Edit tour

Windows Analysis Report
forest.exe

Overview

General Information

Sample name:	forest.exe
Analysis ID:	1513254
MD5:	5242f809563eb3764684ef1180adb902
SHA1:	491399cc669f92229d4a0c4a418067c5d4a808e8
SHA256:	2a3519501362a44a4b122fbf869e195989741525883f07d0fc2d2e5e48fb7fff
Tags:	exelibraofficeonline-com
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

forest.exe (PID: 8152 cmdline: "C:\Users\user\Desktop\forest.exe" MD5: 5242F809563EB3764684EF1180ADB902)

forest.exe (PID: 3544 cmdline: "C:\Users\user\Desktop\forest.exe" MD5: 5242F809563EB3764684EF1180ADB902)

cleanup

Sigma Signatures

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 45.66.249.249, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\forest.exe, Initiated: true, ProcessId: 8152, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\forest.exe, ProcessId: 8152, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: forest.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: forest.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source: forest.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\User\Documents\root\Migratory\Projects\Current\Testing\x64\Release\ClientTest.pdb? source: forest.exe
Source:	Binary string: C:\Users\User\Documents\root\Migratory\Projects\Current\Testing\x64\Release\ClientTest.pdb source: forest.exe

Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C270D8 FindFirstFileExW,		0_2_00007FF7D4C270D8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB9C80 GetFullPathNameW,GetFullPathNameW,FindFirstFileExW,GetLastError,FindClose,		0_2_00007FF7D4BB9C80

Source: global traffic

TCP traffic: 192.168.2.10:49707 -> 45.66.249.249:8080

Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.249.249

Source: global traffic

HTTP traffic detected: GET /sock HTTP/1.1Connection: UpgradeUpgrade: websocketUser-Agent: Where are my socks?Sec-WebSocket-Key: knZ6tsATkpSvprUi2z7eqA==Sec-WebSocket-Version: 13Host: 45.66.249.249:8080

Source: forest.exe, 00000000.00000002.3204034791.000001FB2132E000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: forest.exe, 00000000.00000003.2547402599.000001FB22E13000.00000004.00000020.00020000.00000000.sdmp, forest.exe, 00000000.00000003.2547202351.000001FB22E10000.00000004.00000020.00020000.00000000.sdmp, forest.exe, 00000000.00000002.3204034791.000001FB213EE000.00000004.00000020.00020000.00000000.sdmp, forest.exe, 00000000.00000003.2548428397.000001FB213FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?87d654460fbca
Source: forest.exe, 00000000.00000002.3204034791.000001FB213EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en2r
Source: forest.exe, 00000000.00000002.3204034791.000001FB2130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.66.249.249:8443/
Source: forest.exe, 00000000.00000002.3204034791.000001FB213AC000.00000004.00000020.00020000.00000000.sdmp, forest.exe, 00000000.00000002.3204034791.000001FB21365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.66.249.249:8443/bc
Source: forest.exe, 00000000.00000002.3204549332.000001FB22E01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.66.249.249:8443/bc(
Source: forest.exe, 00000000.00000002.3204034791.000001FB2135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.66.249.249:8443/bcG
Source: forest.exe, 00000000.00000002.3204034791.000001FB21365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.66.249.249:8443/bcJ

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4BBE9E0 GdiplusStartup,GetDesktopWindow,GetDC,CreateCompatibleDC,GetDesktopWindow,GetClientRect,CreateCompatibleBitmap,SelectObject,BitBlt,GdipAlloc,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,SelectObject,DeleteObject,DeleteObject,GetDesktopWindow,ReleaseDC,GdiplusShutdown,GdipGetImageEncoders,SelectObject,DeleteObject,DeleteObject,GetDesktopWindow,ReleaseDC,GdiplusShutdown,CreateStreamOnHGlobal,GdipSaveImageToStream,SelectObject,DeleteObject,DeleteObject,GetDesktopWindow,ReleaseDC,GdiplusShutdown,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7D4BBE9E0

Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB46D0	0_2_00007FF7D4BB46D0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB5EF0	0_2_00007FF7D4BB5EF0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB5040	0_2_00007FF7D4BB5040
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BC7B00	0_2_00007FF7D4BC7B00
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BFC59C	0_2_00007FF7D4BFC59C
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C165BC	0_2_00007FF7D4C165BC
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C20528	0_2_00007FF7D4C20528
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF869C	0_2_00007FF7D4BF869C
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BEB664	0_2_00007FF7D4BEB664
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0F688	0_2_00007FF7D4C0F688
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BFD68C	0_2_00007FF7D4BFD68C
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0262C	0_2_00007FF7D4C0262C
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C2C7E8	0_2_00007FF7D4C2C7E8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF6804	0_2_00007FF7D4BF6804
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE87FC	0_2_00007FF7D4BE87FC
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C2B7BC	0_2_00007FF7D4C2B7BC
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BC5780	0_2_00007FF7D4BC5780
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C101E4	0_2_00007FF7D4C101E4
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB9200	0_2_00007FF7D4BB9200
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BD61C0	0_2_00007FF7D4BD61C0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C2A170	0_2_00007FF7D4C2A170
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C1C188	0_2_00007FF7D4C1C188
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0C178	0_2_00007FF7D4C0C178
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBC300	0_2_00007FF7D4BBC300
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0F2B8	0_2_00007FF7D4C0F2B8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C1B2C0	0_2_00007FF7D4C1B2C0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB7260	0_2_00007FF7D4BB7260
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE2270	0_2_00007FF7D4BE2270
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C26284	0_2_00007FF7D4C26284
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF2230	0_2_00007FF7D4BF2230
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C20224	0_2_00007FF7D4C20224
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF4404	0_2_00007FF7D4BF4404
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BD5370	0_2_00007FF7D4BD5370
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0F4A0	0_2_00007FF7D4C0F4A0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF947C	0_2_00007FF7D4BF947C
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BFE448	0_2_00007FF7D4BFE448
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C22DB8	0_2_00007FF7D4C22DB8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE7D1C	0_2_00007FF7D4BE7D1C
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE0D54	0_2_00007FF7D4BE0D54
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C23D40	0_2_00007FF7D4C23D40
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF0EF0	0_2_00007FF7D4BF0EF0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF5EC4	0_2_00007FF7D4BF5EC4
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C01E60	0_2_00007FF7D4C01E60
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C18F34	0_2_00007FF7D4C18F34
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE9F30	0_2_00007FF7D4BE9F30
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BEC0D8	0_2_00007FF7D4BEC0D8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C270D8	0_2_00007FF7D4C270D8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C030F0	0_2_00007FF7D4C030F0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBA110	0_2_00007FF7D4BBA110
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BF50AC	0_2_00007FF7D4BF50AC
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C21058	0_2_00007FF7D4C21058
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE8018	0_2_00007FF7D4BE8018
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BCB040	0_2_00007FF7D4BCB040
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBE9E0	0_2_00007FF7D4BBE9E0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C209D8	0_2_00007FF7D4C209D8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0D9E4	0_2_00007FF7D4C0D9E4
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BC09A0	0_2_00007FF7D4BC09A0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB69C0	0_2_00007FF7D4BB69C0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C189D0	0_2_00007FF7D4C189D0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB5960	0_2_00007FF7D4BB5960
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BC4940	0_2_00007FF7D4BC4940
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBAAFB	0_2_00007FF7D4BBAAFB
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C19B00	0_2_00007FF7D4C19B00
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C16AB4	0_2_00007FF7D4C16AB4
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BC3AB0	0_2_00007FF7D4BC3AB0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBAACF	0_2_00007FF7D4BBAACF
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BE7A44	0_2_00007FF7D4BE7A44
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBAA43	0_2_00007FF7D4BBAA43
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BC2BD0	0_2_00007FF7D4BC2BD0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBAB7F	0_2_00007FF7D4BBAB7F
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBAB27	0_2_00007FF7D4BBAB27
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBAB53	0_2_00007FF7D4BBAB53
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BBFD10	0_2_00007FF7D4BBFD10
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C0FCD0	0_2_00007FF7D4C0FCD0
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C28C74	0_2_00007FF7D4C28C74
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C00C50	0_2_00007FF7D4C00C50

Source: C:\Users\user\Desktop\forest.exe	Code function: String function: 00007FF7D4BCF390 appears 54 times
Source: C:\Users\user\Desktop\forest.exe	Code function: String function: 00007FF7D4BCA750 appears 35 times

Source: forest.exe	Binary or memory string: OriginalFilename vs forest.exe
Source: forest.exe, 00000000.00000000.1347704637.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewmflJ vs forest.exe
Source: forest.exe, 00000006.00000000.2625471977.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewmflJ vs forest.exe
Source: forest.exe	Binary or memory string: OriginalFilenamewmflJ vs forest.exe

Source: classification engine

Classification label: mal60.winEXE@2/3@0/1

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4BC09A0 CreateToolhelp32Snapshot,Process32FirstW,WideCharToMultiByte,WideCharToMultiByte,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7D4BC09A0

Source: C:\Users\user\Desktop\forest.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Jump to behavior

Source: forest.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\forest.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: forest.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\forest.exe "C:\Users\user\Desktop\forest.exe"
Source: unknown	Process created: C:\Users\user\Desktop\forest.exe "C:\Users\user\Desktop\forest.exe"

Source: C:\Users\user\Desktop\forest.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: websocket.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Source: WindowsSVC.lnk.0.dr

LNK file: ..\..\..\..\..\..\..\Desktop\forest.exe

Source: forest.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: forest.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: forest.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: forest.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: forest.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: forest.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: forest.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: forest.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: forest.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\User\Documents\root\Migratory\Projects\Current\Testing\x64\Release\ClientTest.pdb? source: forest.exe
Source:	Binary string: C:\Users\User\Documents\root\Migratory\Projects\Current\Testing\x64\Release\ClientTest.pdb source: forest.exe

Source: forest.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: forest.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: forest.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: forest.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: forest.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: forest.exe

Static PE information: real checksum: 0xacdd8 should be: 0xae09f

Source: forest.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\forest.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

Code function: _invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetNetworkParams,GlobalAlloc,GetNetworkParams,GetAdaptersInfo,GlobalAlloc,GetAdaptersInfo,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7D4BBA110

Source: C:\Users\user\Desktop\forest.exe

API coverage: 6.1 %

Source: C:\Users\user\Desktop\forest.exe TID: 8156	Thread sleep time: -116397s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\forest.exe TID: 3508	Thread sleep time: -105793s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C270D8 FindFirstFileExW,		0_2_00007FF7D4C270D8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4BB9C80 GetFullPathNameW,GetFullPathNameW,FindFirstFileExW,GetLastError,FindClose,		0_2_00007FF7D4BB9C80

Source: C:\Users\user\Desktop\forest.exe	Thread delayed: delay time: 116397			Jump to behavior
Source: C:\Users\user\Desktop\forest.exe	Thread delayed: delay time: 105793			Jump to behavior

Source: forest.exe, 00000000.00000002.3204034791.000001FB21390000.00000004.00000020.00020000.00000000.sdmp, forest.exe, 00000000.00000002.3204034791.000001FB2132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: forest.exe, 00000000.00000002.3204034791.000001FB2130B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxService

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4C05968 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7D4C05968

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4C04AA4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7D4C04AA4

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4C288C8 GetProcessHeap,

0_2_00007FF7D4C288C8

Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C056B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7D4C056B8
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C05968 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7D4C05968
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C13BC4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7D4C13BC4
Source: C:\Users\user\Desktop\forest.exe	Code function: 0_2_00007FF7D4C05B48 SetUnhandledExceptionFilter,	0_2_00007FF7D4C05B48

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4C30280 cpuid

0_2_00007FF7D4C30280

Source: C:\Users\user\Desktop\forest.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF7D4C2A714
Source: C:\Users\user\Desktop\forest.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7D4C1E878
Source: C:\Users\user\Desktop\forest.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7D4C2B148
Source: C:\Users\user\Desktop\forest.exe	Code function: GetLocaleInfoW,	0_2_00007FF7D4C2AE14
Source: C:\Users\user\Desktop\forest.exe	Code function: GetLocaleInfoW,	0_2_00007FF7D4C1EDBC
Source: C:\Users\user\Desktop\forest.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7D4C2AF6C
Source: C:\Users\user\Desktop\forest.exe	Code function: GetLocaleInfoW,	0_2_00007FF7D4C2B01C
Source: C:\Users\user\Desktop\forest.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7D4C2AA60
Source: C:\Users\user\Desktop\forest.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7D4C2ABC8
Source: C:\Users\user\Desktop\forest.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7D4C2AB30
Source: C:\Users\user\Desktop\forest.exe	Code function: GetLocaleInfoEx,	0_2_00007FF7D4BE5C9C

Source: C:\Users\user\Desktop\forest.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4C05BB4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7D4C05BB4

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4BB46D0 SHTestTokenMembership,GetUserNameA,GetComputerNameA,GetModuleFileNameW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7D4BB46D0

Source: C:\Users\user\Desktop\forest.exe

Code function: 0_2_00007FF7D4C1FE9C _get_daylight,GetTimeZoneInformation,

0_2_00007FF7D4C1FE9C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Process Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 File and Directory Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	32 System Information Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
forest.exe	53%	ReversingLabs	Win64.Hacktool.Sysdupate
forest.exe	100%	Avira	TR/Agent.jqxva

Source	Detection	Scanner	Label
https://45.66.249.249:8443/bc(	0%	Avira URL Cloud	safe
https://45.66.249.249:8443/bcG	0%	Avira URL Cloud	safe
https://45.66.249.249:8443/	0%	Avira URL Cloud	safe
https://45.66.249.249:8443/bcJ	0%	Avira URL Cloud	safe
https://45.66.249.249:8443/bc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://45.66.249.249:8443/bcG	forest.exe, 00000000.00000002.3204034791.000001FB2135C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.66.249.249:8443/bc(	forest.exe, 00000000.00000002.3204549332.000001FB22E01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.66.249.249:8443/bcJ	forest.exe, 00000000.00000002.3204034791.000001FB21365000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.66.249.249:8443/	forest.exe, 00000000.00000002.3204034791.000001FB2130B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.66.249.249:8443/bc	forest.exe, 00000000.00000002.3204034791.000001FB213AC000.00000004.00000020.00020000.00000000.sdmp, forest.exe, 00000000.00000002.3204034791.000001FB21365000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.66.249.249	unknown	Russian Federation		53356	FREERANGECLOUDCA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513254
Start date and time:	2024-09-18 17:08:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	forest.exe
Detection:	MAL
Classification:	mal60.winEXE@2/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.16.100.168, 88.221.110.91, 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: forest.exe

Simulations

Behavior and APIs

Time	Type	Description
17:11:22	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	http://www.skystudioselstree.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://1drv.ms/o/c/8d397705294be844/Ej05S04brJ5Gk0BP_zBxdzgB_4nKyGxS56LL4LZ9Pc6fmQ?e=3DjGg4	Get hash	malicious	HtmlDropper	Browse	199.232.210.172
	https://dltxc.s3.ap-southeast-1.amazonaws.com/svs/wx.htm?eml=test@yahoo.com	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://immergut.dotling.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://abena.dotling.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	Modulo32_.jar	Get hash	malicious	Unknown	Browse	199.232.210.172
	Fatura.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	Adobe.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	https://rb.gy/j709ni	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	PureCrypter, PureLog Stealer, zgRAT	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREERANGECLOUDCA	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.129.35.4
	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59
	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	193.142.147.59
	http://www.brookskushman.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://www.prestigetransportation.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	https://dutchpopp.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://muse.krazzykriss.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	https://muse.krazzykriss.com/	Get hash	malicious	Unknown	Browse	45.66.248.122

Process:	C:\Users\user\Desktop\forest.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\forest.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKvhE9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:nhHDnLNkPlE99SNxAhUe/3
MD5:	F81AAEB12EBE0D0D8B426E6AF78ADE64
SHA1:	506BDEB723209D2EDCB4D9B48CB4FBDC567CA86E
SHA-256:	BBE77318EB6D56F60409C9C23B4AB60BBA311A7785179BDBD7577C84BE035EAC
SHA-512:	9B7D56366375470B398D3393E743B4D66457F40C21EFD583EAE2A7B8594B2B7B56E414005F73552B99B8143BBD76764A3872D505DF6604FB2E0414A71D77252E
Malicious:	false
Reputation:	low
Preview:	p...... ........L=......(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Download File

Process:	C:\Users\user\Desktop\forest.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 5 09:31:42 2023, mtime=Wed Sep 18 14:09:24 2024, atime=Wed Sep 18 14:09:21 2024, length=688128, window=hide
Category:	dropped
Size (bytes):	582
Entropy (8bit):	4.992342607696939
Encrypted:	false
SSDEEP:	6:4xtQl3gr/bK5+ClzeVs+bRLO5xlAKEyZtL5NMwAt0sljAlmdkAV7D6WVMwANu+Qb:89ylzYNbRIxlAKEUVm/jAWD6n/zK2mV
MD5:	3961AD031F8F5E7CA6394ED421EB8FCD
SHA1:	770E3699374D357893AC3C00CB4AEC7637ABD32F
SHA-256:	C35212C6E5EF363DD756225BD86FF9364F50F84F8ABFBD1CBE51E771BD15AF00
SHA-512:	025D94F97430F571CF846F1E1FF86B1D885F519D3F79AD5277B7CDDD66FBBC6FA84EE4977FA9442BD018707302D5A6A09CC92AD3E0F414E42B2373E36F5E4D1C
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...:.!w.../.S.......}..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&......i..5q...i.u#w.....z.......`.2.....2Y+y .forest.exe..F......EW.S2Y+y....:..... ................}Y.f.o.r.e.s.t...e.x.e.......O...............-.......N............\<......C:\Users\user\Desktop\forest.exe..'.....\.....\.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.f.o.r.e.s.t...e.x.e.`.......X.......376483...........hT..CrF.f4... .O.L?.u...+...E...hT..CrF.f4... .O.L?.u...+...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.412521677726676
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	forest.exe
File size:	688'128 bytes
MD5:	5242f809563eb3764684ef1180adb902
SHA1:	491399cc669f92229d4a0c4a418067c5d4a808e8
SHA256:	2a3519501362a44a4b122fbf869e195989741525883f07d0fc2d2e5e48fb7fff
SHA512:	d8ab0ae014be8a70a6ad4c3e4d20dc5816b8a47eebf102b84aea0fcc2f4851f9162aa6fd1fe97d6cbaa213b9f392d679e451ea2ee3d99ea503e313b04a1acc49
SSDEEP:	12288:T8RNDWKhjjr+8M7e0dcrG4e5DNBRfex4d2Ozr3ST80yjlDUjHi8B:YRBBNU7eA+6rs80i1qi8
TLSH:	45E46C1BEAA801ECF27B913D88460516E7F0741B136267CF43E24A561F57AB5AF3E390
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'.~.Fz-.Fz-.Fz-o6y,.Fz-o6.,1Fz-.Fz-.Fz-..~,.Fz-..y,.Fz-...,.Fz-o6~,.Fz-o6\|,.Fz-o6{,.Fz-.F{-.Fz-..s,.Fz-..y,.Fz-...-.Fz-..x,.Fz

