3438->3439 3438->3442 3440 7ff71ae11759 3439->3440 3441 7ff71ae1155d DeleteFileW 3440->3441 3441->3442 3443 7ff71ae121b0 3444 7ff71ae121cf 3443->3444 3445 7ff71ae1220d fprintf 3444->3445 3446 7ff71ae12930 signal 3447 7ff71ae129cf signal 3446->3447 3449 7ff71ae12871 3446->3449 3448 7ff71ae129e3 3447->3448 3450 7ff71ae129bb signal 3449->3450 3451 7ff71ae128bb signal 3449->3451 3453 7ff71ae128d6 3449->3453 3450->3453 3451->3449 3452 7ff71ae129a7 signal 3451->3452 3452->3453 3454 7ff71ae17330 3455 7ff71ae17350 DeleteCriticalSection 3454->3455 3456 7ff71ae17345 3454->3456 3457 7ff71ae14f97 3460 7ff71ae14fae 3457->3460 3461 7ff71ae151a8 3457->3461 3458 7ff71ae13570 3 API calls 3462 7ff71ae1501b 3458->3462 3459 7ff71ae15539 3465 7ff71ae13570 3 API calls 3459->3465 3460->3459 3460->3462 3461->3460 3461->3462 3464 7ff71ae13570 3 API calls 3461->3464 3462->3458 3467 7ff71ae14750 3462->3467 3464->3460 3466 7ff71ae156b2 3465->3466 3466->3466 3469 7ff71ae1476b 3467->3469 3468 7ff71ae131e0 fputc 3468->3469 3469->3468 3470 7ff71ae13e50 10 API calls 3469->3470 3471 7ff71ae13240 4 API calls 3469->3471 3470->3469 3471->3469 3472 7ff71ae15198 3474 7ff71ae151a8 3472->3474 3475 7ff71ae14fae 3472->3475 3473 7ff71ae13570 3 API calls 3477 7ff71ae1501b 3473->3477 3474->3475 3474->3477 3479 7ff71ae13570 3 API calls 3474->3479 3476 7ff71ae15539 3475->3476 3475->3477 3480 7ff71ae13570 3 API calls 3476->3480 3477->3473 3478 7ff71ae14750 11 API calls 3477->3478 3478->3477 3479->3475 3481 7ff71ae156b2 3480->3481 3481->3481 3482 7ff71ae18120 ___lc_codepage_func ___mb_cur_max_func 3483 7ff71ae1815b 3482->3483 3484 7ff71ae18151 3482->3484 3485 7ff71ae18156 3484->3485 3488 7ff71ae181b0 3484->3488 3485->3483 3487 7ff71ae18050 2 API calls 3485->3487 3486 7ff71ae18050 2 API calls 3486->3488 3487->3485 3488->3483 3488->3486 3489 7ff71ae14e20 3493 7ff71ae14ca8 3489->3493 3490 7ff71ae14d9f 3491 7ff71ae131e0 fputc 3491->3493 3492 7ff71ae14d40 fputc 3492->3493 3493->3490 3493->3491 3493->3492 3494 7ff71ae15321 3495 7ff71ae1532a localeconv 3494->3495 3500 7ff71ae14ca8 3494->3500 3496 7ff71ae18380 6 API calls 3495->3496 3496->3500 3497 7ff71ae14d9f 3498 7ff71ae131e0 fputc 3498->3500 3499 7ff71ae14d40 fputc 3499->3500 3500->3497 3500->3498 3500->3499 3501 7ff71ae186a1 GetLastError 3502 7ff71ae15025 3503 7ff71ae15046 3502->3503 3507 7ff71ae15064 3502->3507 3505 7ff71ae133d0 3 API calls 3503->3505 3504 7ff71ae13240 4 API calls 3506 7ff71ae15272 3504->3506 3505->3507 3506->3506 3507->3504

    Executed Functions

    Function 00007FF71AE11806 Relevance: 68.6, APIs: 13, Strings: 26, Instructions: 360stringCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 0 7ff71ae11806-7ff71ae11884 call 7ff71ae120b0 SetConsoleTitleA SetConsoleTextAttribute call 7ff71ae11450 7 7ff71ae1188e-7ff71ae118b8 call 7ff71ae115f0 SleepEx 0->7 10 7ff71ae118ba-7ff71ae119e3 SetConsoleTextAttribute call 7ff71ae11450 call 7ff71ae1157b * 2 call 7ff71ae185e8 7->10 20 7ff71ae11ab7-7ff71ae11afc call 7ff71ae185e0 10->20 21 7ff71ae119e9-7ff71ae11a4d SetConsoleTextAttribute call 7ff71ae11450 call 7ff71ae1153f call 7ff71ae1155d 10->21 29 7ff71ae11b68-7ff71ae11bb2 strlen 20->29 30 7ff71ae11afe-7ff71ae11b63 call 7ff71ae11450 getchar call 7ff71ae1153f call 7ff71ae1155d 20->30 34 7ff71ae11aa8-7ff71ae11ab2 getchar 21->34 35 7ff71ae11a4f-7ff71ae11aa3 call 7ff71ae11450 * 3 21->35 39 7ff71ae11c1e-7ff71ae11c5f strlen 29->39 40 7ff71ae11bb4-7ff71ae11c19 call 7ff71ae11450 getchar call 7ff71ae1153f call 7ff71ae1155d 29->40 38 7ff71ae11f20-7ff71ae11f2a 30->38 34->38 35->34 50 7ff71ae11ccb-7ff71ae11d4f 39->50 51 7ff71ae11c61-7ff71ae11cc6 call 7ff71ae11450 getchar call 7ff71ae1153f call 7ff71ae1155d 39->51 40->38 71 7ff71ae11dbb-7ff71ae11e2e call 7ff71ae11450 50->71 72 7ff71ae11d51-7ff71ae11db6 call 7ff71ae11450 getchar call 7ff71ae1153f call 7ff71ae1155d 50->72 51->38 86 7ff71ae11e3f-7ff71ae11e49 call 7ff71ae11450 71->86 87 7ff71ae11e30-7ff71ae11e3a call 7ff71ae11450 71->87 72->38 90 7ff71ae11e4e-7ff71ae11e73 86->90 87->86 92 7ff71ae11e75-7ff71ae11eaf call 7ff71ae11450 * 2 call 7ff71ae1155d 90->92 99 7ff71ae11eb1-7ff71ae11ec0 call 7ff71ae11450 92->99 100 7ff71ae11ec2-7ff71ae11ee4 call 7ff71ae11450 92->100 105 7ff71ae11ee9-7ff71ae11f1b call 7ff71ae1153f getchar 99->105 100->105 105->38
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: Console$AttributeTextgetchar$ChangeCloseFindNotificationSleepTitlestrlen
    • String ID: 0-0$30;10'z&$802{199$?06!:'{0$LoadLibraryA$Rustclient.exe$Smeg Injector | $[!] Could not open rust client for synchronization.$[!] Couldn't Find Smeg?.$[!] Couldn't call CreateRemoteThread.$[!] Couldn't call VirtualAllocEx.$[!] Couldn't call WriteProcessMemory.$[!] Couldn't create a handle to rust client.$[!] Smeg couldnt clean up?Would suggest an restart of pc.$[!][Dev] Current Dir:%s?.$[!][Dev] Current FilePath:%s?.$[!][Dev] Smegs dll isnt in the folder next to loader?.$[*] Garrys mod closed / crashed...$[*] Monitoring rust client process...$[*] Smeg has cleaning up...$[*] Smeg is cleaning up...$[*] Successfully got PID: %lu$[*] Successfully injected.$[*] Waiting for Rustclient.exe...$kernel32.dll$z&802z<;
    • API String ID: 915047917-113419334
    • Opcode ID: 215c1266a9f5bf5f97cd8d1a100fd8691d93bac558c3053788ebdfc3eebfa616
    • Instruction ID: ede6974658433f48774ec7d4083f129ffc7f6c74375920054f686abf133de432
    • Opcode Fuzzy Hash: 215c1266a9f5bf5f97cd8d1a100fd8691d93bac558c3053788ebdfc3eebfa616
    • Instruction Fuzzy Hash: 7A026025B05F9289FB65FB65E8513EA63A4FB44BA8F8001BBD91D477A5DE3CD20C8310
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE11180 Relevance: 10.6, APIs: 7, Instructions: 146sleepstringCOMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
    • String ID:
    • API String ID: 3806033187-0
    • Opcode ID: 9d17db72d6bbb8996ff62dc2955ffea05b06a9ea5aeea3a66e5e92cd7683551d
    • Instruction ID: 96f4c5318b246cd4af557dbc1b7718dbf05532f9461b7bd254403528c7ececcb
    • Opcode Fuzzy Hash: 9d17db72d6bbb8996ff62dc2955ffea05b06a9ea5aeea3a66e5e92cd7683551d
    • Instruction Fuzzy Hash: 11512775E09E6285F611BB15E89267BE2A2AF44BB0FC444FBD90D47795DE3CE84C8320
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE115F0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: ChangeCloseFindNotification
    • String ID:
    • API String ID: 2591292051-0
    • Opcode ID: 082bdc2531c3331ed75e15c5fae2a17a4a564bc14d40bd7d4a03b985ae65c1f0
    • Instruction ID: d7b3cff9622d965c7b981721c5420b633fadedbc0c9528974bbcdc3403ab0255
    • Opcode Fuzzy Hash: 082bdc2531c3331ed75e15c5fae2a17a4a564bc14d40bd7d4a03b985ae65c1f0
    • Instruction Fuzzy Hash: D7112465604B968DFB30BF65D8053E96365EB043A8F8401B6CA1C5B7C9DF38D50C8760