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140055310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65DD8785 [Tue Feb 27 06:56:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d05eed5b28e2082c65759a421c6f3bfa

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FEA74C66620h
dec eax
add esp, 28h
jmp 00007FEA74C65BFFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FEA74C65D92h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FEA74C65D95h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FEA74C65D8Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FEA74C656F6h
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FEA74C65CF1h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ef00	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xad000	0x6a1	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xa7000	0x4f38	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xeb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x93f90	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x93e50	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x86000	0x498	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x84cbe	0x84e00	ef82e1bbb6f3bd2c3dc8891f9649858e	False	0.4309791715663217	data	6.4533863281507715	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x86000	0x19e98	0x1a000	2de47c4d6fb81fd4e30da2b81be8f271	False	0.40442833533653844	data	5.046197894214373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa0000	0x62ac	0x2400	4046c0b27be31192214d9d2827b5b6e9	False	0.14876302083333334	DOS executable (block device driver)	3.755771211802524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xa7000	0x4f38	0x5000	51bc825de2c686cc52e24e2f2061d81a	False	0.47470703125	data	5.782404509379289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0xac000	0x1f4	0x200	2cd34d966d4eb1345d70df222888ef93	False	0.515625	data	4.194826601975507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xad000	0x6a1	0x800	ed14081ccf3d265a70c0e3cdef8b46f7	False	0.3896484375	data	3.578208011982351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xeb0	0x1000	08882a3e3c0a0d4ff1f233e521bace2b	False	0.425048828125	data	5.30487461027706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0xad0f0	0xc8	data	English	United States	0.54
RT_VERSION	0xad1b8	0x36c	data	English	United States	0.4577625570776256
RT_MANIFEST	0xad524	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetLastError, FileTimeToSystemTime, GlobalAlloc, CloseHandle, DecodePointer, GetFileSize, DeleteCriticalSection, GetProcessHeap, SystemTimeToFileTime, WideCharToMultiByte, SystemTimeToTzSpecificLocalTime, GetComputerNameA, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, GetFileInformationByHandle, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, Sleep, MultiByteToWideChar, WaitForSingleObject, FindClose, InitializeCriticalSectionEx, CreatePipe, GetModuleFileNameW, FindNextFileW, GetOEMCP, GetACP, IsValidCodePage, HeapSize, SetFilePointerEx, GetFileSizeEx, GetConsoleOutputCP, FlushFileBuffers, ReadConsoleW, GetConsoleMode, SetStdHandle, GetCurrentDirectoryW, GetFullPathNameW, FindFirstFileExW, FreeEnvironmentStringsW, ReadFile, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, HeapReAlloc, HeapFree, HeapAlloc, WriteFile, GetStdHandle, GetStringTypeW, GetLocaleInfoEx, EnterCriticalSection, LeaveCriticalSection, EncodePointer, LocalFree, LCMapStringEx, CompareStringEx, GetCPInfo, IsDebuggerPresent, OutputDebugStringW, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess, GetModuleHandleExW, CreateFileW, GetDriveTypeW, GetFileType, PeekNamedPipe, RtlUnwind
USER32.dll	GetClientRect, ReleaseDC, GetDesktopWindow, GetDC
GDI32.dll	SelectObject, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, DeleteObject
ADVAPI32.dll	GetUserNameA
SHELL32.dll
ole32.dll	CoCreateInstance, CreateStreamOnHGlobal, CoUninitialize, CoInitialize
OLEAUT32.dll	VariantClear
IPHLPAPI.DLL	GetNetworkParams, GetAdaptersInfo, GetTcpTable
WS2_32.dll	inet_ntoa, ntohs
gdiplus.dll	GdiplusStartup, GdiplusShutdown, GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdipCreateBitmapFromHBITMAP, GdipCloneImage, GdipAlloc, GdipGetImageEncoders

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 17:11:19.793714046 CEST	49707	8080	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.076463938 CEST	8080	49707	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:20.076571941 CEST	49707	8080	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.077334881 CEST	49707	8080	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.082287073 CEST	8080	49707	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:20.704090118 CEST	8080	49707	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:20.707959890 CEST	49707	8080	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.708924055 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.712806940 CEST	8080	49707	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:20.713712931 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:20.713784933 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.715351105 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:20.720191956 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:21.365818024 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:21.365864038 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:21.365923882 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:21.368236065 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:21.373356104 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:21.545169115 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:21.589998960 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:21.684803009 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:21.730586052 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:22.053395033 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:22.053486109 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:23.358769894 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:23.359324932 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:23.363859892 CEST	8443	49708	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:23.363920927 CEST	49708	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:23.364566088 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:23.364645958 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:23.364866972 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:23.369713068 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:23.369721889 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:23.951437950 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:23.996232986 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:24.082338095 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:24.082771063 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:24.083782911 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:24.090380907 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:24.090411901 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:24.254812956 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:11:24.308707952 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:50.715392113 CEST	49707	8080	192.168.2.10	45.66.249.249
Sep 18, 2024 17:11:50.720545053 CEST	8080	49707	45.66.249.249	192.168.2.10
Sep 18, 2024 17:12:20.715286970 CEST	49707	8080	192.168.2.10	45.66.249.249
Sep 18, 2024 17:12:20.810276985 CEST	8080	49707	45.66.249.249	192.168.2.10
Sep 18, 2024 17:12:24.511703014 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:12:24.511724949 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:12:24.511897087 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:12:24.512240887 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:12:24.512535095 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:12:24.512579918 CEST	49710	8443	192.168.2.10	45.66.249.249
Sep 18, 2024 17:12:24.517385960 CEST	8443	49710	45.66.249.249	192.168.2.10
Sep 18, 2024 17:12:24.517421961 CEST	8443	49710	45.66.249.249	192.168.2.10

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 18, 2024 17:09:40.101671934 CEST	1.1.1.1	192.168.2.10	0x1f26	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 18, 2024 17:09:40.101671934 CEST	1.1.1.1	192.168.2.10	0x1f26	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

45.66.249.249:8080

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	45.66.249.249	8080	8152	C:\Users\user\Desktop\forest.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 17:11:20.077334881 CEST	194	OUT	GET /sock HTTP/1.1 Connection: Upgrade Upgrade: websocket User-Agent: Where are my socks? Sec-WebSocket-Key: knZ6tsATkpSvprUi2z7eqA== Sec-WebSocket-Version: 13 Host: 45.66.249.249:8080
Sep 18, 2024 17:11:20.704090118 CEST	147	IN	HTTP/1.1 101 Upgrade: websocket Connection: upgrade Sec-WebSocket-Accept: f3eq0I1MXjDtACVnS/vIaNSVc/c= Date: Wed, 18 Sep 2024 15:11:20 GMT

Target ID:	0
Start time:	11:09:22
Start date:	18/09/2024
Path:	C:\Users\user\Desktop\forest.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\forest.exe"
Imagebase:	0x7ff7d4bb0000
File size:	688'128 bytes
MD5 hash:	5242F809563EB3764684EF1180ADB902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:11:30
Start date:	18/09/2024
Path:	C:\Users\user\Desktop\forest.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\forest.exe"
Imagebase:	0x7ff7d4bb0000
File size:	688'128 bytes
MD5 hash:	5242F809563EB3764684EF1180ADB902
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.8%
Total number of Nodes:	393
Total number of Limit Nodes:	19

Executed Functions

Function 00007FF7D4BB5040 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB566D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5673
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5679
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB567F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5685
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB57DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB57E4

Strings

Winhttp.dll, xrefs: 00007FF7D4BB504A
", "id":", xrefs: 00007FF7D4BB5192
Where are my socks?, xrefs: 00007FF7D4BB5445
GET, xrefs: 00007FF7D4BB54A6
{"n":", xrefs: 00007FF7D4BB50BF

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ", "id":"$GET$Where are my socks?$Winhttp.dll${"n":"
API String ID: 3668304517-3084486490
Opcode ID: 52c6d12674501996d600ae5c6b18087dcd41be30664ee04f3a59ddbf578eb56f
Instruction ID: c2c006744293b1dba37bd192851c4ea945befef69564c87072628133ce49c61e
Opcode Fuzzy Hash: 52c6d12674501996d600ae5c6b18087dcd41be30664ee04f3a59ddbf578eb56f
Instruction Fuzzy Hash: E3129872A18BC281EA10EF26E4813ADA761FBD57D4FD05233DA9D126A5DF7CE085C720

Function 00007FF7D4BC7B00 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sock, xrefs: 00007FF7D4BC7E7D, 00007FF7D4BC7EB7
Zm9yZXN0, xrefs: 00007FF7D4BC7C0A
NDUuNjYuMjQ5LjI0OQ==, xrefs: 00007FF7D4BC7BE6
UXpwY1ZYTmxjbk5j, xrefs: 00007FF7D4BC7871
WEVGd2NFUmhkR0ZjVW05aGJXbHVaMXhOYVdOeWIzTnZablJjVjJsdVpHOTNjMXhUZEdGeWRDQk5aVzUxWEZCeWIyZHlZVzF6WEZOMFlYSjBkWEJjVjJsdVpHOTNjMU5XUXk1c2Jtcz0=, xrefs: 00007FF7D4BC782D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: NDUuNjYuMjQ5LjI0OQ==$UXpwY1ZYTmxjbk5j$WEVGd2NFUmhkR0ZjVW05aGJXbHVaMXhOYVdOeWIzTnZablJjVjJsdVpHOTNjMXhUZEdGeWRDQk5aVzUxWEZCeWIyZHlZVzF6WEZOMFlYSjBkWEJjVjJsdVpHOTNjMU5XUXk1c2Jtcz0=$Zm9yZXN0$sock
API String ID: 0-1601384142
Opcode ID: 838d58c21301ba66f7a004aa24602807d6e513183d783e348904fbaeeaa868b4
Instruction ID: 718d455da59b04b631ce1585a9b68cfe886f0088cfa0a73cb1a1dacb995eb83a
Opcode Fuzzy Hash: 838d58c21301ba66f7a004aa24602807d6e513183d783e348904fbaeeaa868b4
Instruction Fuzzy Hash: F471AF72B0564289EB20EF62E8941EDB7A2FB98384FC04137EA4D57B99EF38D540C710

Function 00007FF7D4BB46D0 Relevance: 10.8, APIs: 7, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHTestTokenMembership.SHELL32 ref: 00007FF7D4BB4756
GetUserNameA.ADVAPI32 ref: 00007FF7D4BB4780
GetComputerNameA.KERNEL32 ref: 00007FF7D4BB4877
GetModuleFileNameW.KERNEL32 ref: 00007FF7D4BB4964
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB4AE2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB4AE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB4AEE

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Name_invalid_parameter_noinfo_noreturn$ComputerFileMembershipModuleTestTokenUser
String ID:
API String ID: 1487706099-0
Opcode ID: a2be92b86f2a76cd6de73feddaf6bbaf57d5d00667dee1a597eb8376ca4a82ac
Instruction ID: 1fd03d971dc16d298e4eda58aba7e20c9fcbbb00e30d728fafdb2baeee233f73
Opcode Fuzzy Hash: a2be92b86f2a76cd6de73feddaf6bbaf57d5d00667dee1a597eb8376ca4a82ac
Instruction Fuzzy Hash: 92C1E662E18B8581EA10DF26D4842ADA761FB657D4FD15223EA9C22ADADF78E1C1C310

Function 00007FF7D4BB5EF0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB61F8

Strings

002, xrefs: 00007FF7D4BB60D7
/bc, xrefs: 00007FF7D4BB5FCF
pRequest, xrefs: 00007FF7D4BB5F6F
003, xrefs: 00007FF7D4BB610D, 00007FF7D4BB6143, 00007FF7D4BB617F, 00007FF7D4BB61BB
GET, xrefs: 00007FF7D4BB5FD6

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: /bc$002$003$GET$pRequest
API String ID: 3668304517-2660936391
Opcode ID: 6821f11a4b0029687b84fdeaf5abc130de5222e1d40ca23e82932a065d35dbd9
Instruction ID: 2601fee43a729031f7434e1b823f38b925e95238ef327e422ef5ee10a0354a5c
Opcode Fuzzy Hash: 6821f11a4b0029687b84fdeaf5abc130de5222e1d40ca23e82932a065d35dbd9
Instruction Fuzzy Hash: A4816F72A18A8681EA20EF26E5D17ADB361FB947C0FC45133D64D53AA5DF3CE505C720

Function 00007FF7D4BC66F0 Relevance: 21.0, APIs: 1, Strings: 11, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC675A

Strings

sock, xrefs: 00007FF7D4BC7E7D, 00007FF7D4BC7EB7
Zm9yZXN0, xrefs: 00007FF7D4BC7C0A
stoi argument out of range, xrefs: 00007FF7D4BC6B1A, 00007FF7D4BC7766
NDUuNjYuMjQ5LjI0OQ==, xrefs: 00007FF7D4BC7BE6
{"status":"105"}, xrefs: 00007FF7D4BC752C
{"status":"004"}, xrefs: 00007FF7D4BC67C7, 00007FF7D4BC728F
invalid stoi argument, xrefs: 00007FF7D4BC6B0D, 00007FF7D4BC7779
{"n":", xrefs: 00007FF7D4BC6C9F
", "v":", xrefs: 00007FF7D4BC6D4A
{"status":"026"}, xrefs: 00007FF7D4BC6BD7, 00007FF7D4BC70CE
{"status":"005"}, xrefs: 00007FF7D4BC6A26

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ", "v":"$NDUuNjYuMjQ5LjI0OQ==$Zm9yZXN0$invalid stoi argument$sock$stoi argument out of range${"n":"${"status":"004"}${"status":"005"}${"status":"026"}${"status":"105"}
API String ID: 3668304517-2369935561
Opcode ID: 8d6a0734a1a2f6107b3da3b6a01a667e0bd6b3a308cb62972b779b33c1b19ff9
Instruction ID: 3d71b968435596bb5b41da7efb740440292df1b431b7d4b4db8abc578c13d37a
Opcode Fuzzy Hash: 8d6a0734a1a2f6107b3da3b6a01a667e0bd6b3a308cb62972b779b33c1b19ff9
Instruction Fuzzy Hash: BBF090A1B1474541EA15AF26D0C836D6222DB04FC9FE44433CA5C0A68ACE6DD4868364

Function 00007FF7D4BB6660 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 189
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32 ref: 00007FF7D4BB66A9

Part of subcall function 00007FF7D4BB4F00: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB502F

OpenServiceA.ADVAPI32 ref: 00007FF7D4BB67EB
QueryServiceStatusEx.ADVAPI32 ref: 00007FF7D4BB6809
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB68AB
GdipDisposeImage.GDIPLUS ref: 00007FF7D4BB68DD
GdipFree.GDIPLUS ref: 00007FF7D4BB68F2

Strings

VkJveFNlcnZpY2U=, xrefs: 00007FF7D4BB670D
Vk1Ub29scw==, xrefs: 00007FF7D4BB66D7
Seems ok, xrefs: 00007FF7D4BB6820

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: GdipOpenService_invalid_parameter_noinfo_noreturn$DisposeFreeImageManagerQueryStatus
String ID: Seems ok$Vk1Ub29scw==$VkJveFNlcnZpY2U=
API String ID: 3199510081-3703604791
Opcode ID: 540f9263f055597c8382bee0da1726551e37c503f22e868b7c55dda0e55a9baf
Instruction ID: a2c12c734fdf0a4da0d55b053bf806d3db96cb68eb5a3173535df21d5c907d70
Opcode Fuzzy Hash: 540f9263f055597c8382bee0da1726551e37c503f22e868b7c55dda0e55a9baf
Instruction Fuzzy Hash: B6718132F15B4189EB10EF66E8802ADB761FB98798FD44237EA4D13A59EF38D585C310

Function 00007FF7D4C1E8F4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,7FFFFFFFFFFFFFFF,00007FF7D4C1F2BC,?,?,?,?,00007FF7D4C14209,?,?,?,?,00007FF7D4BDFA4C), ref: 00007FF7D4C1EA73
GetProcAddressForCaller.KERNELBASE(?,?,7FFFFFFFFFFFFFFF,00007FF7D4C1F2BC,?,?,?,?,00007FF7D4C14209,?,?,?,?,00007FF7D4BDFA4C), ref: 00007FF7D4C1EA7F

Strings

api-ms-, xrefs: 00007FF7D4C1E9BD
ext-ms-, xrefs: 00007FF7D4C1E9D0

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: AddressCallerFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3520295827-537541572
Opcode ID: 912c94047a0cb9539cafd7d5ce12736182df3d91ecf7096a8cea6366d4922533
Instruction ID: dce04f38920b554eee9bbda669f03052bd2538d0d6bf28c4a79afd28fe837c3d
Opcode Fuzzy Hash: 912c94047a0cb9539cafd7d5ce12736182df3d91ecf7096a8cea6366d4922533
Instruction Fuzzy Hash: 4C419061B19A0281EA55AF17E8941BDABA1BF45BE0FC88137DD1D87784EF3CE4458330

Function 00007FF7D4C0519C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7D4C04E80: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7D4C04E94

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7D4C051C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7D4C0522E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7D4C05281

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: e4a17efe478abd50984052b8a0019fdc49fd87fe32912cdc85873eec47f6ce3e
Instruction ID: 4ad1be27efb6c3bca754fb584aa2b17a49b68d079d668586d12780cdd37c3757
Opcode Fuzzy Hash: e4a17efe478abd50984052b8a0019fdc49fd87fe32912cdc85873eec47f6ce3e
Instruction Fuzzy Hash: BC312820E0910346FA24FF67D4D93BD92919F917C4FC45037DA0E2B2D3DE2CA9058674

Function 00007FF7D4BB1DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7D4BB1DFB

Strings

Winhttp.dll, xrefs: 00007FF7D4BB1DEC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: LibraryLoad
String ID: Winhttp.dll
API String ID: 1029625771-1936088768
Opcode ID: 7a429ab9266b4f3fffa479279b48a073b534981f8cae20d0d5e5bf2d62eddd7e
Instruction ID: 3982cb8a6e37540fe89d97f66a1350a661ca37a3e63f1b83aafdc11a57482f87
Opcode Fuzzy Hash: 7a429ab9266b4f3fffa479279b48a073b534981f8cae20d0d5e5bf2d62eddd7e
Instruction Fuzzy Hash: 14D0E925F59A02C2EA54BF13ECD503DA2A4BB98791FC40177C04E85225DF2CA5998728

Function 00007FF7D4C2218C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C221B7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: dc89c29555d5d88225e870e6d7040d38a1bbc348fd38f3aaa4cad493a1cad2d3
Instruction ID: ee7b7fa0058dbd0d6b7a7e5069a17f12fbc187103d634ca72efb1b3a7cedc422
Opcode Fuzzy Hash: dc89c29555d5d88225e870e6d7040d38a1bbc348fd38f3aaa4cad493a1cad2d3
Instruction Fuzzy Hash: 67115B3691864282F310AF16E8C067DF7A0BB447C0FD50937E65D676A6EEBDE8108B20

Function 00007FF7D4C199F0 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C19A04

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ad82f3d5463a9e98e1552197bf2295ae65c8778a080b52305350446953181a80
Instruction ID: 6d5390d6e163998698ea89ac5d116fb48fe604f4519f88efe066e7fd72f573b8
Opcode Fuzzy Hash: ad82f3d5463a9e98e1552197bf2295ae65c8778a080b52305350446953181a80
Instruction Fuzzy Hash: 17E01A35E0914386FA147FA6C8D23BDA2B09F483C4FD08433E20C462C2CFAD28068739

Function 00007FF7D4C04E80 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7D4C04E94

Part of subcall function 00007FF7D4C07120: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7D4C07128
Part of subcall function 00007FF7D4C07120: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7D4C0712D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 39a315521b5a0a89ce840e419fc18619f359d4d2551cdf961bb8d95cb46cf093
Instruction ID: f5b80ec7120100bd2b44381d54d5673dda24137ba02cd8665469ac3df4494a3c
Opcode Fuzzy Hash: 39a315521b5a0a89ce840e419fc18619f359d4d2551cdf961bb8d95cb46cf093
Instruction Fuzzy Hash: 67E0B610E0D15350FE593E63D6CA2BED2801F253C9ED0047BD92D321C39D5D74561AB5

Function 00007FF7D4C1D5F8 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7D4C1E3CA,?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1D64D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 207747ec03c5779b6438231ab1fa883743136f62b2697e2ac2019a5d10ff2dad
Instruction ID: bced15d78ba74968a1d037ec0adce3dee883698947d22b59c0c120126a8af04a
Opcode Fuzzy Hash: 207747ec03c5779b6438231ab1fa883743136f62b2697e2ac2019a5d10ff2dad
Instruction Fuzzy Hash: BEF0F954F1968781FE557E67D9952BD92B05F88BC0FC84833C90E862D2FE5CB4818230

Non-executed Functions

Function 00007FF7D4BBE9E0 Relevance: 102.4, APIs: 48, Strings: 10, Instructions: 935windowmemoryCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS ref: 00007FF7D4BBECC3
GetDesktopWindow.USER32 ref: 00007FF7D4BBECC9
GetDC.USER32 ref: 00007FF7D4BBECD2
CreateCompatibleDC.GDI32 ref: 00007FF7D4BBECE3
GetDesktopWindow.USER32 ref: 00007FF7D4BBECF0
GetClientRect.USER32 ref: 00007FF7D4BBED00
CreateCompatibleBitmap.GDI32 ref: 00007FF7D4BBED26
SelectObject.GDI32 ref: 00007FF7D4BBED3A
BitBlt.GDI32 ref: 00007FF7D4BBED6E
GdipAlloc.GDIPLUS ref: 00007FF7D4BBED79
GdipCreateBitmapFromHBITMAP.GDIPLUS ref: 00007FF7D4BBEDB7
GdipGetImageEncodersSize.GDIPLUS ref: 00007FF7D4BBEDDE
SelectObject.GDI32 ref: 00007FF7D4BBEE50
DeleteObject.GDI32 ref: 00007FF7D4BBEE59
DeleteObject.GDI32 ref: 00007FF7D4BBEE64
GetDesktopWindow.USER32 ref: 00007FF7D4BBEE6A
ReleaseDC.USER32 ref: 00007FF7D4BBEE78
GdiplusShutdown.GDIPLUS ref: 00007FF7D4BBEE85
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF997
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF99D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBF9FD

Strings

{"status":"103"}, xrefs: 00007FF7D4BBEB12
", "id":", xrefs: 00007FF7D4BBF26D
", "uId":", xrefs: 00007FF7D4BBF2FD
image/, xrefs: 00007FF7D4BBEB70
105, xrefs: 00007FF7D4BBF6CC
, xrefs: 00007FF7D4BBED45
{"status":"013"}, xrefs: 00007FF7D4BBEA7F, 00007FF7D4BBEE1E
", "d":", xrefs: 00007FF7D4BBF394
{"n":", xrefs: 00007FF7D4BBF1C4
{"status":"014"}, xrefs: 00007FF7D4BBEF6B

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Object$CreateDesktopGdipWindow$BitmapCompatibleDeleteGdiplusSelect$AllocClientEncodersFromImageRectReleaseShutdownSizeStartup
String ID: $", "d":"$", "uId":"$", "id":"$105$image/${"n":"${"status":"013"}${"status":"014"}${"status":"103"}
API String ID: 149809242-3914048934
Opcode ID: ef322a054e7980fd1c65c34188ce0f6eeddda7de61b96defefaa8c2d82c62b78
Instruction ID: ce55aa405c07e9af08d50e44c3675477f7046a5804b82855c3f18c07daf19a3d
Opcode Fuzzy Hash: ef322a054e7980fd1c65c34188ce0f6eeddda7de61b96defefaa8c2d82c62b78
Instruction Fuzzy Hash: 6DA2AE32A14BC585EB20EF26D8843ED6761FB99798FC04233DA5D57AA9DF78E184C310

Function 00007FF7D4BBA110 Relevance: 99.9, APIs: 46, Strings: 10, Instructions: 1904COMMON

Download Yara Rule

Strings

", "id":", xrefs: 00007FF7D4BBBAAB
{"status":"010"}, xrefs: 00007FF7D4BBA5EA, 00007FF7D4BBA6B3, 00007FF7D4BBA9AA, 00007FF7D4BBA9F3, 00007FF7D4BBC077
stoi argument out of range, xrefs: 00007FF7D4BBA440
101, xrefs: 00007FF7D4BBBF0F
", "d":", xrefs: 00007FF7D4BBBBDD
invalid stoi argument, xrefs: 00007FF7D4BBA433
{"n":", xrefs: 00007FF7D4BBB9FF
", "uId":", xrefs: 00007FF7D4BBBB3C
{"status":"110"}, xrefs: 00007FF7D4BBA503
{"status":"102"}, xrefs: 00007FF7D4BBA21B, 00007FF7D4BBA3CA

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: ", "d":"$", "id":"$", "uId":"$101$invalid stoi argument$stoi argument out of range${"n":"${"status":"010"}${"status":"102"}${"status":"110"}
API String ID: 0-3917518979
Opcode ID: ee7c6142e077d018a0edae1bb93f682eed05a56daa3bb6535a0af21e663f0f0f
Instruction ID: 00ade89ebf8f58469dc9380fabef47024d9a414ef073d5624bbb69c3d80f8567
Opcode Fuzzy Hash: ee7c6142e077d018a0edae1bb93f682eed05a56daa3bb6535a0af21e663f0f0f
Instruction Fuzzy Hash: 2503E262E19B8645EB10EF36D4843EDA761EB55798FD04233EA6C17ADADF38E480C314

Function 00007FF7D4BF4404 Relevance: 97.1, APIs: 54, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF445F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4488
_Getctype.LIBCPMT ref: 00007FF7D4BF44BC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4517
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4540
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4583
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF45AC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF45EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4614
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4650
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4679
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF46B8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF46E1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF471E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4747
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF47A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF47CE
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4829
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4852
_Getcoll.LIBCPMT ref: 00007FF7D4BF4886
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF48B2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF48DB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF491E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4947
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF49F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4A1B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4AC1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4AEA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4B8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4BB7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4C15
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4C3E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4C81
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4CAA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4D16
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4D3F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4D86
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4DAF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4E16
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4E3F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4E7F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4EA8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4F2E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4F57
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF4F9E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF4FC7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF503E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5067

Strings

file=, xrefs: 00007FF7D4BF4418

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctype
String ID: file=
API String ID: 19648113-2538679502
Opcode ID: 396c6eee7f4c872df5603970c7d1090a95535081cb8cbfcc141ec48a3ca9cc28
Instruction ID: 1876bcb6fd0fb64d0d9747dbb97d44d669df1c24d53cfa79417ce227ebe4fc08
Opcode Fuzzy Hash: 396c6eee7f4c872df5603970c7d1090a95535081cb8cbfcc141ec48a3ca9cc28
Instruction Fuzzy Hash: DA820C21A0BA0245EA55BF23E9D02BCA3E0AF647C4BC84537D94E67796EF3CF5418760

Function 00007FF7D4BF50AC Relevance: 97.1, APIs: 54, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5107
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5130
_Getctype.LIBCPMT ref: 00007FF7D4BF5164
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF51BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF51E8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF522B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5254
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5293
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF52BC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF52F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5321
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5360
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5389
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF53C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF53EF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF544D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5476
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF54D1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF54FA
_Getcoll.LIBCPMT ref: 00007FF7D4BF552E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF555A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5583
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF55C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF55EF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF569A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF56C3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5769
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5792
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5836
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF585F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF58BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF58E6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5929
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5952
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF59BE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF59E7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5A2E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5A57

Part of subcall function 00007FF7D4BF37A8: _Getvals.LIBCPMT ref: 00007FF7D4BF3826

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5ABE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5AE7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5B27
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5B50
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5BD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5BFF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5C46
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5C6F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BF5CE6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BF5D0F

Strings

file=, xrefs: 00007FF7D4BF50C0

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctypeGetvals
String ID: file=
API String ID: 553569086-2538679502
Opcode ID: 67a1c0790ef1249461a340128b7fb1e3b27baf6d4379e39df7b50e971e6fd2f5
Instruction ID: e164f577e9cb6d7e927d2407810608ca7cfe9484c4a1564b4f07f08d341789fd
Opcode Fuzzy Hash: 67a1c0790ef1249461a340128b7fb1e3b27baf6d4379e39df7b50e971e6fd2f5
Instruction Fuzzy Hash: CC822822A0EA0285EA51BF62D8C02BCA3E1AF647C4FC84537D94E57396EF3CF5518760

Function 00007FF7D4BB7260 Relevance: 90.9, APIs: 36, Strings: 15, Instructions: 1697COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB7640
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB7694
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8C68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8C6E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8C74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8C86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8C92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8C9E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CA4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CC8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CF2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8CFE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D04
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D10
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D22
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D28
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D3A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D40
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D52
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D58
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D64
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D6A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D7C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D82
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB8D8E

Part of subcall function 00007FF7D4BD3E80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BD3F92
Part of subcall function 00007FF7D4BD3E80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD3F98

Strings

Content-Disposition: form-data; name="id", xrefs: 00007FF7D4BB7BE9
&, xrefs: 00007FF7D4BB8696
Content-Disposition: form-data; name="fInf", xrefs: 00007FF7D4BB7EE7
Content-Disposition: form-data; name="n", xrefs: 00007FF7D4BB77C8
{"status":"008"}, xrefs: 00007FF7D4BB738E
Content-Disposition: form-data; name="f"; filename=", xrefs: 00007FF7D4BB84E4
POST, xrefs: 00007FF7D4BB7354
{"status":"024"}, xrefs: 00007FF7D4BB8AAE, 00007FF7D4BB8B03
", "fid":"1"}, xrefs: 00007FF7D4BB89E2
Content-Type: multipart/form-data; boundary = , xrefs: 00007FF7D4BB757C
", "flDr":", xrefs: 00007FF7D4BB89B8
--------------------------346435246262465368257857, xrefs: 00007FF7D4BB7508
Content-Disposition: form-data; name="m", xrefs: 00007FF7D4BB81E6
Content-Type: application/octet-stream, xrefs: 00007FF7D4BB869F
{"status":"111", "fName":", xrefs: 00007FF7D4BB89A7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharMultiWide$Concurrency::cancel_current_task
String ID: ", "fid":"1"}$", "flDr":"$&$--------------------------346435246262465368257857$Content-Disposition: form-data; name="f"; filename="$Content-Disposition: form-data; name="fInf"$Content-Disposition: form-data; name="id"$Content-Disposition: form-data; name="m"$Content-Disposition: form-data; name="n"$Content-Type: application/octet-stream$Content-Type: multipart/form-data; boundary = $POST${"status":"008"}${"status":"024"}${"status":"111", "fName":"
API String ID: 3480596355-259015812
Opcode ID: 0838fe6f16684eb46940be8f1169d7bcf9463f7978d7b620442b91148171e785
Instruction ID: bb6c1e7b3d52193e6f91a63adc3388a91ebc101814d3dd306bf8d2ea4e60319c
Opcode Fuzzy Hash: 0838fe6f16684eb46940be8f1169d7bcf9463f7978d7b620442b91148171e785
Instruction Fuzzy Hash: E4F2F562B19B8185EB00EF76D4C43ADA761FBA5398FC05633EA5D16ADADF38D480C314

Function 00007FF7D4BBC300 Relevance: 76.5, APIs: 28, Strings: 15, Instructions: 1261networkCOMMON

Download Yara Rule

APIs

GetTcpTable.IPHLPAPI ref: 00007FF7D4BBC48F
GetTcpTable.IPHLPAPI ref: 00007FF7D4BBC593
inet_ntoa.WS2_32 ref: 00007FF7D4BBC7C5
htons.WS2_32 ref: 00007FF7D4BBC987
inet_ntoa.WS2_32 ref: 00007FF7D4BBCB8A
htons.WS2_32 ref: 00007FF7D4BBCD4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD785
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD78B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD79D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7A3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD7FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD803
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBD80F

Strings

{"status":"103"}, xrefs: 00007FF7D4BBDED1, 00007FF7D4BBFEB8
{"status":"011"}, xrefs: 00007FF7D4BBC3A2, 00007FF7D4BBC4D4, 00007FF7D4BBD714
", "id":", xrefs: 00007FF7D4BBD15C, 00007FF7D4BBE2D5, 00007FF7D4BC01E9
VUUU, xrefs: 00007FF7D4BBFB85
{"n":", xrefs: 00007FF7D4BBD0B0, 00007FF7D4BBE226, 00007FF7D4BC0140
{"status":"015"}, xrefs: 00007FF7D4BBFDA0, 00007FF7D4BBFF16
102, xrefs: 00007FF7D4BBD5C4
{"status":"016"}, xrefs: 00007FF7D4BC0A31
", "uId":", xrefs: 00007FF7D4BC0279
104, xrefs: 00007FF7D4BBE72B
UXpwY1ZYTmxjbk5j, xrefs: 00007FF7D4BBDD31
{"status":"012"}, xrefs: 00007FF7D4BBDC38, 00007FF7D4BBE144, 00007FF7D4BBE168
", "d":", xrefs: 00007FF7D4BBD284, 00007FF7D4BBE3FC, 00007FF7D4BC0312
", "uId":", xrefs: 00007FF7D4BBD1E8, 00007FF7D4BBE365
106, xrefs: 00007FF7D4BC064F

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Tablehtonsinet_ntoa
String ID: ", "d":"$", "uId":"$", "id":"$", "uId":"$102$104$106$UXpwY1ZYTmxjbk5j$VUUU${"n":"${"status":"011"}${"status":"012"}${"status":"015"}${"status":"016"}${"status":"103"}
API String ID: 2861794738-2026247035
Opcode ID: 18c6ea4742a7190a7bc6c5767b69587352ecc130419f13d85746abf318837e22
Instruction ID: 57df52fb964d67adceb405696be100d9aab8265e35e92cad56e2aa8fd1664949
Opcode Fuzzy Hash: 18c6ea4742a7190a7bc6c5767b69587352ecc130419f13d85746abf318837e22
Instruction Fuzzy Hash: 53C2E322A19BC685EB10EF36D4803EDA761EB95794FD08233DA5D17ADADF78E180C310

Function 00007FF7D4C01E60 Relevance: 60.0, APIs: 33, Strings: 1, Instructions: 503COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C0067C: _Getcoll.LIBCPMT ref: 00007FF7D4C00718

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C01EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C01EEF
_Getcoll.LIBCPMT ref: 00007FF7D4C01F23
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C01F4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C01F78
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C01FBB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C01FE4
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C02023
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C0204C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0208F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C020B8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C020F7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C02120
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0215E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C02187
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C021C5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C021EE
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0222B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C02254
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C022B2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C022DB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0231E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C02347
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C023B3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C023DC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C02423
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C0244C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C024B3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C024DC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0251C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C02545
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C025C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C025EB

Strings

file=, xrefs: 00007FF7D4C01E74

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getcoll
String ID: file=
API String ID: 2318601406-2538679502
Opcode ID: c4e082c22604d0d01a263d60d7e2b20a58e754c6ccc846a024c985314d72cb5a
Instruction ID: 8eb7057ba4c91f47809811cbf871b6b5897799682ba84fffb242455dccdaaed8
Opcode Fuzzy Hash: c4e082c22604d0d01a263d60d7e2b20a58e754c6ccc846a024c985314d72cb5a
Instruction Fuzzy Hash: A4323B21A0AA1245EE55BF53D8C42BDA7E0AF547C0FC84437EA4E67795EF3CE8428760

Function 00007FF7D4BC09A0 Relevance: 53.4, APIs: 23, Strings: 7, Instructions: 919processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7D4BC0B29
Process32FirstW.KERNEL32 ref: 00007FF7D4BC0BDC
WideCharToMultiByte.KERNEL32 ref: 00007FF7D4BC0C14
WideCharToMultiByte.KERNEL32 ref: 00007FF7D4BC0C9A
Process32NextW.KERNEL32 ref: 00007FF7D4BC106E
CloseHandle.KERNEL32 ref: 00007FF7D4BC1107
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC190F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1915
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC191B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1921
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1927
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC192D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1933
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC193F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1945
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC194B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1951
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1957
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC195D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1963
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC196F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC1975
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC197B

Strings

{"status":"103"}, xrefs: 00007FF7D4BBDED1, 00007FF7D4BBFEB8, 00007FF7D4BC0ADE
{"status":"016"}, xrefs: 00007FF7D4BC0A31, 00007FF7D4BC0B58, 00007FF7D4BC109F
", "id":", xrefs: 00007FF7D4BBD15C, 00007FF7D4BBE2D5, 00007FF7D4BC01E9, 00007FF7D4BC126E
107, xrefs: 00007FF7D4BC170B
", "d":", xrefs: 00007FF7D4BBD284, 00007FF7D4BBE3FC, 00007FF7D4BC0312, 00007FF7D4BC13AD
", "uId":", xrefs: 00007FF7D4BBD1E8, 00007FF7D4BBE365, 00007FF7D4BC1311
{"n":", xrefs: 00007FF7D4BBD0B0, 00007FF7D4BBE226, 00007FF7D4BC0140, 00007FF7D4BC11B0

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharMultiProcess32Wide$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: ", "d":"$", "id":"$", "uId":"$107${"n":"${"status":"016"}${"status":"103"}
API String ID: 2079577941-3782765540
Opcode ID: 729b7cb32be10c0a944716848bbef28e45815e262deb30b19e7ef0a5808eb1ca
Instruction ID: ddf7b8e2cf74fcc56257248044cbb48e41c736759fbf33db0ab172eb05f0f9ac
Opcode Fuzzy Hash: 729b7cb32be10c0a944716848bbef28e45815e262deb30b19e7ef0a5808eb1ca
Instruction Fuzzy Hash: 93928362A19BC585EB20EF35D8C43EDA361FBA5798F905323D65C16AEADF78D180C310