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE13AC0 Relevance: 6.2, APIs: 4, Instructions: 238COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 153 7ff71ae13ac0-7ff71ae13af3 154 7ff71ae13b00-7ff71ae13b23 call 7ff71ae13060 153->154 155 7ff71ae13af5-7ff71ae13afa 153->155 159 7ff71ae13b25-7ff71ae13b28 154->159 160 7ff71ae13b36-7ff71ae13b3c 154->160 155->154 156 7ff71ae13d48-7ff71ae13d5a 155->156 156->154 161 7ff71ae13b2e-7ff71ae13b32 159->161 162 7ff71ae13da0-7ff71ae13da3 159->162 163 7ff71ae13bd0-7ff71ae13bd3 160->163 164 7ff71ae13b42-7ff71ae13b63 160->164 161->160 162->164 165 7ff71ae13c00-7ff71ae13c03 163->165 166 7ff71ae13bd5-7ff71ae13be4 163->166 167 7ff71ae13b68-7ff71ae13b8d 164->167 171 7ff71ae13c11-7ff71ae13c13 165->171 172 7ff71ae13c05-7ff71ae13c0b 165->172 169 7ff71ae13bea-7ff71ae13bfb memset 166->169 170 7ff71ae13d80-7ff71ae13d83 166->170 167->163 168 7ff71ae13b8f-7ff71ae13b92 167->168 173 7ff71ae13bc0-7ff71ae13bc6 168->173 174 7ff71ae13b94-7ff71ae13b97 168->174 169->165 170->171 175 7ff71ae13d89 170->175 177 7ff71ae13c50-7ff71ae13c54 171->177 178 7ff71ae13c15-7ff71ae13c22 171->178 172->171 176 7ff71ae13d8c-7ff71ae13d93 172->176 173->167 174->173 179 7ff71ae13b99-7ff71ae13b9e 174->179 175->176 176->171 180 7ff71ae13c5a-7ff71ae13c5d 177->180 181 7ff71ae13d30-7ff71ae13d37 177->181 178->177 182 7ff71ae13c24-7ff71ae13c2b 178->182 179->173 183 7ff71ae13ba0-7ff71ae13bad 179->183 184 7ff71ae13c61-7ff71ae13c64 180->184 185 7ff71ae13d39-7ff71ae13d40 181->185 186 7ff71ae13d60-7ff71ae13d67 181->186 187 7ff71ae13db0-7ff71ae13db9 182->187 188 7ff71ae13c31-7ff71ae13c34 182->188 183->173 189 7ff71ae13baf-7ff71ae13bb6 183->189 190 7ff71ae13c89-7ff71ae13c94 184->190 191 7ff71ae13c66 184->191 185->184 186->184 192 7ff71ae13d6d-7ff71ae13d74 186->192 193 7ff71ae13c3a-7ff71ae13c41 187->193 194 7ff71ae13dbf-7ff71ae13dcc 187->194 188->193 188->194 189->173 199 7ff71ae13c9e-7ff71ae13cab 190->199 200 7ff71ae13c96-7ff71ae13c9c 190->200 198 7ff71ae13cc0-7ff71ae13cc3 191->198 192->184 195 7ff71ae13c47 193->195 196 7ff71ae13e08-7ff71ae13e13 193->196 194->193 197 7ff71ae13dd2-7ff71ae13ddd 194->197 195->177 196->177 202 7ff71ae13e19 196->202 197->177 201 7ff71ae13de3-7ff71ae13e00 memset 197->201 206 7ff71ae13cdc-7ff71ae13ce6 198->206 204 7ff71ae13cad-7ff71ae13cbe fputc 199->204 205 7ff71ae13c70-7ff71ae13c77 199->205 200->199 203 7ff71ae13c7a-7ff71ae13c83 200->203 201->177 209 7ff71ae13e20-7ff71ae13e38 call 7ff71ae131e0 202->209 203->198 210 7ff71ae13c85 203->210 204->198 204->210 205->203 207 7ff71ae13d18-7ff71ae13d28 206->207 208 7ff71ae13ce8-7ff71ae13cee 206->208 211 7ff71ae13cf8-7ff71ae13cfe 208->211 212 7ff71ae13cf0-7ff71ae13cf6 208->212 218 7ff71ae13e3a-7ff71ae13e3e 209->218 210->190 215 7ff71ae13cc8-7ff71ae13cd3 211->215 216 7ff71ae13d00-7ff71ae13d10 fputc 211->216 212->211 214 7ff71ae13cd6-7ff71ae13cd9 212->214 214->206 215->214 216->214 218->177
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 2804497f37bed78f9e3d7aef058ba03dbed360900f347cef15d15b3c6bcc9568
    • Instruction ID: e870efd45f14129ef5ae442c4a1f44b53ca61923768efd38bde264ce2615f815
    • Opcode Fuzzy Hash: 2804497f37bed78f9e3d7aef058ba03dbed360900f347cef15d15b3c6bcc9568
    • Instruction Fuzzy Hash: FF91CA72B08A6346F7A5BF29814177BA691AB04BA4F9481F2CE0C573C4DB3CE84DD760
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE114EC Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 234 7ff71ae114ec-7ff71ae11528 call 7ff71ae114a4 DeleteFileW 237 7ff71ae1152a-7ff71ae1152f 234->237 238 7ff71ae11531 234->238 239 7ff71ae11536-7ff71ae1153e 237->239 238->239