Function 00007FF7D4C16AB4 Relevance: 47.4, APIs: 24, Strings: 2, Instructions: 1877COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C16DE8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C17047
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1730D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C17554
memcpy_s.LIBCPMT ref: 00007FF7D4C177BA
memcpy_s.LIBCPMT ref: 00007FF7D4C17A42
memcpy_s.LIBCPMT ref: 00007FF7D4C17C5B
memcpy_s.LIBCPMT ref: 00007FF7D4C17CD6
memcpy_s.LIBCPMT ref: 00007FF7D4C17D0B
memcpy_s.LIBCPMT ref: 00007FF7D4C17D46
memcpy_s.LIBCPMT ref: 00007FF7D4C17E72
memcpy_s.LIBCPMT ref: 00007FF7D4C17F97
memcpy_s.LIBCPMT ref: 00007FF7D4C18042
memcpy_s.LIBCPMT ref: 00007FF7D4C1808D
memcpy_s.LIBCPMT ref: 00007FF7D4C1815A
memcpy_s.LIBCPMT ref: 00007FF7D4C182E3
memcpy_s.LIBCPMT ref: 00007FF7D4C1835A
memcpy_s.LIBCPMT ref: 00007FF7D4C1839F
memcpy_s.LIBCPMT ref: 00007FF7D4C18451
memcpy_s.LIBCPMT ref: 00007FF7D4C1857E
memcpy_s.LIBCPMT ref: 00007FF7D4C17856

Part of subcall function 00007FF7D4C18E5C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C18E8E

memcpy_s.LIBCPMT ref: 00007FF7D4C18738

Strings

, xrefs: 00007FF7D4C184FE
, xrefs: 00007FF7D4C1862B

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: a3aae9aa187e148188ee3e8d0f716f249af1cb6b6161ada15a895cbeb3ca6e36
Instruction ID: daf33756a7952dda1f98c97cf4bcb16435ffc9234438935baeac16c6dd04dd00
Opcode Fuzzy Hash: a3aae9aa187e148188ee3e8d0f716f249af1cb6b6161ada15a895cbeb3ca6e36
Instruction Fuzzy Hash: 5D03B472A191828BE7759F26D5807FDB7A1FB943C8FC45137EA0E57B44DB389A008B60

Function 00007FF7D4BB69C0 Relevance: 42.5, APIs: 11, Strings: 13, Instructions: 546COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB720C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7212
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7218
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB721E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7224
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7230
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7236
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB723C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7242
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB7248
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB724E

Strings

{"status":"007"}, xrefs: 00007FF7D4BB7170
type=, xrefs: 00007FF7D4BB6A38
filename=, xrefs: 00007FF7D4BB8E15, 00007FF7D4BB9208
GET, xrefs: 00007FF7D4BB943B
{"status":", xrefs: 00007FF7D4BB6E69
Content-Type: application/json, xrefs: 00007FF7D4BB6DB8
", "fid":"0"}, xrefs: 00007FF7D4BB6F53
" , "t":", xrefs: 00007FF7D4BB6E80
file=, xrefs: 00007FF7D4BB92A9
POST, xrefs: 00007FF7D4BB6C45
{"status":"001"}, xrefs: 00007FF7D4BB6C81
{"status":"025"}, xrefs: 00007FF7D4BB9470, 00007FF7D4BB9602, 00007FF7D4BB975F
", "uId":", xrefs: 00007FF7D4BB6EC9

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: " , "t":"$", "fid":"0"}$", "uId":"$Content-Type: application/json$GET$POST$file=$filename=$type=${"status":"${"status":"001"}${"status":"007"}${"status":"025"}
API String ID: 3668304517-724035736
Opcode ID: 57557a2e8098d2de54157b2f1d2863870cfbd18935dff6268356b8b7b29fb187
Instruction ID: c994f0576239e8c6d714eda4e5bb7d4d923414f49476889f58535e8e9bf1fe6e
Opcode Fuzzy Hash: 57557a2e8098d2de54157b2f1d2863870cfbd18935dff6268356b8b7b29fb187
Instruction Fuzzy Hash: E632C362E15B8585EB00EF36D4843ADA721EB957D4FD05323EA6C12AEADF78E5C0C350

Function 00007FF7D4BC3AB0 Relevance: 41.2, APIs: 16, Strings: 7, Instructions: 941fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7D4BC40BB
GetLastError.KERNEL32 ref: 00007FF7D4BC40CE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC48E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC48E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC48EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC48FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4901
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4907
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC490D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4913
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4919
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC491F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4925
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC492B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4931
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC4937

Part of subcall function 00007FF7D4BCE920: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCE9EC
Part of subcall function 00007FF7D4BCE920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCE9F2

Part of subcall function 00007FF7D4BCF390: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCF47A
Part of subcall function 00007FF7D4BCF390: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCF480

Strings

{"status":"103"}, xrefs: 00007FF7D4BC59C7
{"status":"022"}, xrefs: 00007FF7D4BC5811
type=1, xrefs: 00007FF7D4BC5676
{"status":"108"}, xrefs: 00007FF7D4BC44CE, 00007FF7D4BC4802
{"status":"110"}, xrefs: 00007FF7D4BC5A64
{"status":"020"}, xrefs: 00007FF7D4BC3B44, 00007FF7D4BC3E85, 00007FF7D4BC40E7, 00007FF7D4BC440A, 00007FF7D4BC4599, 00007FF7D4BC4665, 00007FF7D4BC473E
{"status":"102"}, xrefs: 00007FF7D4BC5D5F

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$CreateErrorFileLast
String ID: type=1${"status":"020"}${"status":"022"}${"status":"102"}${"status":"103"}${"status":"108"}${"status":"110"}
API String ID: 847724067-3449146413
Opcode ID: a7df7adc844e351bbb82ad79d3e5ae8fdcc3bb12ac9e4706d04bc134d0cde42e
Instruction ID: 42467299dbca270fe9aa8b1e583737a769e503371b11f07c81d3f932c63eb724
Opcode Fuzzy Hash: a7df7adc844e351bbb82ad79d3e5ae8fdcc3bb12ac9e4706d04bc134d0cde42e
Instruction Fuzzy Hash: 2792B262F1A74281FA10EF76D4C42BDA361AFA4794FD05233D95D27AE9DE7CE5808310

Function 00007FF7D4BC4940 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 619memoryCOMMON

Download Yara Rule

APIs

RtlCreateProcessParametersEx.NTDLL ref: 00007FF7D4BC4E2B
GetProcessHeap.KERNEL32 ref: 00007FF7D4BC4E71
HeapAlloc.KERNEL32 ref: 00007FF7D4BC4E83
GetProcessHeap.KERNEL32 ref: 00007FF7D4BC51CE
RtlFreeHeap.NTDLL ref: 00007FF7D4BC51DC
RtlDestroyEnvironment.NTDLL ref: 00007FF7D4BC51E6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC5305
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC530B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC5323
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC5329
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC532F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC5335
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC533B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC5341
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC534D

Strings

@, xrefs: 00007FF7D4BC49C0
{"status":"109"}, xrefs: 00007FF7D4BC52AC
\??\, xrefs: 00007FF7D4BC4D74
{"status":"021"}, xrefs: 00007FF7D4BC5179

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Heap$Process$AllocCreateDestroyEnvironmentFreeParameters
String ID: @$\??\${"status":"021"}${"status":"109"}
API String ID: 1847043289-3946298159
Opcode ID: e90fc13a62e3c3175694a3568c6b7c2ee5b709cc2317347e5b19cb96a7f64993
Instruction ID: 7ec0b3f37e41276fabe563d4dd2fbe6d6e623dcdf150b5c3e495918cbdee1d11
Opcode Fuzzy Hash: e90fc13a62e3c3175694a3568c6b7c2ee5b709cc2317347e5b19cb96a7f64993
Instruction Fuzzy Hash: 94529172A15B4185EB10AF36D8C43ADA361EB907D8FC05237EA6D167EADF78E580C350

Function 00007FF7D4C2C7E8 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7D4C2C837
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2CE6A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2CFE0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2D29C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2D4BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2D6F7
memcpy_s.LIBCPMT ref: 00007FF7D4C2D7D2
memcpy_s.LIBCPMT ref: 00007FF7D4C2D87D
memcpy_s.LIBCPMT ref: 00007FF7D4C2D94D

Part of subcall function 00007FF7D4C18E5C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C18E8E

Strings

1#SNAN, xrefs: 00007FF7D4C2C94A
1#QNAN, xrefs: 00007FF7D4C2C953
1#IND, xrefs: 00007FF7D4C2C927
1#INF, xrefs: 00007FF7D4C2C963

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 6cfc1e31ae17e9f123e4776491613748614b580d476c610465501349d2b8f876
Instruction ID: aceb074b10ab9b7d7873718e55bdf7776609c075019fce74770d2f2af67b4031
Opcode Fuzzy Hash: 6cfc1e31ae17e9f123e4776491613748614b580d476c610465501349d2b8f876
Instruction Fuzzy Hash: 71B2B272A192828BE7649F66D4C07FDB6A1FB543C8FD05137DA0D57A84EFB8A900CB50

Function 00007FF7D4BFC59C Relevance: 23.8, APIs: 8, Strings: 5, Instructions: 1063COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BFC935
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BFC941
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BFCCFE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BFCD0A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BFD0B5

Strings

+, xrefs: 00007FF7D4BFD4BE
0123456789-, xrefs: 00007FF7D4BFC643
%, xrefs: 00007FF7D4BFD4AB
0123456789-, xrefs: 00007FF7D4BFCDB7
%.0Lf, xrefs: 00007FF7D4BFC63C, 00007FF7D4BFC9D4, 00007FF7D4BFD148

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn
String ID: %$%.0Lf$+$0123456789-$0123456789-
API String ID: 4131450254-1072446943
Opcode ID: 7c9b9654659de3135487b461ef231c4f1cf79fe2bc6a67a80590afa68c787f25
Instruction ID: 3545ebf7eb7c0ac0adf65b43c5b0b91ce0c0f96186e4adcf39b820a79a049b6b
Opcode Fuzzy Hash: 7c9b9654659de3135487b461ef231c4f1cf79fe2bc6a67a80590afa68c787f25
Instruction Fuzzy Hash: 7CA2B062B09B8595EB10EFA6D4943BDA3B1EB54BA8FC04233DE5D13B99DE38D485C310

Function 00007FF7D4BB9200 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB9C59
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB9C65
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB9C6B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB9C71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB9C77

Strings

file=, xrefs: 00007FF7D4BB92A9
filename=, xrefs: 00007FF7D4BB8E15, 00007FF7D4BB9208
GET, xrefs: 00007FF7D4BB943B
Content-Type: application/json, xrefs: 00007FF7D4BB6DB8, 00007FF7D4BB95CD

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Content-Type: application/json$GET$file=$filename=
API String ID: 3668304517-3007091521
Opcode ID: 564e62709b548e43167a9803115ffd5d0a743548e56cd6dd15194f39d17b631c
Instruction ID: b43589967c3c2e36e11b73882711237a6437a75cf5236e56e5117de070b84a30
Opcode Fuzzy Hash: 564e62709b548e43167a9803115ffd5d0a743548e56cd6dd15194f39d17b631c
Instruction Fuzzy Hash: 44C1D372F15B8185EB10EF76E8802ADA7A1FB54798FD05633EA5C52AD9DF38E480C314

Function 00007FF7D4BC5780 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 441COMMON

Download Yara Rule

Strings

{"status":"103"}, xrefs: 00007FF7D4BC59C7
{"status":"022"}, xrefs: 00007FF7D4BC5811, 00007FF7D4BC5BCE
stoi argument out of range, xrefs: 00007FF7D4BC5F4E
{"status":"023"}, xrefs: 00007FF7D4BC5ADC
invalid stoi argument, xrefs: 00007FF7D4BC5F41
{"status":"102"}, xrefs: 00007FF7D4BC5D5F, 00007FF7D4BC5E71

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: invalid stoi argument$stoi argument out of range${"status":"022"}${"status":"023"}${"status":"102"}${"status":"103"}
API String ID: 0-4000889359
Opcode ID: b756f211aa819a3d698a959213f879c040ced7da72824270e3a52963b15fbec4
Instruction ID: 2f99bad25210a12eef723be14e26c4918fbb157c5807149675e2fbb96104932f
Opcode Fuzzy Hash: b756f211aa819a3d698a959213f879c040ced7da72824270e3a52963b15fbec4
Instruction Fuzzy Hash: AAF1D662F1974641EA20EF76D4C03BDA361EB957E4FD05233EE6D16ADADE7CE0818210

Function 00007FF7D4BB5960 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5EB4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5EC0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5EC6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5ECC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5ED2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5ED8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5EDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5EE4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BB5EEA

Strings

{"d":, xrefs: 00007FF7D4BB599D
", "n":", xrefs: 00007FF7D4BB5A4C
, "id":", xrefs: 00007FF7D4BB59DC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ", "n":"$, "id":"${"d":
API String ID: 3668304517-217307741
Opcode ID: f19ae3fc870347bc2389a68f26f546bcf0523541b74f8ed576f16b6d4eae24fc
Instruction ID: daeff60b7849200bf4c6a19f6f6231d10c679753f815c82d9a4dc2e16ca92fc2
Opcode Fuzzy Hash: f19ae3fc870347bc2389a68f26f546bcf0523541b74f8ed576f16b6d4eae24fc
Instruction Fuzzy Hash: 5DF1C462E18B8585EB01EF35D4853BDA721EBA57D8F905323EA6C12AD6DF78E4C0C350

Function 00007FF7D4BF947C Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 576COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4BEE8C8: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE8DD
Part of subcall function 00007FF7D4BEE8C8: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE902
Part of subcall function 00007FF7D4BEE8C8: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE92C
Part of subcall function 00007FF7D4BEE8C8: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE9C4

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BF978D

Strings

%H : %M : %S, xrefs: 00007FF7D4BF9A1E
:AM:am:PM:pm, xrefs: 00007FF7D4BF9CA8
%H : %M, xrefs: 00007FF7D4BF997F
%m / %d / %y, xrefs: 00007FF7D4BF991B
%I : %M : %S %p, xrefs: 00007FF7D4BF9C98
%d / %m / %y, xrefs: 00007FF7D4BF9C6D
%b %d %H : %M : %S %Y, xrefs: 00007FF7D4BF9B65

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$_invalid_parameter_noinfo_noreturn
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 533778753-2891247106
Opcode ID: 026989573ea27209ae04e441fa7fbb74c9798316c8c905b9363d05a5be5fd6f8
Instruction ID: d080a64ac31f59c3c8211f0139d64b2259b60f81169abb22cca400295f3e700b
Opcode Fuzzy Hash: 026989573ea27209ae04e441fa7fbb74c9798316c8c905b9363d05a5be5fd6f8
Instruction Fuzzy Hash: E642AE32A09B4689EB24AF6AD4901BDB7A1FB58B88FC44133DE4D13B69DF39E545C310

Function 00007FF7D4C030F0 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 659COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4BCDD60: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCDD8B
Part of subcall function 00007FF7D4BCDD60: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCDDB0
Part of subcall function 00007FF7D4BCDD60: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCDDDA
Part of subcall function 00007FF7D4BCDD60: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCDE6B

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4C03450
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4C037DC
_Wcsftime.LIBCMT ref: 00007FF7D4C038A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4C03A4F

Strings

!%x, xrefs: 00007FF7D4C0381E
0123456789-, xrefs: 00007FF7D4C03197
%.0Lf, xrefs: 00007FF7D4C034E6

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$_invalid_parameter_noinfo_noreturn$Lockit::_Lockit::~_$Wcsftime
String ID: !%x$%.0Lf$0123456789-
API String ID: 3423291586-778084515
Opcode ID: 34b021d4a9e562a6ed182eda517adbe2fc1294020da36c2c9d257be05d3169c2
Instruction ID: a1a0ec2db1887e6973f5e3d571e2495ad325b663e1deeb0207ec312e4b49937c
Opcode Fuzzy Hash: 34b021d4a9e562a6ed182eda517adbe2fc1294020da36c2c9d257be05d3169c2
Instruction Fuzzy Hash: 3252C362F09A8589FB11EFA6D4943BCA761AB44BD8FC44233DE5D27BA9DE38D045C310

Function 00007FF7D4C23D40 Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C24172

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f5388ea15350438e8a1582e3d0df842e881fc469dd08d470af3a11267d8be547
Instruction ID: 0f6a637a79bbfb552bef224a6b81d2c0550c7f447384d423843a4f898a844ffc
Opcode Fuzzy Hash: f5388ea15350438e8a1582e3d0df842e881fc469dd08d470af3a11267d8be547
Instruction Fuzzy Hash: CEC1C126A0C68696E761AF22D4D43BDB660FB45BC4FC54133DA4E077A2CFBCE4548724

Function 00007FF7D4C2A714 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C1E1F0: GetLastError.KERNEL32 ref: 00007FF7D4C1E1FF
Part of subcall function 00007FF7D4C1E1F0: FlsGetValue.KERNEL32 ref: 00007FF7D4C1E214
Part of subcall function 00007FF7D4C1E1F0: SetLastError.KERNEL32 ref: 00007FF7D4C1E29F

TranslateName.LIBCMT ref: 00007FF7D4C2A781
TranslateName.LIBCMT ref: 00007FF7D4C2A7BC
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7D4C1C340), ref: 00007FF7D4C2A801
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7D4C1C340), ref: 00007FF7D4C2A829

Strings

utf8, xrefs: 00007FF7D4C2A90D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 62dd0897f3a40bff9230205bb84dd3753ae87d61fcead77b1b4fb739315c740d
Instruction ID: eccbfcb22353cb7b01cc7a6db51c4b4c59bd681c39c8cafd788a9f36f9f4b455
Opcode Fuzzy Hash: 62dd0897f3a40bff9230205bb84dd3753ae87d61fcead77b1b4fb739315c740d
Instruction Fuzzy Hash: C5915A32A0874296E724BF23D5C12ADB2A4EB44BC0FD44133DA4D57686EFBEE9558720

Function 00007FF7D4C2B148 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C1E1F0: GetLastError.KERNEL32 ref: 00007FF7D4C1E1FF
Part of subcall function 00007FF7D4C1E1F0: FlsGetValue.KERNEL32 ref: 00007FF7D4C1E214
Part of subcall function 00007FF7D4C1E1F0: SetLastError.KERNEL32 ref: 00007FF7D4C1E29F

Part of subcall function 00007FF7D4C1E1F0: FlsSetValue.KERNEL32 ref: 00007FF7D4C1E235

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7D4C2B2B8

Part of subcall function 00007FF7D4C1E1F0: FlsSetValue.KERNEL32 ref: 00007FF7D4C1E262
Part of subcall function 00007FF7D4C1E1F0: FlsSetValue.KERNEL32 ref: 00007FF7D4C1E273
Part of subcall function 00007FF7D4C1E1F0: FlsSetValue.KERNEL32 ref: 00007FF7D4C1E284

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7D4C1C339), ref: 00007FF7D4C2B29F
ProcessCodePage.LIBCMT ref: 00007FF7D4C2B2E2
IsValidCodePage.KERNEL32 ref: 00007FF7D4C2B2F4
IsValidLocale.KERNEL32 ref: 00007FF7D4C2B30A
GetLocaleInfoW.KERNEL32 ref: 00007FF7D4C2B366
GetLocaleInfoW.KERNEL32 ref: 00007FF7D4C2B382