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: DeleteFile
    • String ID:
    • API String ID: 4033686569-0
    • Opcode ID: c430a8bc528c303b26a417022506a4da0b7f844244d5aa017f7b41610ffa0cb6
    • Instruction ID: e37f57edd3347c4212da9573c6369b697a82eb40340f38a63befc50b0781333b
    • Opcode Fuzzy Hash: c430a8bc528c303b26a417022506a4da0b7f844244d5aa017f7b41610ffa0cb6
    • Instruction Fuzzy Hash: 20E06526B14FA588FB21BA28E8453E92324AB08358F8400BAC90D4B794EE2CD64DC220
    Uniqueness

    Uniqueness Score: -1.00%

    Non-executed Functions

    Function 00007FF71AE15930 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1385COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID: $ $Infinity$NaN
    • API String ID: 0-3274152445
    • Opcode ID: e8b157dc07018cd1b0e2bb85c577ddbc7c758f4043cddf46959810312c8c95f3
    • Instruction ID: 95912d1acfcdcf96c3086b05d72bbc28220cc4f5ac2ca6c1d976d4063f7e4709
    • Opcode Fuzzy Hash: e8b157dc07018cd1b0e2bb85c577ddbc7c758f4043cddf46959810312c8c95f3
    • Instruction Fuzzy Hash: 05D2C672A1CA918AF711BF25A00172BF791FB857A0F5081B6EA4A47B59DB3CE44DCF10
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE14750 Relevance: 1.5, Strings: 1, Instructions: 296COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID: .
    • API String ID: 0-248832578
    • Opcode ID: dc7c95912ea179b4376ebdfd1fe7d6f82869dd945337f08c514ca93ba6913bec
    • Instruction ID: 7c56727b5f94e4fb7a88850df310dd714400b7922d2febe34a156a7d8088749c
    • Opcode Fuzzy Hash: dc7c95912ea179b4376ebdfd1fe7d6f82869dd945337f08c514ca93ba6913bec
    • Instruction Fuzzy Hash: 80B1FCA2A1CA6346F7557E25D01677BE291EB41BA4F8481F2DE0E477C6DE2CE90C8720
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE1F358 Relevance: .0, Instructions: 12COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: c5a45a94ecbe7473543027e91b9e240f81e177555c95c74afc7448f1a0a6f819
    • Instruction ID: da4290f5274b0bc800eb4267734a4614c47bc1882c27ab0ac4d3edff8530037d
    • Opcode Fuzzy Hash: c5a45a94ecbe7473543027e91b9e240f81e177555c95c74afc7448f1a0a6f819
    • Instruction Fuzzy Hash: 7AD0A78BD0DED244F15661740E272165AC05F63970B4D83FFCF38032D25A05B80A9361
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE11F61 Relevance: .0, Instructions: 4COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 9a3e921274223871fabf03b3343526f713b7f296e36f4d548d484219d10f21e6
    • Instruction ID: 469824c7bf088388229b9c2a6b804c0165d973d3626a52dda0ef544a47b07d6d
    • Opcode Fuzzy Hash: 9a3e921274223871fabf03b3343526f713b7f296e36f4d548d484219d10f21e6
    • Instruction Fuzzy Hash: 7EA00252C4DD55C0F2046B44E8421719228D756611F8820B3C01D510A5892C91484165
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE122C0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 315 7ff71ae122c0-7ff71ae12343 call 7ff71ae18030 call 7ff71ae18608 call 7ff71ae18030 call 7ff71ae18660 call 7ff71ae185c8 327 7ff71ae12349-7ff71ae12357 315->327 328 7ff71ae12460-7ff71ae12462 315->328 329 7ff71ae12360-7ff71ae12366 327->329 330 7ff71ae12388-7ff71ae12396 call 7ff71ae12d80 328->330 331 7ff71ae12368-7ff71ae12375 329->331 332 7ff71ae1237b-7ff71ae12386 329->332 336 7ff71ae1239c-7ff71ae123e4 call 7ff71ae12ec0 VirtualQuery 330->336 337 7ff71ae12482-7ff71ae124bf call 7ff71ae122c0 330->337 331->332 334 7ff71ae12405-7ff71ae1240c 331->334 332->329 332->330 342 7ff71ae12467-7ff71ae1247d call 7ff71ae122c0 336->342 343 7ff71ae123ea-7ff71ae123f4 336->343 348 7ff71ae124d8-7ff71ae1252f call 7ff71ae12e00 call 7ff71ae13060 337->348 349 7ff71ae124c1-7ff71ae124d1 337->349 342->337 345 7ff71ae123fe 343->345 346 7ff71ae123f6-7ff71ae123fc 343->346 345->334 346->345 350 7ff71ae12410-7ff71ae12446 VirtualProtect 346->350 348->349 358 7ff71ae12531-7ff71ae12537 348->358 350->345 352 7ff71ae12448-7ff71ae1245c GetLastError call 7ff71ae122c0 350->352 352->328 359 7ff71ae126b8-7ff71ae126ba 358->359 360 7ff71ae1253d-7ff71ae12541 358->360 361 7ff71ae127b0-7ff71ae127b3 359->361 362 7ff71ae126c0-7ff71ae126c8 359->362 360->361 363 7ff71ae12547 360->363 361->349 364 7ff71ae127b9 361->364 365 7ff71ae1254a-7ff71ae1254c 362->365 366 7ff71ae126ce 362->366 363->365 367 7ff71ae127c0-7ff71ae127db call 7ff71ae12330 364->367 365->361 368 7ff71ae12552-7ff71ae12558 365->368 370 7ff71ae126e0-7ff71ae126e3 366->370 380 7ff71ae127dd 367->380 371 7ff71ae127ee-7ff71ae12812 call 7ff71ae122c0 368->371 372 7ff71ae1255e-7ff71ae12565 368->372 374 7ff71ae126e9-7ff71ae126f8 370->374 375 7ff71ae127e2-7ff71ae127e9 call 7ff71ae122c0 370->375 385 7ff71ae12839-7ff71ae1283d 371->385 386 7ff71ae12814-7ff71ae12838 371->386 372->349 377 7ff71ae1256b-7ff71ae1257c 372->377 382 7ff71ae126fa-7ff71ae126fd 374->382 383 7ff71ae12760-7ff71ae12768 call 7ff71ae12330 374->383 375->371 379 7ff71ae125d2-7ff71ae125e9 377->379 387 7ff71ae12718-7ff71ae12722 379->387 388 7ff71ae125ef 379->388 380->375 382->383 384 7ff71ae126ff-7ff71ae12713 call 7ff71ae122c0 382->384 391 7ff71ae12770-7ff71ae12778 383->391 384->387 386->385 387->391 392 7ff71ae12724-7ff71ae12739 387->392 388->370 393 7ff71ae125f5-7ff71ae125f8 388->393 395 7ff71ae1277a 391->395 396 7ff71ae1273b-7ff71ae1273e 391->396 392->396 399 7ff71ae1274a-7ff71ae12752 call 7ff71ae12330 392->399 400 7ff71ae125fa-7ff71ae125fd 393->400 401 7ff71ae12580-7ff71ae1258c 393->401 395->399 396->384 404 7ff71ae12740-7ff71ae12748 396->404 399->383 400->375 406 7ff71ae12603-7ff71ae1260f 400->406 402 7ff71ae12798-7ff71ae127a0 401->402 403 7ff71ae12592-7ff71ae125a1 401->403 408 7ff71ae125a3-7ff71ae125aa 402->408 409 7ff71ae127a6 402->409 407 7ff71ae125ba-7ff71ae125cc call 7ff71ae12330 403->407 403->408 404->384 404->399 411 7ff71ae12780-7ff71ae12788 406->411 412 7ff71ae12615-7ff71ae12624 406->412 407->379 422 7ff71ae12660-7ff71ae12668 407->422 408->384 415 7ff71ae125b0-7ff71ae125b4 408->415 409->407 413 7ff71ae1278e 411->413 414 7ff71ae12626-7ff71ae1262d 411->414 412->414 417 7ff71ae12640-7ff71ae12652 call 7ff71ae12330 412->417 413->417 414->384 420 7ff71ae12633-7ff71ae1263a 414->420 415->384 415->407 417->379 423 7ff71ae12658 417->423 420->384 420->417 422->349 424 7ff71ae1266e-7ff71ae1267b 422->424 423->422 425 7ff71ae12680-7ff71ae12690 424->425 426 7ff71ae1269f-7ff71ae126ae 425->426 427 7ff71ae12692-7ff71ae1269d VirtualProtect 425->427 426->425 428 7ff71ae126b0 426->428 427->426 428->349
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: QueryVirtual
    • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
    • API String ID: 1804819252-1534286854
    • Opcode ID: e9a490fd51d39e951c90214a31b7a881265b3b714cfa718eb496ac04111f472b
    • Instruction ID: 19e7e266f8ef6154424223a656f1717167002b99ec577b31faf1f1f5dd843fef
    • Opcode Fuzzy Hash: e9a490fd51d39e951c90214a31b7a881265b3b714cfa718eb496ac04111f472b
    • Instruction Fuzzy Hash: 775187B2A04E5685FA11BB51E8426BAF760FB85BA4FC441B2DE4C07394DE3CD54DC760