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: f752fc2ad53d96a5a2cf0e4783939982821df30ecafcf97518e638cf9fd582f7
Instruction ID: 9cb8446e7d49768d81c441eee95eabb71c017a472591e8c2f172b32be8e00b8d
Opcode Fuzzy Hash: f752fc2ad53d96a5a2cf0e4783939982821df30ecafcf97518e638cf9fd582f7
Instruction Fuzzy Hash: 34716922B187528AFB10AF62D8D06BDB3A0BF44B84FD44137CA1D57695EFBCA845C360

Function 00007FF7D4C05968 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7D4C05984
RtlCaptureContext.KERNEL32 ref: 00007FF7D4C059B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7D4C059CB
RtlVirtualUnwind.KERNEL32 ref: 00007FF7D4C05A0C
IsDebuggerPresent.KERNEL32 ref: 00007FF7D4C05A60
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7D4C05A7D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7D4C05A88

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ca9133218e8fd64e453ca13e2065ac02271bf55d4d281d1e59191dc596debb9c
Instruction ID: 91b3db8c442d2b92eeaba79dcd8faf782594be320d3360f57177f10bbf847205
Opcode Fuzzy Hash: ca9133218e8fd64e453ca13e2065ac02271bf55d4d281d1e59191dc596debb9c
Instruction Fuzzy Hash: A6311C72709A818AEB60EF61E8843FDB364FB84794F84403BDA4E57B94DF38D5488720

Function 00007FF7D4BF2230 Relevance: 10.1, APIs: 2, Strings: 3, Instructions: 1359COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BF3561
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BF3567

Strings

0123456789-, xrefs: 00007FF7D4BF23E2, 00007FF7D4BF25D7, 00007FF7D4BF28A7, 00007FF7D4BF2AB7
$+xv, xrefs: 00007FF7D4BF23DB
, xrefs: 00007FF7D4BF3391

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $$+xv$0123456789-
API String ID: 3668304517-2753741353
Opcode ID: 64dbe46abcd0a748f2301b1c3c723a728d35ddea38314b42eb9914c6443c78c9
Instruction ID: d351735b7c2d28c21de7bd43577f647d4be072f166ab0d712d31e82c78037073
Opcode Fuzzy Hash: 64dbe46abcd0a748f2301b1c3c723a728d35ddea38314b42eb9914c6443c78c9
Instruction Fuzzy Hash: 0ED28062A0AA4699EB54AF66D4D017CB7A0FB64B84FD45033DE4E177A4CF3ED891C320

Function 00007FF7D4BF0EF0 Relevance: 8.4, APIs: 2, Strings: 2, Instructions: 1359COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BF2221
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BF2227

Strings

0123456789-, xrefs: 00007FF7D4BF10A2, 00007FF7D4BF1297, 00007FF7D4BF1567, 00007FF7D4BF1777
, xrefs: 00007FF7D4BF2051

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $0123456789-
API String ID: 3668304517-700845222
Opcode ID: 93c310f1076dfa6572f971a1e162c11640b0d77122258c6e44ead9dc76e54eb7
Instruction ID: 16d32edb9ef7ca0988a547510c03c0f810f5a19714657f5c66e319607125228c
Opcode Fuzzy Hash: 93c310f1076dfa6572f971a1e162c11640b0d77122258c6e44ead9dc76e54eb7
Instruction Fuzzy Hash: 65D28162A0AA4699EB14AF56D4D017CB7B0FB64B84FD46433DE4E177A4CF3AD891C320

Function 00007FF7D4BCB040 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 512COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCB321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCB60D

Strings

%, xrefs: 00007FF7D4BCB644
+, xrefs: 00007FF7D4BCB661

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %$+
API String ID: 3668304517-2626897407
Opcode ID: aaeac8550ca6e12506b71e98f6b98c11c6615126fb48153819423fe2f66e44ce
Instruction ID: 16cecf3bae506fe86f2966f52129733c7b3e473be23c1166a5e4a3ab4c7cf6e1
Opcode Fuzzy Hash: aaeac8550ca6e12506b71e98f6b98c11c6615126fb48153819423fe2f66e44ce
Instruction Fuzzy Hash: 7712E022B1D6858AFB259F76E4C03FDA761AB64788F844132DE4D17A89DE3CD451CB20

Function 00007FF7D4C189D0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7D4C18A3A
memcpy_s.LIBCPMT ref: 00007FF7D4C18A65

Strings

, xrefs: 00007FF7D4C18B98

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: d5921c5f5581713e7daa7186113356940e2354a9cdd6fd7f83da389ac929e130
Instruction ID: d0f2a294013350ac138807fefa2d0c6590575a97074a3a1d45d5592754d99990
Opcode Fuzzy Hash: d5921c5f5581713e7daa7186113356940e2354a9cdd6fd7f83da389ac929e130
Instruction Fuzzy Hash: 20C1A376A1D68687D774DF16E084A6EB7A1FB94784F848136DB8E43784DB3CE805CB20

Function 00007FF7D4BBAA43 Relevance: 7.3, Strings: 5, Instructions: 1014COMMON

Download Yara Rule

Strings

", "id":", xrefs: 00007FF7D4BBBAAB
101, xrefs: 00007FF7D4BBBF0F
", "uId":", xrefs: 00007FF7D4BBBB3C
{"n":", xrefs: 00007FF7D4BBB9FF
", "d":", xrefs: 00007FF7D4BBBBDD

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: ", "d":"$", "id":"$", "uId":"$101${"n":"
API String ID: 0-3774563054
Opcode ID: 57c6288ed6cea57e80edcc7ecc00a2014172ac291a626356b348743fccb4a816
Instruction ID: a111298547371044c330c32f98ef4d3e30c4f92482eb2b6df5aef0a3a7c7ed20
Opcode Fuzzy Hash: 57c6288ed6cea57e80edcc7ecc00a2014172ac291a626356b348743fccb4a816
Instruction Fuzzy Hash: C3A20362E08B8585EB10DF76D4803ED6761EB957A8FD04323EA6C17AEADF78D080D314

Function 00007FF7D4BBAAFB Relevance: 7.2, Strings: 5, Instructions: 990COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC122
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC128
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC12E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC134
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC13A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC140
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC146
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC14C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC152
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC158
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC15E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC164
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC16A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC170
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC176
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC17C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC182
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC18E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC19A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1BE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1CA

Strings

", "id":", xrefs: 00007FF7D4BBBAAB
101, xrefs: 00007FF7D4BBBF0F
", "uId":", xrefs: 00007FF7D4BBBB3C
{"n":", xrefs: 00007FF7D4BBB9FF
", "d":", xrefs: 00007FF7D4BBBBDD

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ", "d":"$", "id":"$", "uId":"$101${"n":"
API String ID: 3668304517-3774563054
Opcode ID: 91c75f65d24afd891e359e78c223b4a5d7f9ed4280980d0461f2aa1c3b5be185
Instruction ID: 70556f2dcfe4f1d91e22860ecf661f1e37954f316bc0556d1419a1735e596485
Opcode Fuzzy Hash: 91c75f65d24afd891e359e78c223b4a5d7f9ed4280980d0461f2aa1c3b5be185
Instruction Fuzzy Hash: D0A20362E09B8585EB10DF76D4803AD6761EB957A8FD04323EA6C17AEADF78D080D314

Function 00007FF7D4BBAACF Relevance: 7.2, Strings: 5, Instructions: 990COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC122
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC128
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC12E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC134
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC13A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC140
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC146
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC14C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC152
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC158
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC15E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC164
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC16A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC170
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC176
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC17C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC182
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC18E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC19A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1BE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BBC1CA

Strings

", "id":", xrefs: 00007FF7D4BBBAAB
101, xrefs: 00007FF7D4BBBF0F
", "uId":", xrefs: 00007FF7D4BBBB3C
{"n":", xrefs: 00007FF7D4BBB9FF
", "d":", xrefs: 00007FF7D4BBBBDD

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ", "d":"$", "id":"$", "uId":"$101${"n":"
API String ID: 3668304517-3774563054
Opcode ID: 0121a56c495bb3f6a1cc841da0f3e66fd35cafa0e229533a941ae2acd42fdd69
Instruction ID: 4b229ff6a6f090b315c2a979b2a2bbdeea09f46429618f7c7a1db03e4090dde8
Opcode Fuzzy Hash: 0121a56c495bb3f6a1cc841da0f3e66fd35cafa0e229533a941ae2acd42fdd69
Instruction Fuzzy Hash: F8A20362E09B8585EB10DF76D4803AD6761EB957A8FD04323EA6C17AEADF78D0C0D314

Function 00007FF7D4C04AA4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7D4C04B05
IsDebuggerPresent.KERNEL32 ref: 00007FF7D4C04B1D
OutputDebugStringW.KERNEL32 ref: 00007FF7D4C04B2E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7D4C04B27

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 709f36ce9c18c584a5dd09b511388c37de8f709decbce0009373de8c9d67e20c
Instruction ID: 76d39e7a978a97c6a6bae043073c25976c1b6e4284c122a9ab3e73a344c847aa
Opcode Fuzzy Hash: 709f36ce9c18c584a5dd09b511388c37de8f709decbce0009373de8c9d67e20c
Instruction Fuzzy Hash: F7112832A18B4296E754AF23EA9837DA2A5FB44785FC44137C64D82A50EF3DE4788720

Function 00007FF7D4C20224 Relevance: 6.2, APIs: 4, Instructions: 224COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C20246
_get_daylight.LIBCMT ref: 00007FF7D4C202C8
_isindst.LIBCMT ref: 00007FF7D4C20319
_isindst.LIBCMT ref: 00007FF7D4C2036C

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _isindst$_get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 2079693926-0
Opcode ID: 024d7a2fbe3fa35e71b706349b584e453a738bf18d77ff34baa4f6ded577213b
Instruction ID: 807de86031396d601a1b2c798a9ba796c75191464d2bd846008fc5fee91b22a5
Opcode Fuzzy Hash: 024d7a2fbe3fa35e71b706349b584e453a738bf18d77ff34baa4f6ded577213b
Instruction Fuzzy Hash: ED8193B2B042464BEB589F26C9813BCB2A5EB547C8F849137DB0E8A785EF7CE5418750

Function 00007FF7D4BF6804 Relevance: 5.1, APIs: 3, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e0ad59e8c9e26bcd656274253aea465c3f9b5a8b3e1938740b34708a10c824
Instruction ID: 2a53f04a6a8284a8b5aff31b0080768d38535b37edaeca097e539604888324c7
Opcode Fuzzy Hash: 45e0ad59e8c9e26bcd656274253aea465c3f9b5a8b3e1938740b34708a10c824
Instruction Fuzzy Hash: 6752D462A19A858AEB10DF2AD4845BDB3A1FB64B88FC44133EE8D43B95DF3DD585C310

Function 00007FF7D4BF5EC4 Relevance: 5.1, APIs: 3, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef44f5b996b0a4c97cd421fa2f7b2eec2c956ec4453700ee090a862ad28ef570
Instruction ID: 2db583a02e6b36fc50e5924351bf5475c0dcf78433e2a9c031bfd855a206fe05
Opcode Fuzzy Hash: ef44f5b996b0a4c97cd421fa2f7b2eec2c956ec4453700ee090a862ad28ef570
Instruction Fuzzy Hash: 2E52D462A19A859AEB10EF2AD4845BDB3A1FB54B88FC44133EE4D13795DF3DD582C310

Function 00007FF7D4BE87FC Relevance: 4.3, Strings: 2, Instructions: 1754COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00007FF7D4BE8861, 00007FF7D4BE8EA7, 00007FF7D4BE9111, 00007FF7D4BE96E1
gfffffff, xrefs: 00007FF7D4BE9E88

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+XxPp$gfffffff
API String ID: 593203224-1108341528
Opcode ID: 4d51fc69ed0aefbb7a54308f17d5018c06b0431565279e3e57718adadde6371e
Instruction ID: 9c0f8db43de4e91ca14363e32bb38475123ef5634a0600ca1d5753229f5fd8c6
Opcode Fuzzy Hash: 4d51fc69ed0aefbb7a54308f17d5018c06b0431565279e3e57718adadde6371e
Instruction Fuzzy Hash: 6EF2B326A0AA4685EB60AF1BD19017DB3A0FFA1B84BD49033DF5E07791CF2DD865D324

Function 00007FF7D4BE9F30 Relevance: 4.3, Strings: 2, Instructions: 1754COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7D4BEB5BC
0123456789ABCDEFabcdef-+XxPp, xrefs: 00007FF7D4BE9F95, 00007FF7D4BEA5DB, 00007FF7D4BEA845, 00007FF7D4BEAE15

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+XxPp$gfffffff
API String ID: 593203224-1108341528
Opcode ID: 4bff4011c69dc2bffa4ca5d965b1aff102f176220c1171cf0afa2514a101b1f7
Instruction ID: 766a331a38e19c5044bb72ff80446ca26aff8169671380d0227b7b3d1e65ff9d
Opcode Fuzzy Hash: 4bff4011c69dc2bffa4ca5d965b1aff102f176220c1171cf0afa2514a101b1f7
Instruction Fuzzy Hash: 07F2D266A0A6468AEB60DF1BD19013CB764FFA5B84BD49033DB4E07791CF2DE861C724

Function 00007FF7D4BE0D54 Relevance: 4.1, Strings: 2, Instructions: 1640COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00007FF7D4BE0DB3, 00007FF7D4BE1365, 00007FF7D4BE1590, 00007FF7D4BE1ACE
gfffffff, xrefs: 00007FF7D4BE21D0

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+XxPp$gfffffff
API String ID: 593203224-1108341528
Opcode ID: c421abd8b1227590fafa7866595071cb9ef304930f6dcaa7988eefdff358e5b6
Instruction ID: 96249bb505b2f0edf93401b826440278b95c83f0e841e931a1aeea4c35a45b60
Opcode Fuzzy Hash: c421abd8b1227590fafa7866595071cb9ef304930f6dcaa7988eefdff358e5b6
Instruction Fuzzy Hash: 0AF2B522B0A68589EB519F2BC1D037CB761EBA1B88FE49133CA5D47791CF2DD462C324

Function 00007FF7D4C0C178 Relevance: 4.0, APIs: 2, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0C5C3
_get_daylight.LIBCMT ref: 00007FF7D4C0C663

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 9519d5d6927c0dceee90412c84b97ab75983e3401561576c12abd0c3b33256e1
Instruction ID: 30f0c69fbfe245f5af9a663a7de91a9aac550050edcb521a514ad92aae1ba57e
Opcode Fuzzy Hash: 9519d5d6927c0dceee90412c84b97ab75983e3401561576c12abd0c3b33256e1
Instruction Fuzzy Hash: 6C929C32A0868286E728AF26D4D817DA7A5FB457C4FC44137EB8D27AD5DF3DE5018B20

Function 00007FF7D4C1EDBC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF7D4C1C512), ref: 00007FF7D4C1EE30

Strings

GetLocaleInfoEx, xrefs: 00007FF7D4C1EDD8, 00007FF7D4C1EDE9

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 45432cefa987a8ddb26bcb9aa938afebbc246bbe92d0c79083534491fcf22730
Instruction ID: 0c3197a88a5af92a8a0ffbe0e48ae89bec3ceb4fe14f4c73d5b816c809f75d0b
Opcode Fuzzy Hash: 45432cefa987a8ddb26bcb9aa938afebbc246bbe92d0c79083534491fcf22730
Instruction Fuzzy Hash: 9A012125B0868185E754BF57E4840BEE660AF84BD0FD84037DE4D43B6ACE2CD5418760

Function 00007FF7D4BFD68C Relevance: 3.4, APIs: 2, Instructions: 430COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BFD928
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BFDBCC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0e8365d8b205fea13b78dd6ceb5cc1ac767074d11a9a9471fc7cb433d0944f90
Instruction ID: 60884a6c85ee914c7eeecd67c032666ffd10f791d18bfca4a8ede3452feea04b
Opcode Fuzzy Hash: 0e8365d8b205fea13b78dd6ceb5cc1ac767074d11a9a9471fc7cb433d0944f90
Instruction Fuzzy Hash: B6F1F752F19A848AFB14AF66D4903FDA3A1AF547D8FC48332EE5D27A99DE2CD141C310

Function 00007FF7D4BFE448 Relevance: 3.4, APIs: 2, Instructions: 430COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BFE6E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BFE988

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7f3d26e1593e39e1a10a5e8ff1769929c7ce844638a16bdf71775aefefaf4499
Instruction ID: 6acb0020352b70d67f69c08153b7dae8a5bcf968ce472105e880d0237b1f5ccc
Opcode Fuzzy Hash: 7f3d26e1593e39e1a10a5e8ff1769929c7ce844638a16bdf71775aefefaf4499
Instruction Fuzzy Hash: EFF1E852B19A848AFB14AF66D4903FDA3A1AF547D4FC44332EE5C27A99EE2CD145C310

Function 00007FF7D4C22DB8 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7D4C23007
RaiseException.KERNEL32 ref: 00007FF7D4C23018

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 39e1f376b379eddbde7b102e04ecedd1f0283ba68647ca32517d18baf4289d42
Instruction ID: f1dfbff668cfcda82c15988ce03252d88e8383a339badd827a2f5ba5e00d4173
Opcode Fuzzy Hash: 39e1f376b379eddbde7b102e04ecedd1f0283ba68647ca32517d18baf4289d42
Instruction Fuzzy Hash: 4BB14973A00B858BEB15DF2AC8C636CB7A0F744B88F958923DA5D877A4CB79D851C710

Function 00007FF7D4C1FE9C Relevance: 3.1, APIs: 2, Instructions: 105timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C2012C), ref: 00007FF7D4C1FF13
_get_daylight.LIBCMT ref: 00007FF7D4C1FECA

Part of subcall function 00007FF7D4C1DB30: HeapFree.KERNEL32 ref: 00007FF7D4C1DB46
Part of subcall function 00007FF7D4C1DB30: GetLastError.KERNEL32 ref: 00007FF7D4C1DB50

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone_get_daylight
String ID:
API String ID: 3817840142-0
Opcode ID: dcf3cfaab941910156589bad44e65512d7baf0601cf28d33dea5fbd4a63b99ea
Instruction ID: 4b36b406660740310691dd3f6ca4f6af9e3146184d6bcd5749389f1a9a71433f
Opcode Fuzzy Hash: dcf3cfaab941910156589bad44e65512d7baf0601cf28d33dea5fbd4a63b99ea
Instruction Fuzzy Hash: 94411C32A1864286E714FF23E8D15BDB6A0BB487C4FC44537EA4D876A5EF3CE4418B64

Function 00007FF7D4C209D8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7D4C20B62
e+000, xrefs: 00007FF7D4C20AE5

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 9952dff17a6e0b28f1c47ad7625a1f8cb13026598cfda70a363bfcb1f793575a
Instruction ID: c0963d5c26aa3cd19d41f091098f9191aa615f752e17d45598301b3a63062650
Opcode Fuzzy Hash: 9952dff17a6e0b28f1c47ad7625a1f8cb13026598cfda70a363bfcb1f793575a
Instruction Fuzzy Hash: 34512162B186C586E7249E27D8C176DBBA1E744BD4FC88233CBAC4BAD5CEBDD4418710