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE13610 Relevance: 7.8, APIs: 5, Instructions: 299COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 801 7ff71ae13610-7ff71ae1362e 802 7ff71ae13930-7ff71ae1394a 801->802 803 7ff71ae13634-7ff71ae1364e 801->803 804 7ff71ae1394c 802->804 805 7ff71ae139b0-7ff71ae139d8 call 7ff71ae13060 802->805 806 7ff71ae136f0-7ff71ae13723 call 7ff71ae13060 803->806 807 7ff71ae13654-7ff71ae1365e 803->807 813 7ff71ae13960-7ff71ae13963 804->813 828 7ff71ae139e8-7ff71ae139f4 805->828 816 7ff71ae136b8-7ff71ae136c4 806->816 817 7ff71ae13725-7ff71ae1372c 806->817 809 7ff71ae13660-7ff71ae13671 807->809 810 7ff71ae13674-7ff71ae136af call 7ff71ae13060 807->810 809->810 810->817 825 7ff71ae136b1 810->825 818 7ff71ae13969 813->818 819 7ff71ae138a0-7ff71ae138aa 813->819 826 7ff71ae136ca-7ff71ae136ce 816->826 827 7ff71ae1376b-7ff71ae1377a 816->827 821 7ff71ae13730-7ff71ae13757 817->821 824 7ff71ae13904-7ff71ae1390a 818->824 822 7ff71ae138ac-7ff71ae138b2 819->822 823 7ff71ae138b4-7ff71ae138c0 819->823 821->821 829 7ff71ae13759-7ff71ae1375c 821->829 822->823 830 7ff71ae13892-7ff71ae1389b 822->830 831 7ff71ae13888-7ff71ae1388f 823->831 832 7ff71ae138c2-7ff71ae138d3 fputc 823->832 835 7ff71ae1390c-7ff71ae13912 824->835 836 7ff71ae13914-7ff71ae1391d 824->836 825->816 837 7ff71ae136d4-7ff71ae136d8 826->837 838 7ff71ae13796-7ff71ae13799 826->838 833 7ff71ae13970-7ff71ae13974 827->833 834 7ff71ae13780-7ff71ae13791 memset 827->834 839 7ff71ae13849-7ff71ae13854 828->839 840 7ff71ae139fa-7ff71ae13a14 memset 828->840 829->816 845 7ff71ae13762-7ff71ae13765 829->845 843 7ff71ae1389d 830->843 844 7ff71ae138d5-7ff71ae138d8 830->844 831->830 832->843 832->844 833->837 846 7ff71ae1397a-7ff71ae1397d 833->846 834->838 835->836 850 7ff71ae138eb-7ff71ae138f8 835->850 852 7ff71ae1391f-7ff71ae1392c fputc 836->852 853 7ff71ae138e0-7ff71ae138e8 836->853 837->838 851 7ff71ae136de-7ff71ae136e5 837->851 847 7ff71ae1379b-7ff71ae1379e 838->847 848 7ff71ae137a4-7ff71ae137a7 838->848 839->813 849 7ff71ae1385a-7ff71ae1385d 839->849 841 7ff71ae13a1a-7ff71ae13a26 840->841 842 7ff71ae137d1 840->842 854 7ff71ae137d7-7ff71ae137da 841->854 858 7ff71ae13a2c 841->858 842->854 843->819 859 7ff71ae138da 844->859 860 7ff71ae13901 844->860 845->826 845->827 855 7ff71ae13a38-7ff71ae13a48 846->855 856 7ff71ae13983-7ff71ae13986 846->856 847->848 847->855 863 7ff71ae137aa-7ff71ae137ad 848->863 857 7ff71ae13860-7ff71ae13871 call 7ff71ae131e0 849->857 861 7ff71ae138fe 850->861 862 7ff71ae137f0-7ff71ae13800 850->862 851->838 852->850 853->850 854->862 864 7ff71ae137dc-7ff71ae137e4 854->864 855->863 865 7ff71ae1398c-7ff71ae1399c 856->865 866 7ff71ae13a6d-7ff71ae13a74 856->866 880 7ff71ae13873-7ff71ae1387c 857->880 858->855 859->862 860->824 861->860 868 7ff71ae13808-7ff71ae13816 863->868 869 7ff71ae137af-7ff71ae137ba 863->869 864->819 872 7ff71ae13820-7ff71ae13827 865->872 873 7ff71ae139a2 865->873 875 7ff71ae137c0-7ff71ae137c4 866->875 870 7ff71ae13818-7ff71ae1381e 868->870 871 7ff71ae13840-7ff71ae13843 868->871 869->875 876 7ff71ae13a50-7ff71ae13a53 869->876 870->871 870->872 871->828 871->839 878 7ff71ae13a79-7ff71ae13a7c 872->878 879 7ff71ae1382d-7ff71ae13838 872->879 873->839 875->842 881 7ff71ae137c6-7ff71ae137cd 875->881 876->862 877 7ff71ae13a59-7ff71ae13a68 876->877 877->819 883 7ff71ae13a8e-7ff71ae13a9a 878->883 884 7ff71ae13a7e-7ff71ae13a89 878->884 879->854 880->843 882 7ff71ae1387e 880->882 881->842 882->862 883->884 885 7ff71ae13a9c-7ff71ae13ab2 memset 883->885 884->839 885->841
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fputcmemset
    • String ID:
    • API String ID: 947785774-0
    • Opcode ID: b75e487522b39b3bbe0c3696fac386f1b96f20ba868e3f26bbf2d185f95f227c
    • Instruction ID: 84e95e3a7e1829a788df3274c03b7d52827ab66f7e476c84ff1262eb089542a8
    • Opcode Fuzzy Hash: b75e487522b39b3bbe0c3696fac386f1b96f20ba868e3f26bbf2d185f95f227c
    • Instruction Fuzzy Hash: F3B1FBA6E189A346F7A1BF25C00633BA6D1AB007B4F9442F6CA1D177C5DA3CE84DC761
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE124A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231memoryCOMMON
    Download Yara Rule
    APIs
    • VirtualProtect.KERNEL32(00007FF71AE1E050,00007FF71AE1E058,00000001,?,?,?,?,00007FF8C6F6ADA0,00007FF71AE11228,?,?,?,00007FF71AE11406), ref: 00007FF71AE1269D
    Strings
    • Unknown pseudo relocation bit size %d., xrefs: 00007FF71AE127E2
    • Unknown pseudo relocation protocol version %d., xrefs: 00007FF71AE127EE
    • %d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF71AE12707
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: ProtectVirtual
    • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
    • API String ID: 544645111-1286557213
    • Opcode ID: 417d21af58d2d3d50a368e1e91377f4ec64050e6dc27a6c7479be07aac230688
    • Instruction ID: 51107d3865f38617f10ea81e39a6ac367e983a35fbc888e60c0a2cd23218538c
    • Opcode Fuzzy Hash: 417d21af58d2d3d50a368e1e91377f4ec64050e6dc27a6c7479be07aac230688
    • Instruction Fuzzy Hash: E091A1A2E0997286FA10BB149D5227BE290BF54774FC482F2DE1D177D4DE3CE85D8620
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE12843 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: signal
    • String ID: CCG
    • API String ID: 1946981877-1584390748
    • Opcode ID: a078fd30fed3b8767887fae0c85bee4124425d70a51118b925b8044ae2f13bee
    • Instruction ID: c7dc37e68feea7a43e40130a11897546891364e40cdd0978a688349d97246a1f
    • Opcode Fuzzy Hash: a078fd30fed3b8767887fae0c85bee4124425d70a51118b925b8044ae2f13bee
    • Instruction Fuzzy Hash: D4218EA1E09A2A42FA697659885337AD182DF59370F9849F7C91D873D0DD3CA8CD8221
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE18220 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: Byte$CharLeadMultiWide
    • String ID:
    • API String ID: 2561704868-0
    • Opcode ID: b892afee27befa9390ff12b951c17d71c98e9c64dea45c68a03a4fbd94c8224f
    • Instruction ID: eed80146d377b770ee934f0547933590c31cabd61d5f7a5d2ff112287b153b64
    • Opcode Fuzzy Hash: b892afee27befa9390ff12b951c17d71c98e9c64dea45c68a03a4fbd94c8224f
    • Instruction Fuzzy Hash: F531D87260CA9186F362AF28F40136FB690FBA5794F9481B2DA9847794DF3DD44DCB10
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE121B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-3474627141
    • Opcode ID: 634d8938bb56d9e0f5fd2ae82153dca1d7c6b0b30c3fc25f77a1cdfa16b81045
    • Instruction ID: cb60ea2d1897814d0d22784155f2ab6725a1a093528c016b73969df67da433e9
    • Opcode Fuzzy Hash: 634d8938bb56d9e0f5fd2ae82153dca1d7c6b0b30c3fc25f77a1cdfa16b81045
    • Instruction Fuzzy Hash: 0F01C262D0CF9482E602AF1CD8011BBB330FB6E798F559366EE8C26155DF28E58AC700
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE12290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-4273532761
    • Opcode ID: c971a3672ae1ba92292952e1765209915c22e90ad351eb8cfde800cdffd39e4b