Function 00007FF7D4BEC0D8 Relevance: 2.1, Strings: 1, Instructions: 813COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FF7D4BEC184, 00007FF7D4BEC7E5

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 593203224-2799312399
Opcode ID: ea9d776c45aea9a44ce6d9e28d219698def782b8cb8146fa504f5756bcf6936f
Instruction ID: e176eb2ac8bb8c4d67714b15f94059473e947b167ae670be105f80611dd87525
Opcode Fuzzy Hash: ea9d776c45aea9a44ce6d9e28d219698def782b8cb8146fa504f5756bcf6936f
Instruction Fuzzy Hash: 62727726A0A68689EB519F2AC09017CB7B1EFA0F88BD49033DE4E17795CF3DD851D724

Function 00007FF7D4BEB664 Relevance: 2.1, Strings: 1, Instructions: 807COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FF7D4BEB710, 00007FF7D4BEBD71

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 593203224-2799312399
Opcode ID: 973f37aa93a0d019f595dddc61c82ec5c018c339e496f414752873abb2b5094c
Instruction ID: d324b48f11bafe106bf4700605a0afb9ea765f0a78dc562cc94dce35b93d38f1
Opcode Fuzzy Hash: 973f37aa93a0d019f595dddc61c82ec5c018c339e496f414752873abb2b5094c
Instruction Fuzzy Hash: 5A724226A0E64689EB51DF26C09027CB7A1EFA0F88BD49033DE4D1B7A5CE3DD841D764

Function 00007FF7D4BE2270 Relevance: 2.0, Strings: 1, Instructions: 776COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FF7D4BE2315, 00007FF7D4BE2913

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 593203224-2799312399
Opcode ID: 8b0cf6414e84dd9bcc1a7c0fa230220f4878bfbeb7e5d67c0ba136a9a7323d7c
Instruction ID: 8bc1cd22603f9993abf43ef4ce47d97ef9d57a9aa0e51d21083f9e22571912b2
Opcode Fuzzy Hash: 8b0cf6414e84dd9bcc1a7c0fa230220f4878bfbeb7e5d67c0ba136a9a7323d7c
Instruction Fuzzy Hash: 43729722A0A68589EB559F2AC49037CB7B1EBA1F98FD45133CA4D173A5CF3DD842D324

Function 00007FF7D4C19B00 Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7D4C19C48

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 3c6382313bb41b2851cfb189bd452b790050670863c99794003037fc7f0be717
Instruction ID: d65cca732eaca25b11f63c2dad36bd3a2fbe477176026ddd87fc67855856918a
Opcode Fuzzy Hash: 3c6382313bb41b2851cfb189bd452b790050670863c99794003037fc7f0be717
Instruction Fuzzy Hash: 6712B122A08BC186E751DF29D5946FDB7A4FB58788F858237EF8D42652EF39E181C310

Function 00007FF7D4BF869C Relevance: 1.8, APIs: 1, Instructions: 322COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4BEE7B0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE7C5
Part of subcall function 00007FF7D4BEE7B0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE7EA
Part of subcall function 00007FF7D4BEE7B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE814
Part of subcall function 00007FF7D4BEE7B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE8AC

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BF89AD

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 533778753-0
Opcode ID: af87c9e842256e83c81d9ee310d1c56a49c79a1967f1ac551558253c834198e5
Instruction ID: 68880268cf96055bf96e489e8535b2ede532f6c0faa11e97b06da4d7609019a3
Opcode Fuzzy Hash: af87c9e842256e83c81d9ee310d1c56a49c79a1967f1ac551558253c834198e5
Instruction Fuzzy Hash: EBD17B22B05B4699EB10EF66D4802ADA7B1FB64B98FC48133DE8D277A9DF39D445C310

Function 00007FF7D4BD5370 Relevance: 1.8, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BD56D6

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5cf1311638112db07b927694fef8e6396ca2c9b095fa6c551ed0c097e664b80b
Instruction ID: 6a8be89b5b5d809d15942ade8499ecc0c45a5290202068c5cf85344a6767e49d
Opcode Fuzzy Hash: 5cf1311638112db07b927694fef8e6396ca2c9b095fa6c551ed0c097e664b80b
Instruction Fuzzy Hash: 53B1132260E68186EF219F1AD09037DBBA1EB61B88FD841B7DA9E077D5CF6CD441C710

Function 00007FF7D4C2B7BC Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7D4C2B81F

Part of subcall function 00007FF7D4C1B960: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1B974

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 7a04537e4f0c6fc99f1a4c970968e9cdf89bd7abc21a88531081b7fd270944c8
Instruction ID: a8b633aba2effd41f6438bd086b355b9670c0619f7a9c8bd69ba930e9b8b66b4
Opcode Fuzzy Hash: 7a04537e4f0c6fc99f1a4c970968e9cdf89bd7abc21a88531081b7fd270944c8
Instruction Fuzzy Hash: 7161B222F0C6928AFB64AD2AD4C077DF1919F447E0FD54637DA5D866D2FEADE8008720

Function 00007FF7D4C270D8 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e16e5d671d89c29f79eaeb6640cc837820a088961377a8c5a45492aa46f04c
Instruction ID: 27aac662ef901639f01f5bb57ff3d40b73d116ffc56bc50cc4d468a8281a5d40
Opcode Fuzzy Hash: f1e16e5d671d89c29f79eaeb6640cc837820a088961377a8c5a45492aa46f04c
Instruction Fuzzy Hash: CC51E322B0878185EB20AF73E8C45AEBBA0BB407D4F944137EE5D27A99DE7CD001C710

Function 00007FF7D4C2AE14 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C1E1F0: GetLastError.KERNEL32 ref: 00007FF7D4C1E1FF
Part of subcall function 00007FF7D4C1E1F0: FlsGetValue.KERNEL32 ref: 00007FF7D4C1E214
Part of subcall function 00007FF7D4C1E1F0: SetLastError.KERNEL32 ref: 00007FF7D4C1E29F

Part of subcall function 00007FF7D4C1E1F0: FlsSetValue.KERNEL32 ref: 00007FF7D4C1E235

GetLocaleInfoW.KERNEL32 ref: 00007FF7D4C2AE7C

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: e6cff381f708a6e4bed4a41e6150083fc0489feac95b7f7c59ea85fe37f47e98
Instruction ID: 1fee801b429cec3305ec7eb5f4027686ddcb04553c2b22eeae835140cef049f0
Opcode Fuzzy Hash: e6cff381f708a6e4bed4a41e6150083fc0489feac95b7f7c59ea85fe37f47e98
Instruction Fuzzy Hash: B8318D32A0868297EB64EF26D5C13AEB2A0FB487C4FC48037DA5D87696DF7DE4518710

Function 00007FF7D4C2AA60 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C1E1F0: GetLastError.KERNEL32 ref: 00007FF7D4C1E1FF
Part of subcall function 00007FF7D4C1E1F0: FlsGetValue.KERNEL32 ref: 00007FF7D4C1E214
Part of subcall function 00007FF7D4C1E1F0: SetLastError.KERNEL32 ref: 00007FF7D4C1E29F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7D4C2B24B,?,00000000,00000092,?,?,00000000,?,00007FF7D4C1C339), ref: 00007FF7D4C2AAFE

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 9e44754d9577773977ea80c74dd13d3e76b8718e7eff8b86a5b4e7f7b291e66c
Instruction ID: f27597645d7744371a276c3e5ff3b510b7f696dc88f270b233a079d8c1ecd559
Opcode Fuzzy Hash: 9e44754d9577773977ea80c74dd13d3e76b8718e7eff8b86a5b4e7f7b291e66c
Instruction Fuzzy Hash: CA11C067A08645EAEB24AF16D1C06ADBBA1FB40BE0FC48137C62D432C0DA69D9D1CB50

Function 00007FF7D4C2B01C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C1E1F0: GetLastError.KERNEL32 ref: 00007FF7D4C1E1FF
Part of subcall function 00007FF7D4C1E1F0: FlsGetValue.KERNEL32 ref: 00007FF7D4C1E214
Part of subcall function 00007FF7D4C1E1F0: SetLastError.KERNEL32 ref: 00007FF7D4C1E29F

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7D4C2ADC5), ref: 00007FF7D4C2B053

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 9d0b2ffe273e1f4fed17e8bd1c313f9a0eaebc25c880ac3e083329c0c2e7b654
Instruction ID: 4d75a9d0a812d02d6fc23b3394c1dec56620344288a0121555772f69ab53dcec
Opcode Fuzzy Hash: 9d0b2ffe273e1f4fed17e8bd1c313f9a0eaebc25c880ac3e083329c0c2e7b654
Instruction Fuzzy Hash: E911E772A1859286E765EF23D0C067EB261EB44BA0FD44133EA7D076C5EE79D8818750

Function 00007FF7D4C1E878 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7D4C1ECCB,?,?,?,?,?,?,?,?,00000000,00007FF7D4C2A0AC), ref: 00007FF7D4C1E8C7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a93aaad4e12693b5b086b917930b389686b377b09538789090b40f77a9a41231
Instruction ID: fbbf8a9beb0baba233f11505980313253966d746f1469d80f10e105403fa7f79
Opcode Fuzzy Hash: a93aaad4e12693b5b086b917930b389686b377b09538789090b40f77a9a41231
Instruction Fuzzy Hash: A1F01976B08A4182E604EF1AE9915ADA371FB987C0FD88137DA5D93369CF3CD550C354

Function 00007FF7D4C20528 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7D4C20886

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 794b6b85d57e6143a27c57cba61a4ebcd47d9c8f9dbfa1945f9a65145824eb81
Instruction ID: 643c875b8ba1337dd02c061be7540067d8071c46bb5e84446f42db32b5e3e357
Opcode Fuzzy Hash: 794b6b85d57e6143a27c57cba61a4ebcd47d9c8f9dbfa1945f9a65145824eb81
Instruction Fuzzy Hash: 4FA11162A087C686EB21DF27E4807AEBBA1AB54BC4F858133CF4D47785EA7DE501C711

Function 00007FF7D4C26284 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7D4C26329

Part of subcall function 00007FF7D4C1D5F8: HeapAlloc.KERNEL32(?,?,00000000,00007FF7D4C1E3CA,?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1D64D

Part of subcall function 00007FF7D4C1DB30: HeapFree.KERNEL32 ref: 00007FF7D4C1DB46
Part of subcall function 00007FF7D4C1DB30: GetLastError.KERNEL32 ref: 00007FF7D4C1DB50

Part of subcall function 00007FF7D4C2E374: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2E3A7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: f9b88f2107271149bc3535cc48857f35e922378b7ddc4875876bfe8fb7144504
Instruction ID: c5032899bab21b01827031914a9fe24a3c4da15cf6164df3577c6893da94c6b7
Opcode Fuzzy Hash: f9b88f2107271149bc3535cc48857f35e922378b7ddc4875876bfe8fb7144504
Instruction Fuzzy Hash: 80416121B1968241EA60BE27E8D16BEF6907F857C4FC84537DE8D47B85EE7CE4019630

Function 00007FF7D4C288C8 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7D4C288CC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ac1f6705ad9a3939b16cf4e579eb91725149cf93cfec8d41fb06b871f5ffea49
Instruction ID: ffc673e93fafba11793ddf6b870e554acf35a393cb18c8bf01710819ef2c0bb6
Opcode Fuzzy Hash: ac1f6705ad9a3939b16cf4e579eb91725149cf93cfec8d41fb06b871f5ffea49
Instruction Fuzzy Hash: 74B09220F17A02C2EA093F22ACCB22C62A56F88740FD8043BC00D80330DE2C30F95B20

Function 00007FF7D4C0262C Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: e28e951fa2e8ffb585d96571ab97b3f57ac350516693fce54ef1d3af4be56964
Instruction ID: 715d014664d76145a191e9d33a4baf141d26db3e21be0a670b31a58b520d34db
Opcode Fuzzy Hash: e28e951fa2e8ffb585d96571ab97b3f57ac350516693fce54ef1d3af4be56964
Instruction Fuzzy Hash: 6E22A322F0868686EB21AF26D4883BDA761FB54B88FC54133DE8D27755DE3CE985C710

Function 00007FF7D4C0D9E4 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo$AllocHeap
String ID:
API String ID: 443252259-0
Opcode ID: 6964823ca8642a5af7a9c54e1d0b42cb12e8f60dbf1da35b588f3f8206867df7
Instruction ID: 300a84e5fb15d79cc5620251f404527a933848ca16990bfb8b361dba926473a3
Opcode Fuzzy Hash: 6964823ca8642a5af7a9c54e1d0b42cb12e8f60dbf1da35b588f3f8206867df7
Instruction Fuzzy Hash: 6102F871F04A9640EF60EE27C9881FDA3A5EB947E4FD45233DE6E573D4EE29D4428220

Function 00007FF7D4C101E4 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4822b5c2577af7dd3d9ceb3033f2715f059c44100626e067fb054da6d963c7ce
Instruction ID: 70e265ddd37a278bc17ab1b1a33513882a8a486dcb6067f6cfc949c60f63f30c
Opcode Fuzzy Hash: 4822b5c2577af7dd3d9ceb3033f2715f059c44100626e067fb054da6d963c7ce
Instruction Fuzzy Hash: B5D1A426A0864686EB64AF2BC08027DA7B1EB05BC8FD44237DE4D57AD5CF39E442C374

Function 00007FF7D4C1C188 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: ce827e23b5fb9fb048f2fdd3c7457ec4e9fb83c6efa7c177d8ecfdf58fe21a12
Instruction ID: 22e68e96e31dfc43b2b97ed9318c50c84af070c538a335d6f372f04cc6d59b82
Opcode Fuzzy Hash: ce827e23b5fb9fb048f2fdd3c7457ec4e9fb83c6efa7c177d8ecfdf58fe21a12
Instruction Fuzzy Hash: 5DC19665A0868185EB64AF63D4903BEA7B0FB947C8FC04037EE4E97699DE3CD545CB20

Function 00007FF7D4C165BC Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c7b20eb71a5b2964de6ca0bca0f38bfffaca83e06991a8733f1a37c5226840
Instruction ID: bccb17884d3f3dcf5cb5c447703f42d0b564a0058e072c8e45f3ea8ad8ed841a
Opcode Fuzzy Hash: e9c7b20eb71a5b2964de6ca0bca0f38bfffaca83e06991a8733f1a37c5226840
Instruction Fuzzy Hash: 3C910526B1824247FA256E2AD4903BD96A0AF417D8FDC153BDE6E477C0DD3CE9069730

Function 00007FF7D4C2A170 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorLastValue$CurrentFeatureInfoLocalePresentProcessProcessor
String ID:
API String ID: 2071376764-0
Opcode ID: e12076cdc0c0cdc7fe1b0f0b1b4ad132a50841606ac88c01f83246212a4c5ec9
Instruction ID: 57da29bf7a64eb02e32363c9896a64b2a5e85ca5effe1f044b936a9fec78efa8
Opcode Fuzzy Hash: e12076cdc0c0cdc7fe1b0f0b1b4ad132a50841606ac88c01f83246212a4c5ec9
Instruction Fuzzy Hash: 76B19122A1864697EB64AF22D4C16BEB3A1FB44BC8FC04133DA4D836C5DFBDE5518760

Function 00007FF7D4BE8018 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1482580fe5820d1ed51b21129fc6c885640b63bc2115ddbd9026485005cb11b0
Instruction ID: 0ee4171c8ffa50bd5060b3360c26ff0bab86cae010a063b8793ffa6da2cfac2e
Opcode Fuzzy Hash: 1482580fe5820d1ed51b21129fc6c885640b63bc2115ddbd9026485005cb11b0
Instruction Fuzzy Hash: C691A022B0AE9289FF10EF66C4901BCA7A1EF94BD8BD48032DE5D17795DF29D491C324

Function 00007FF7D4BE7D1C Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64db8b3930721d7cd7e68643915407db51066f5bba8df27865b8459d2248eb55
Instruction ID: 9fdd72521a37a1c1656f54e7b85ff84038904cae8de27f5ad58abd8bcb5ec749
Opcode Fuzzy Hash: 64db8b3930721d7cd7e68643915407db51066f5bba8df27865b8459d2248eb55
Instruction Fuzzy Hash: 2B91A226B0A69295FF10EF66C49017CB7A1EF95B98BD48036DE0E17B94DF39D881C324

Function 00007FF7D4BE7A44 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f45778ff971aba7ce3f734c2651c6e97fec5afbed90dd1b1c86f56fd86f035
Instruction ID: acca2a1b97233c15b54c6492a6fe01bb384c1766026a50182b85b21ca508c0e1
Opcode Fuzzy Hash: 87f45778ff971aba7ce3f734c2651c6e97fec5afbed90dd1b1c86f56fd86f035
Instruction Fuzzy Hash: 0591A022B0A69689FF11DF77D8902BC6BA1EF95B88FD84032CE4E17795DE28D441C324

Function 00007FF7D4C18F34 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4ad6b9f4432906f135b8dd3c72e53b1a22c067a589a710dc80522fe65d7b5cdb
Instruction ID: a6081b8061982789e90c22c2842ca165e73c77a85320f632ac6b060fb3dea128
Opcode Fuzzy Hash: 4ad6b9f4432906f135b8dd3c72e53b1a22c067a589a710dc80522fe65d7b5cdb
Instruction Fuzzy Hash: 96818922A04A5286EB64EE26C4C53BDA370FB44BD8F948637EE5E87795CF38D4418360

Function 00007FF7D4C21058 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85187abf30c5ce538421c33984565d9305ba6d6c58eded8eb0eb882ace783bf
Instruction ID: 29e9d5de6894f9633231c3f25cacc891cbadcd8bc93b3cdbcf706655c90dde78
Opcode Fuzzy Hash: c85187abf30c5ce538421c33984565d9305ba6d6c58eded8eb0eb882ace783bf
Instruction Fuzzy Hash: C781BF72A0868186EB64DE1AD4C037EB6A1FB867D4FD44237DA9D43B99CE7DD5008B10

Function 00007FF7D4C0F688 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a9baa5c6f6a1324998f8c6abba3616a79418b5feb9c6b3328fbf741c304964
Instruction ID: 6162be4404a1f6379fa91c08ecbc4849e82d0fd86e6facbc63ee97c08493c888
Opcode Fuzzy Hash: 89a9baa5c6f6a1324998f8c6abba3616a79418b5feb9c6b3328fbf741c304964
Instruction Fuzzy Hash: 5151C532A1865182E7299F2AC09937CA760EB55B98FD50137CF4D27798CF68ECC1C7A0

Function 00007FF7D4C0F2B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fc44ad14a614332960738f91919508aaa3738b51a3d202a8b17e26d1b4cd2a
Instruction ID: d037b42a833f5fb329893329e4e4cdd7adc5a6b3d661593b322571600501fabb
Opcode Fuzzy Hash: b2fc44ad14a614332960738f91919508aaa3738b51a3d202a8b17e26d1b4cd2a
Instruction Fuzzy Hash: 75519677A1865182E7689F26C09833CA760EB55BA8FD50137CF4D27795CF68EC81C790