    • Instruction ID: 4691456f7c65f1274a856aa12c91b8b66b700d0fc970cecb9879f43d1876f934
    • Opcode Fuzzy Hash: c971a3672ae1ba92292952e1765209915c22e90ad351eb8cfde800cdffd39e4b
    • Instruction Fuzzy Hash: 0DF06252D08E9482E213EF1CA8011BBB330FF5D7A8F585367EF8D26555DF29E58A8710
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE12280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-2187435201
    • Opcode ID: 53999fce98eda89b82a53f86e7fd3430362f9e14b3238285a70787bb88555cf0
    • Instruction ID: 97654ecf74c441d3798d0594204f9031fe9d000eb8dfb7a85fc0cff09cdf9657
    • Opcode Fuzzy Hash: 53999fce98eda89b82a53f86e7fd3430362f9e14b3238285a70787bb88555cf0
    • Instruction Fuzzy Hash: 7DF06252D08E9486E213FF1CA8011BBB330FF9D7A8F585366EF8D26155DF29E58A8710
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE12270 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-4064033741
    • Opcode ID: fbc974752fea1caea45fefa3acd33513dfe0091bbaf5476e9fcce9c36d033d5a
    • Instruction ID: 352a8d7e5ead516c79d5640b6cccfaf4234689cc6edcf98fba91171867fe8998
    • Opcode Fuzzy Hash: fbc974752fea1caea45fefa3acd33513dfe0091bbaf5476e9fcce9c36d033d5a
    • Instruction Fuzzy Hash: 36F06252D08E9482E213EF1CE8011BBB330FF5E7A8F585366EF8D26155DF29E58A8710
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE12260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-4283191376
    • Opcode ID: 8b195b809002428d1609d60b864f2c998565fb23057fe505748be45d67ddd552
    • Instruction ID: 94db327dd304a452b7889291b41d23ba0bb571626003de7528d77c278e597765
    • Opcode Fuzzy Hash: 8b195b809002428d1609d60b864f2c998565fb23057fe505748be45d67ddd552
    • Instruction Fuzzy Hash: B5F06252D08E9482E213EF1CA8011BBB330FF9D7A8F585366EF8D26155DF29E58A8710
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE12250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-2713391170
    • Opcode ID: d6fb19bb5c5e0e8aac553f78f459857bfa390450d0369f6a16eab92e0e984841
    • Instruction ID: fc714d240c0ed699b022e66755be0591656675d8810fe983fbdf36f7cd993da6
    • Opcode Fuzzy Hash: d6fb19bb5c5e0e8aac553f78f459857bfa390450d0369f6a16eab92e0e984841
    • Instruction Fuzzy Hash: 4FF06252D08E9486E213EF1CA8011BBB330FF5E7A8F585366EF8D26155DF29E58A8710
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00007FF71AE121E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3261360693.00007FF71AE11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71AE10000, based on PE: true
    • Associated: 00000000.00000002.3259365086.00007FF71AE10000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261377981.00007FF71AE1A000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261392308.00007FF71AE1F000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261408510.00007FF71AE22000.00000008.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3261423294.00007FF71AE23000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff71ae10000_SecuriteInfo.jbxd
    Similarity
    • API ID: fprintf
    • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
    • API String ID: 383729395-2468659920
    • Opcode ID: 4a9cb5e5456f8189433cacb5b3cee1d99bc4794b77bf2b06863172ead2cb8f73
    • Instruction ID: c27d9e69bc7a7bc212a050f286c6818748db538e32026b78715462cf66b833c4
    • Opcode Fuzzy Hash: 4a9cb5e5456f8189433cacb5b3cee1d99bc4794b77bf2b06863172ead2cb8f73
    • Instruction Fuzzy Hash: 09F09612D08E9482E203EF1CA4011BBB330FF5D798F545366EF8D2A115DF29E5868710
    Uniqueness

    Uniqueness Score: -1.00%