Function 00007FF7D4C0F4A0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00f397ae338938fd8b8a1234f6058bf6b7253c494a8c7dedd4426e63cb650a7
Instruction ID: c60e3c82509bc35c79d1e295cdc34d91754c5fa9071b7ea73c024abe63be8002
Opcode Fuzzy Hash: e00f397ae338938fd8b8a1234f6058bf6b7253c494a8c7dedd4426e63cb650a7
Instruction Fuzzy Hash: BC51A773A0851182E7299F2AC0D823CA760EB55B98FD50137CF4E67799CF69EC81C760

Function 00007FF7D4C1B2C0 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9c31f07231d4a45a650701019bc74ff76c00fe044c85a6861c68b665763c22ca
Instruction ID: 838276e2ba7c4d5b42fab00e050e16f8729772ad1d34588a0a83af1ca7dbcb56
Opcode Fuzzy Hash: 9c31f07231d4a45a650701019bc74ff76c00fe044c85a6861c68b665763c22ca
Instruction Fuzzy Hash: F541E122714A5482EF44DF2BD9A416DB3A1BB48FD4BC99037EE0D97B58EE3CD0428310

Function 00007FF7D4BD61C0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6493d6e35529629c397c204590ddb3bde36fd56b60c7bb670539de328662dbf
Instruction ID: 3788c0bcdc4b6b2e27447ea30a48e4f8616da8dcb007d46572126c2ad1d4e27e
Opcode Fuzzy Hash: d6493d6e35529629c397c204590ddb3bde36fd56b60c7bb670539de328662dbf
Instruction Fuzzy Hash: 94416733B155548BDB8CCE2AC8656AD73A2F3DC304F89C239DA1AC7385DA359905CB40

Function 00007FF7D4C30280 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49246b04862395ee029d2994fd82be78ec5b7bbecae9447cd8274b0296db14a3
Instruction ID: 2bb12883db50e5b5c7137d3e0d28714bd0413eb78eaa769e9ea41f9bf219a004
Opcode Fuzzy Hash: 49246b04862395ee029d2994fd82be78ec5b7bbecae9447cd8274b0296db14a3
Instruction Fuzzy Hash: 4CF0FF72A286958ADBA49F2AE84263DB7A0E7483C4BD0843BD68DC3A14D63C94618F14

Function 00007FF7D4C15944 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15973
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15A49

Strings

0, xrefs: 00007FF7D4C15A8A
0, xrefs: 00007FF7D4C15B31
0, xrefs: 00007FF7D4C15B47
0, xrefs: 00007FF7D4C15A78

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0$0
API String ID: 3215553584-3558443385
Opcode ID: e93bfac5235ef71cd426514e060948761f247dc8953c00dea033de83a4a23df1
Instruction ID: eca6a4ffe87dd6387a496d42a5c26d89bad0e81ed1ea5332cc901e10edb87492
Opcode Fuzzy Hash: e93bfac5235ef71cd426514e060948761f247dc8953c00dea033de83a4a23df1
Instruction Fuzzy Hash: ACF1B432A096868AF751AE16C5D42BDBBF1AB15BC0FD84033C78C47795DE2D94558730

Function 00007FF7D4BC21D0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC25B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC25BE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC25C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC25CA

Strings

stoi argument out of range, xrefs: 00007FF7D4BC28F4
type=0, xrefs: 00007FF7D4BC285A
invalid stoi argument, xrefs: 00007FF7D4BC28E7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: invalid stoi argument$stoi argument out of range$type=0
API String ID: 3668304517-70522167
Opcode ID: a09c7e5c2d23c9f4d4aec673c2591103bbc3faef796065eeb9ac9be67246059b
Instruction ID: 1a1d61826426d72f71f7a39ebb6801c3fd809bb504df6342aecea38303c48115
Opcode Fuzzy Hash: a09c7e5c2d23c9f4d4aec673c2591103bbc3faef796065eeb9ac9be67246059b
Instruction Fuzzy Hash: 6171A122F19B4295F710EF72E8C03ADA3B1AB55788FC44537EE4C26A99DE38E555C320

Function 00007FF7D4BB44F0 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB453D
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB457D
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB45A1
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB45DB
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB4600
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB463A
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB465F
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4BB4699

Strings

/infoEndpoint?, xrefs: 00007FF7D4BB458B, 00007FF7D4BB45C5
/taskEndpoint?, xrefs: 00007FF7D4BB4648, 00007FF7D4BB4683
/fileEndpoint?, xrefs: 00007FF7D4BB45E9, 00007FF7D4BB4624

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: /fileEndpoint?$/infoEndpoint?$/taskEndpoint?
API String ID: 626452242-4035432986
Opcode ID: 6dfd119fe7f24439e64abed31e3f9a06fc0040ed8949a8e682c6a5c46fd5acd1
Instruction ID: 9fa1092fb158cf1d659a7ae1c1f40ad37e536f1d749fbc8861094e873a5c7bcb
Opcode Fuzzy Hash: 6dfd119fe7f24439e64abed31e3f9a06fc0040ed8949a8e682c6a5c46fd5acd1
Instruction Fuzzy Hash: 96417D76A09B8182E734EF53F944169B6A2F788BD4F88423BDA8C17B65CF3CD1419704

Function 00007FF7D4BCDEA0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCDF42
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCDF6D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCDF9A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCE03A

Part of subcall function 00007FF7D4BD5FF0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD6073
Part of subcall function 00007FF7D4BD5FF0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BD60BB

std::_Facet_Register.LIBCPMT ref: 00007FF7D4BCE01D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCE183

Strings

ios_base::badbit set, xrefs: 00007FF7D4BCE18E
ios_base::failbit set, xrefs: 00007FF7D4BCE19A
ios_base::eofbit set, xrefs: 00007FF7D4BCE1A1

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2294326227-1866435925
Opcode ID: 86fe1b2093ae2041e83959f1dff7804b2bc232e9e5e410c9bfc820932902e2a8
Instruction ID: 84f0ec9984e94d80167c3966bf2156eb0bceb2a876dc037bcdf2b1a596812afb
Opcode Fuzzy Hash: 86fe1b2093ae2041e83959f1dff7804b2bc232e9e5e410c9bfc820932902e2a8
Instruction Fuzzy Hash: 80913C3260AB8581EA24DF26E4813ADB7A1FB94B84FD48137DA8D43B65DF3CD456C710

Function 00007FF7D4BD3530 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD35A6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BD35F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD3737
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD3750
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD3763
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD3769

Strings

bad locale name, xrefs: 00007FF7D4BD3756
true, xrefs: 00007FF7D4BD3699
false, xrefs: 00007FF7D4BD3669

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 4121308752-1062449267
Opcode ID: a96fadd14a7eb2f3f58b98dbe9cb50c9b1a43cb1f5cb2863c14212cbc0dac3e7
Instruction ID: af0e87ed7f0c0baa5c09d7a5690cc54f7932d2a24f2385d49d347b2f3c1d86a8
Opcode Fuzzy Hash: a96fadd14a7eb2f3f58b98dbe9cb50c9b1a43cb1f5cb2863c14212cbc0dac3e7
Instruction Fuzzy Hash: 4F618F32A0AB418AEB14EFA2D4903BCB7B1EF54744FC81136DA4D27A96DF38E455C324

Function 00007FF7D4C2BE54 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C2BA34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2BA75
Part of subcall function 00007FF7D4C2BA34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2BAF5
Part of subcall function 00007FF7D4C2BA34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2BB49
Part of subcall function 00007FF7D4C2BA34: _get_daylight.LIBCMT ref: 00007FF7D4C2BBA1

CreateFileW.KERNEL32 ref: 00007FF7D4C2BF5A
CreateFileW.KERNEL32 ref: 00007FF7D4C2BFAA
GetLastError.KERNEL32 ref: 00007FF7D4C2BFDA
GetFileType.KERNEL32 ref: 00007FF7D4C2BFEF
GetLastError.KERNEL32 ref: 00007FF7D4C2BFF9
CloseHandle.KERNEL32 ref: 00007FF7D4C2C02C
CloseHandle.KERNEL32 ref: 00007FF7D4C2C190
CreateFileW.KERNEL32 ref: 00007FF7D4C2C1C5
GetLastError.KERNEL32 ref: 00007FF7D4C2C1D4

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 1ff1ce3bc5de2cde991e5a49a17d146b584b1235a50141dcf283e721ad9a4ef4
Instruction ID: 854f4ae967066e44cd4577b03e4f33863473a779ab9bfdda5eed55286d248604
Opcode Fuzzy Hash: 1ff1ce3bc5de2cde991e5a49a17d146b584b1235a50141dcf283e721ad9a4ef4
Instruction Fuzzy Hash: E0C1C036B28A4285EB10DFAAC4D06AC7761FB49BE8B840237DB1E57394DF78E051C720

Function 00007FF7D4C11FE8 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1202C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C12404
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C126AF

Strings

f, xrefs: 00007FF7D4C1214E
0, xrefs: 00007FF7D4C12454
p, xrefs: 00007FF7D4C120DE
p, xrefs: 00007FF7D4C12156

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 3c7a9cd9be296de5bd08ebe4132baff99b533e7609acdf59f14f58abcc8e45d7
Instruction ID: d6ced36f14dbe80af14f547bf4658f97166d2eab2a4c45f553ab62e2c6170c28
Opcode Fuzzy Hash: 3c7a9cd9be296de5bd08ebe4132baff99b533e7609acdf59f14f58abcc8e45d7
Instruction Fuzzy Hash: A7128D6AA0C14386FB24BE16D08477EF671EB81790FD44033E68E666C4DB3CE9809B71

Function 00007FF7D4C00464 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00479
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0049E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C004C8
std::_Facet_Register.LIBCPMT ref: 00007FF7D4C0053F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00560
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4C00573

Strings

file=, xrefs: 00007FF7D4C00467

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: eb3739b5e1fdbb06f111bd2a254998f898f1234b37b19ab848cda24c27d7c5b4
Instruction ID: e2c56b0f2750b8f84508d475d39dcebb48128c4c0476730ce0518eb2826193df
Opcode Fuzzy Hash: eb3739b5e1fdbb06f111bd2a254998f898f1234b37b19ab848cda24c27d7c5b4
Instruction Fuzzy Hash: 59417C22A09A4681EA15BF57E4D42BDA360FB84BE0FC84133DA0D577A6DF7CE4428720

Function 00007FF7D4BD4D40 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD4D6B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD4D90
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD4DBA
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BD4E31
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD4E4B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD4E73

Strings

file=, xrefs: 00007FF7D4BD4D4A

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: 1edb80342092630832c5fb6f55dc38ee63870157e5051224cf635a77ba23c09f
Instruction ID: 8c0cf671fea1db2513c08641c6d4c4a1a23d92ca19d467051ba0284f9d04283e
Opcode Fuzzy Hash: 1edb80342092630832c5fb6f55dc38ee63870157e5051224cf635a77ba23c09f
Instruction Fuzzy Hash: D9314022A09A0291EE25EF17E5801BDA7A0FBA4B94FCC0573DA5E177A5DF3CE4418720

Function 00007FF7D4BE4754 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BE4769
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BE478E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BE47B8
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BE482F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BE4850
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BE4863

Strings

file=, xrefs: 00007FF7D4BE4758

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: 7281c3b0ae52227ce0c1cf18d1da4f5298ab66826f35442084b9449367ac1972
Instruction ID: 731434f9a5da64d5649c5c935f6e3c2f95c8a31bbd75faf10bc95828a10301e0
Opcode Fuzzy Hash: 7281c3b0ae52227ce0c1cf18d1da4f5298ab66826f35442084b9449367ac1972
Instruction Fuzzy Hash: AA317E22A0AA4281EA15BF57D48027DE761EBA4BA0FC80533DA0E57695DF7CE4428724

Function 00007FF7D4C0011C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00131
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00156
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00180
std::_Facet_Register.LIBCPMT ref: 00007FF7D4C001F7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00218
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4C0022B

Strings

file=, xrefs: 00007FF7D4C0011E

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: a79b8aa47fa485bbab139914a1b2ad1b3c206d5a57251d70f73a494e315bbdf8
Instruction ID: 23828bebf83fdcea31b253164a74923b95ed563304668f33bb4d55f2fbd140fe
Opcode Fuzzy Hash: a79b8aa47fa485bbab139914a1b2ad1b3c206d5a57251d70f73a494e315bbdf8
Instruction Fuzzy Hash: 44318426A09A4684EA25BF57E8C42BDE361EB54BE0FC80133DA1D576A5DF3CE4428320

Function 00007FF7D4BEE238 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE24D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE272
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE29C
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE313
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE334
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE347

Strings

file=, xrefs: 00007FF7D4BEE23C

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: 7c2c59fa053a96a9ecf4ebc1fe4e55a598fb33aa9990182c37703a59b10f1925
Instruction ID: 9e933495425001496644c29c1dd30809d86635852451868da212be2d3bd84d46
Opcode Fuzzy Hash: 7c2c59fa053a96a9ecf4ebc1fe4e55a598fb33aa9990182c37703a59b10f1925
Instruction Fuzzy Hash: 35317222A0AA4684EE15BF57E48027DE760EBA4BA4FC80133DE4D07795EF3CF4428324

Function 00007FF7D4BEE350 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE365
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE38A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE3B4
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE42B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE44C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE45F

Strings

file=, xrefs: 00007FF7D4BEE352

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: 0412f7df46e42df070327a9a1b5083ccedc36c2dba824865371200824fc3f07c
Instruction ID: 228dffa68b4865c6da8bd07cf9a2c4b8af84e6eafdcd2e81c861aed9787b2bd6
Opcode Fuzzy Hash: 0412f7df46e42df070327a9a1b5083ccedc36c2dba824865371200824fc3f07c
Instruction Fuzzy Hash: 53318522A0AA4281FA15BF57E4C01BCE361EBA4BA4FC80133DE5D077A5DF3CE4428724

Function 00007FF7D4BFFDD4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BFFDE9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BFFE0E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BFFE38
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BFFEAF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BFFED0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BFFEE3

Strings

file=, xrefs: 00007FF7D4BFFDD7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: e364a7d37f6e9fbbd1dce1d43802610c092617238c46e8cfe554c601d2725b9b
Instruction ID: f9bf7b4e515a27f17b9f15d5f6b8b3ad8df3eece7d0e8db15e1204dc0e954b23
Opcode Fuzzy Hash: e364a7d37f6e9fbbd1dce1d43802610c092617238c46e8cfe554c601d2725b9b
Instruction Fuzzy Hash: DC316F32A0AA4684EE15BF57D48027CE7A1EB64BA4FC80533DE0D476A6DF3CE442C720

Function 00007FF7D4BFFEEC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BFFF01
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BFFF26
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BFFF50
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BFFFC7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BFFFE8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BFFFFB

Strings

file=, xrefs: 00007FF7D4BFFEEF

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: c715b6234142cd09e9b106a8f36208cb94172bf7d7ad036fe947d961413caed5
Instruction ID: 392eab17baa98de99c14552453d0e45c680ac7da9fea77c4604a5613b6bf71d9
Opcode Fuzzy Hash: c715b6234142cd09e9b106a8f36208cb94172bf7d7ad036fe947d961413caed5
Instruction Fuzzy Hash: 28318222A0BA4285EA15BF57D4C067CFBA1EB65BA4FC80133DE5D476A5DF3CE4428720

Function 00007FF7D4C00004 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00019
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0003E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00068
std::_Facet_Register.LIBCPMT ref: 00007FF7D4C000DF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00100
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4C00113

Strings

file=, xrefs: 00007FF7D4C00007

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: 61d1ece634c315a025c50fc175d7199a4b562c3677c0d51e552b046aa0396774
Instruction ID: f5bb589e1fdf51d8f7f326144eadb9253b461599382931e5a9985d1f7cbca15d
Opcode Fuzzy Hash: 61d1ece634c315a025c50fc175d7199a4b562c3677c0d51e552b046aa0396774
Instruction Fuzzy Hash: 2E31A022A09A4281EA15BF57E88427DE761EB54BE8FC80133DA4D577A5DF3CE4428720

Function 00007FF7D4BEEAF8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEEB0D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEEB32
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEEB5C
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEEBD3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEEBF4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEEC07

Strings

file=, xrefs: 00007FF7D4BEEAFC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: file=
API String ID: 2081738530-2538679502
Opcode ID: 48d9c4655d1b26753cda38297b84ee87202d2a335801f716313b61c49757966b
Instruction ID: 8b43e8943863243de79d1b35d0e155b33d723fd3b53772524265fffef9405559
Opcode Fuzzy Hash: 48d9c4655d1b26753cda38297b84ee87202d2a335801f716313b61c49757966b
Instruction Fuzzy Hash: 15317421A0EA4680EA15BF67E4C017CE361EBA4BA4FC80533DE5E077A5DF7CE4428724

Function 00007FF7D4BC61E0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC6469
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC646F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC6475

Strings

{"msg":", xrefs: 00007FF7D4BC6268
High, xrefs: 00007FF7D4BC620D
Low, xrefs: 00007FF7D4BC6214

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: High$Low${"msg":"
API String ID: 3668304517-1891866251
Opcode ID: 4a3cfaeab38b78596b3228263cae7344cdeb35620154d9bc2cdc784de1d34b88
Instruction ID: d44838229608da31129d6b7eaabf511c8b5fc7a4e86b41c37ae331b741a9ce32
Opcode Fuzzy Hash: 4a3cfaeab38b78596b3228263cae7344cdeb35620154d9bc2cdc784de1d34b88
Instruction Fuzzy Hash: B471A162F19B8589FB10EF76D4803ACA321AB957D8FC44233DA5C266DADF78E1858350

Function 00007FF7D4BD63D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD65E2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD65E8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD65EE

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF7D4BD6488
M:pm, xrefs: 00007FF7D4BD65C1
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF7D4BD6548

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: :Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday$M:pm
API String ID: 118556049-1862959636
Opcode ID: 53820c5083b1a79f781b10075a89789dd2e95327002a2535c902c75b9376703e
Instruction ID: 0eb050c1ae06a205e87dceb6f4adf5c38c830d46d0fdc53a87e0a9043988bfe3
Opcode Fuzzy Hash: 53820c5083b1a79f781b10075a89789dd2e95327002a2535c902c75b9376703e
Instruction Fuzzy Hash: BC519122A0A78645FE01EF16D18437CA7A0AF64B84FCD8177DE5D07796EF2CE4818760

Function 00007FF7D4BB3AB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BB3B1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BB3B62
_Getctype.LIBCPMT ref: 00007FF7D4BB3B7A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BB3C32
_Getwctype.LIBCPMT ref: 00007FF7D4BB3C81

Strings

bad locale name, xrefs: 00007FF7D4BB3C55

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: fef943b3e94fe06f291272d72be438a6e3b6cd09b7a1663201a4f2f1369eeb99
Instruction ID: 1148050e5a9b4e5e96f03180dbe0fcd97eeeda83991a84f7b7ba8de3ed99ac52
Opcode Fuzzy Hash: fef943b3e94fe06f291272d72be438a6e3b6cd09b7a1663201a4f2f1369eeb99
Instruction Fuzzy Hash: 5B518D22F0AB418AFB15EFB2D4802AC77B0AF54744F845136DE4D27A96DF38A466C364

Function 00007FF7D4C0A57C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7D4C0A82E,?,?,?,00007FF7D4C0A520,?,?,?,00007FF7D4C07101), ref: 00007FF7D4C0A601
GetLastError.KERNEL32(?,?,?,00007FF7D4C0A82E,?,?,?,00007FF7D4C0A520,?,?,?,00007FF7D4C07101), ref: 00007FF7D4C0A60F
LoadLibraryExW.KERNEL32(?,?,?,00007FF7D4C0A82E,?,?,?,00007FF7D4C0A520,?,?,?,00007FF7D4C07101), ref: 00007FF7D4C0A639
FreeLibrary.KERNEL32(?,?,?,00007FF7D4C0A82E,?,?,?,00007FF7D4C0A520,?,?,?,00007FF7D4C07101), ref: 00007FF7D4C0A6A7
GetProcAddress.KERNEL32(?,?,?,00007FF7D4C0A82E,?,?,?,00007FF7D4C0A520,?,?,?,00007FF7D4C07101), ref: 00007FF7D4C0A6B3

Strings

api-ms-, xrefs: 00007FF7D4C0A621

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 2d5ac74ecc6a100ea38a0b516f94a7f8ad851f9c2de47539d31183b94db67e70
Instruction ID: 732f79a36691e45ad9363151e6b1bcf88ff7afecd5d1c25689bdcf88f8ab4fd8
Opcode Fuzzy Hash: 2d5ac74ecc6a100ea38a0b516f94a7f8ad851f9c2de47539d31183b94db67e70
Instruction Fuzzy Hash: AC31E821B1AA4192EE15AF13E8846BDA3A4FF54BE4FC90537ED5D1A390EF3DE4018320

Function 00007FF7D4C1E1F0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7D4C1E1FF
FlsGetValue.KERNEL32 ref: 00007FF7D4C1E214
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E235
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E262
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E273
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E284
SetLastError.KERNEL32 ref: 00007FF7D4C1E29F

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f5b00e574aa0d888fdfeee6e05e8aa48410a17821f25b7e5bbad88f407bda14a
Instruction ID: bf87bc8702bb0fb97918dd5aa325d6d044e44adc54bcece5d5fc3fbd73937d8d
Opcode Fuzzy Hash: f5b00e574aa0d888fdfeee6e05e8aa48410a17821f25b7e5bbad88f407bda14a
Instruction Fuzzy Hash: C8214C20F0C69242FA597F63EAE517DD2626F447E0FD44637E83E866CADE2CB4014231

Function 00007FF7D4C0467C Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C04351), ref: 00007FF7D4C04725
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C04351), ref: 00007FF7D4C047C8
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C04351), ref: 00007FF7D4C04869
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4C048B3
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4C0494A
CompareStringEx.KERNEL32 ref: 00007FF7D4C0497D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: c666564c02407c54345e54014b62058ee8b094e36e91e9a6216927ceb7f195ec
Instruction ID: 61c82a34827a8fd306fa9af061b94ff034d7cbdeae7e91293e09b25bd419ad39
Opcode Fuzzy Hash: c666564c02407c54345e54014b62058ee8b094e36e91e9a6216927ceb7f195ec
Instruction Fuzzy Hash: 23A1C222A0868146EB30EF26D5983BEA695AF457E4FC84633DA5C767D5DF7CE800C324

Function 00007FF7D4C03F8C Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7D4C03FFE
MultiByteToWideChar.KERNEL32 ref: 00007FF7D4C040A6
LCMapStringEx.KERNEL32 ref: 00007FF7D4C040DD
LCMapStringEx.KERNEL32 ref: 00007FF7D4C04136
LCMapStringEx.KERNEL32 ref: 00007FF7D4C041E3
WideCharToMultiByte.KERNEL32 ref: 00007FF7D4C04225

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 365d1809e1fc97452a50b45ad1143c2e49007afe7a5dee32fe1fa1860b5294e4
Instruction ID: 19b851460017c0a1f06d849db57777980ca008dcfe0ea857e8eb1ebd90486628
Opcode Fuzzy Hash: 365d1809e1fc97452a50b45ad1143c2e49007afe7a5dee32fe1fa1860b5294e4
Instruction Fuzzy Hash: FE817F7270874186EB209F62E48437EA6A1FB847E8F840237EA5D27BD4DF3CD4458724

Function 00007FF7D4BEED28 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEED3D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEED62
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEED8C
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEEE03
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEEE24
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEEE37

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d39c7b6fc60f21c3df8607624212dac4fb56cbd034ddefb43e8cd75d3152efc0
Instruction ID: 896d3b25d6a5dab1361162bc355334fc69901e8a43d10ab7b7bc80b59a2264bd
Opcode Fuzzy Hash: d39c7b6fc60f21c3df8607624212dac4fb56cbd034ddefb43e8cd75d3152efc0
Instruction Fuzzy Hash: 2B417F22A0AA4281EE15BF57D4801BDA360EFA4BD4FC84133DE5D472A5DF6CE442C734

Function 00007FF7D4BCDD60 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCDD8B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCDDB0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCDDDA
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BCDE51
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCDE6B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCDE93

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 2042775240bd6c479fce8bd923c7f62237510e7186632ca0eff0cc3ec857919d
Instruction ID: 67cdeac2e4209bb4cfed851d9ce17aaef2ce408a66d60ad2e6783475bf2f2d76
Opcode Fuzzy Hash: 2042775240bd6c479fce8bd923c7f62237510e7186632ca0eff0cc3ec857919d
Instruction Fuzzy Hash: 01314626A09A42C1EE25BF27E4C01BDA7A4EBA4B94FD80533DA5D076A5DE3CE4418720

Function 00007FF7D4BD5060 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD508B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD50B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD50DA
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BD5151
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD516B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD5193

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b11b7d60a71d5e64724596738f5cf418a9b85c8d5d2b0b66d99383134bd93198
Instruction ID: 63afa45fa027aa010d9ef0d518beaef8a5d5766024c85b9d98e4a8f50a03a943
Opcode Fuzzy Hash: b11b7d60a71d5e64724596738f5cf418a9b85c8d5d2b0b66d99383134bd93198
Instruction Fuzzy Hash: D8316622A09A0181EE11BF17E4801BEA7A0FB68BD8FDC0573DA5E072A5DF7CE4518710

Function 00007FF7D4BCEA00 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCEA2B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BCEA50
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCEA7A
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BCEAF1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BCEB0B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCEB33

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 24d47b9c58b4ac561442a5f8a6a89dda0eda9f481c2d97320db3b7ccf610aeac
Instruction ID: 717ebf646c484c4072ac1d7ec0dfdcb6a392a51f28d00c16d08f44cac8b2b078
Opcode Fuzzy Hash: 24d47b9c58b4ac561442a5f8a6a89dda0eda9f481c2d97320db3b7ccf610aeac
Instruction Fuzzy Hash: 59313622609A0185EA25BF27E4C057DE770FBA4794FDC0633EA5D076A5DF3CE4428720

Function 00007FF7D4BEE580 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE595
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE5BA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE5E4
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE65B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE67C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE68F

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3cae802a4357c99cce02824399aa241b436792386caece8917db76d399560e9e
Instruction ID: 0c479d96e59d2511efca415ff825aa305fc83464654b6f972cb1383186433bb1
Opcode Fuzzy Hash: 3cae802a4357c99cce02824399aa241b436792386caece8917db76d399560e9e
Instruction Fuzzy Hash: 8F316621A0AA4685EA15BF57E88017DF761EBA4BA4FC80133DE0D47795DF3CE4428724

Function 00007FF7D4BEE698 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE6AD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE6D2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE6FC
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE773
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE794
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE7A7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e94e0b861b29c27e4889fd7655c754f6b2dc5b8100564e9d521e209e7882ebe0
Instruction ID: 16ba08fab48f253001d65d8dbe5e92c7d83fbe48c47537fe3eba08e24dbe4194
Opcode Fuzzy Hash: e94e0b861b29c27e4889fd7655c754f6b2dc5b8100564e9d521e209e7882ebe0
Instruction Fuzzy Hash: 51317226A0AA4680EB15BF57E48017CE7A1EBA4BA4FC80133DE5D47695DF3CF446C324

Function 00007FF7D4BEE7B0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE7C5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE7EA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE814
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE88B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE8AC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE8BF

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: eec5043ab38b9151b3457b01f3287d20a57aa9387b6922933c9514c79e264e2a
Instruction ID: 4f5466819111f212f8a0650e501c2ab1da69d6e9dcdd942d0581a750e0bb7126
Opcode Fuzzy Hash: eec5043ab38b9151b3457b01f3287d20a57aa9387b6922933c9514c79e264e2a
Instruction Fuzzy Hash: 34312122A0AA4681EA15BF57E8801BDA761EBA4BA4FC80133DE5D47795DE3CE442C724

Function 00007FF7D4BEE8C8 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE8DD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE902
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE92C
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE9A3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE9C4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE9D7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c47ac0e8dd3d0c286527649e92f272822709cc0d429192d2b540c2e798ba42d9
Instruction ID: 7e929014b24edc7b47e2d144284e2a6be42cf07ef70aa33c6f593471ba33974d
Opcode Fuzzy Hash: c47ac0e8dd3d0c286527649e92f272822709cc0d429192d2b540c2e798ba42d9
Instruction Fuzzy Hash: 57318626A0AA4281EE55BF57E48027CE3A1EBA47A4FC80133DF5D07795DE3CE4468324

Function 00007FF7D4C00234 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00249
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C0026E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00298
std::_Facet_Register.LIBCPMT ref: 00007FF7D4C0030F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00330
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4C00343

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 766bc0b1722455a3eec6d0639954e9c5a2943d8c3e93ed51b5b95f5e5a2d201a
Instruction ID: 368c2bb85816ac7c3501f16159ffca81e04edfb8047604735bbe87e66400ab50
Opcode Fuzzy Hash: 766bc0b1722455a3eec6d0639954e9c5a2943d8c3e93ed51b5b95f5e5a2d201a
Instruction Fuzzy Hash: 90317E22A0DA4285EE15BF57E4C427DE361EB94BE4FC80133DA4D57695DF7CE4828720

Function 00007FF7D4C0034C Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00361
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4C00386
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C003B0
std::_Facet_Register.LIBCPMT ref: 00007FF7D4C00427
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4C00448
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4C0045B

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 377b59972e5e0ee5b8278c57d5a3dc2c1a202cafcbafdecb7bd9c415f6f64c78
Instruction ID: 5eeebc609a4c6793c0c38e38d557e5eec4c0e8a6f2203269ebbb21869ec62ec1
Opcode Fuzzy Hash: 377b59972e5e0ee5b8278c57d5a3dc2c1a202cafcbafdecb7bd9c415f6f64c78
Instruction Fuzzy Hash: FF318022A09A4685EF15BF57E8C427DE360EB94BE4FC80133DA5E57696DF3CE4428720

Function 00007FF7D4BEE468 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE47D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE4A2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE4CC
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEE543
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEE564
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEE577

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 21717bef3686618cd96da9bb82ce299ad44ed5010396f82f6eca78fbaf962fb2
Instruction ID: 9cd84c51f8babed7f1781641759d2c805794bc6c7a6b2e3500062d7151fe6830
Opcode Fuzzy Hash: 21717bef3686618cd96da9bb82ce299ad44ed5010396f82f6eca78fbaf962fb2
Instruction Fuzzy Hash: 84317822A0AA4281EA15BF57E48067CE7A1EBA47A4FC80133DE4D07695EF3CE4468334

Function 00007FF7D4BEE9E0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEE9F5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BEEA1A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEEA44
std::_Facet_Register.LIBCPMT ref: 00007FF7D4BEEABB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BEEADC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BEEAEF

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9c406dcfc41f0356f12bc71b5c6d240ac8f6804b0cb7f11da5ef4b535cedcd89
Instruction ID: e1a929b276b5a6eeaa472812302449302a9ee5765be0d96e7b6744c4495f2f1e
Opcode Fuzzy Hash: 9c406dcfc41f0356f12bc71b5c6d240ac8f6804b0cb7f11da5ef4b535cedcd89
Instruction Fuzzy Hash: 76316F22A0AA4680EA15BF57E4C017DA7A1FBA4BA4FC81137DE0D477A5DF3CE4428724

Function 00007FF7D4BFDE90 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

%, xrefs: 00007FF7D4BFE267
+, xrefs: 00007FF7D4BFE27A

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: be3d1e85cf96b28ac0a17ea4137767ce67214e1e92dfd20f534a1827cba5f10e
Instruction ID: 7a260c9b4cf55826542c185f809079e8ee9fd0392951f026a6780247f2a09af1
Opcode Fuzzy Hash: be3d1e85cf96b28ac0a17ea4137767ce67214e1e92dfd20f534a1827cba5f10e
Instruction Fuzzy Hash: BFD1E462B09B8585EB11DFAAD4802ADB3A1AB58BD8FC44233DE5C27B99DF3DD045C310

Function 00007FF7D4C08120 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7D4C082BE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7D4C085E7

Strings

csm, xrefs: 00007FF7D4C08205
csm, xrefs: 00007FF7D4C08267
csm, xrefs: 00007FF7D4C082E5

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 890515245bb3702dda5d83861889bf4967c74efe4f362a51c3ffa88499933ad7
Instruction ID: 957bafed1d764401cc52baede15b518964cdd67c3de98666e8b12ebb1a80bf8e
Opcode Fuzzy Hash: 890515245bb3702dda5d83861889bf4967c74efe4f362a51c3ffa88499933ad7
Instruction Fuzzy Hash: 53E1A6729087828AEB60AF66D4C43BDB7A0FB45798FD44137DE8D67695CE38E441C720

Function 00007FF7D4C1E368 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1E377
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1E3AD
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1E3DA
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1E3EB
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1E3FC
SetLastError.KERNEL32(?,?,8000000000000000,00007FF7D4C11C85,?,?,?,?,00007FF7D4C1DB64), ref: 00007FF7D4C1E417

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 98384f26327f76579ed9f630f10178bdb8d09822ebacc95e52f3561bd0bb9469
Instruction ID: 0e935efd430e42279617dcbaf5caa3a3eed32bea847b9aa79b3165439b1d447a
Opcode Fuzzy Hash: 98384f26327f76579ed9f630f10178bdb8d09822ebacc95e52f3561bd0bb9469
Instruction Fuzzy Hash: 24114A20E0C29242FA68BF27EAD517DE1626F847E0FD44637E92E867C6DE2CB4014231

Function 00007FF7D4BC9650 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 00007FF7D4BC97F6, 00007FF7D4BC9850
ios_base::failbit set, xrefs: 00007FF7D4BC9802
ios_base::eofbit set, xrefs: 00007FF7D4BC9809

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: e8fc301ee92d7accb233e5a65c4cc3912e36ef04512fb8064d0719e2c12e0876
Instruction ID: 593e08b1cade988bbe7fd8b95742288f4dcbac2f8299c17614e0b75e0ca7f80d
Opcode Fuzzy Hash: e8fc301ee92d7accb233e5a65c4cc3912e36ef04512fb8064d0719e2c12e0876
Instruction Fuzzy Hash: 4781B02260AA8582EF24EF26D0C037DA7A1EB84F94F948533DA5D47799DF3DD845C310

Function 00007FF7D4BB37A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BB380A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BB3852
_Getctype.LIBCPMT ref: 00007FF7D4BB386A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BB38FA

Strings

bad locale name, xrefs: 00007FF7D4BB391D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: a608f9e962290028e7dcc6ab05cafac44368563cf0e660048a16c5bacd16331e
Instruction ID: faec5ec53c55cf64445ba722a2473f8ff7b661a0c3681578a496edb8f0ef91c2
Opcode Fuzzy Hash: a608f9e962290028e7dcc6ab05cafac44368563cf0e660048a16c5bacd16331e
Instruction Fuzzy Hash: 22417C22B0AB4189FB10EFB2D4902BCA7B4AF54784FC84436DE4E26A95DF38D516D364

Function 00007FF7D4BD4830 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD4972

Part of subcall function 00007FF7D4BDFC0C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7D4BDFC15

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD4978
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD497E

Strings

true, xrefs: 00007FF7D4BD4923
false, xrefs: 00007FF7D4BD48F7

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID: false$true
API String ID: 1173176844-2658103896
Opcode ID: a0548538b1f2a7caf437fa2082cbfdfde99cd727c9bf5cef349941922eb6682d
Instruction ID: de840aaf879f0726b0f4d4b7ae6c21e98ebd0d533c7fcb341ee4801c0ebd37fa
Opcode Fuzzy Hash: a0548538b1f2a7caf437fa2082cbfdfde99cd727c9bf5cef349941922eb6682d
Instruction Fuzzy Hash: FF41A32250A78249EB11EF66E4802ADB7A0EF64B94FD84536DE9D03395EF3CE451C360

Function 00007FF7D4BCC1F0 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCC616
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCC61C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCC622
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCC628
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCC62E

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: e7fa8e4a899329e984c1acece99ca774f877e1b28c68e86b264a1d9f6202f99f
Instruction ID: 5b852c6c2dc5cd7209f957b802eee079efcc53e9cbf8a7900dae19c441b1ee80
Opcode Fuzzy Hash: e7fa8e4a899329e984c1acece99ca774f877e1b28c68e86b264a1d9f6202f99f
Instruction Fuzzy Hash: FDC19162F15B4186FB20EFBAD0842BC6375ABA8798FC05632DE5D23B98DE38D041C754

Function 00007FF7D4C07520 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF7D4C07643
__AdjustPointer.LIBCMT ref: 00007FF7D4C0768E

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f49579f6f4c693db4c0587241cba271d48c05cfce4442a5e01e519973c885395
Instruction ID: 579e154ad847d537af0a09d94cfb6b37e4774fccfb7cfcfccaf90bbd35917bb5
Opcode Fuzzy Hash: f49579f6f4c693db4c0587241cba271d48c05cfce4442a5e01e519973c885395
Instruction Fuzzy Hash: 7AB19E22B0B64281EE6ABF17D5C867CE694AF44BC4FD98437DE4D27795DE2CE4428320

Function 00007FF7D4BCBE00 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCC1CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCC1D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCC1D8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCC1DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCC1E4

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: bcead0ba50dd890a7dbadb4ee972e07d315b1ca9652fd7eddeed071f19e576e3
Instruction ID: a14e8fe8a60fa72ae02bdaae9fdca38cb23371a188700f4a5892d1d6e41a797e
Opcode Fuzzy Hash: bcead0ba50dd890a7dbadb4ee972e07d315b1ca9652fd7eddeed071f19e576e3
Instruction Fuzzy Hash: 0AB1C062B1AB418AEB20EF76D0C42BDA372AB65798FC04232DE5D17B99DE38D055C710

Function 00007FF7D4C22A98 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7D4C22ADB
_set_statfp.LIBCMT ref: 00007FF7D4C22AF9
_set_statfp.LIBCMT ref: 00007FF7D4C22B22
_set_statfp.LIBCMT ref: 00007FF7D4C22D5B

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 77b3e33a6f5132d0789f4973ca5980c7032235896e2b77d186fa7528dd25f978
Instruction ID: 0e180b50c61fd9246fcf3bc6d75e22a1b8cfb04d5a0c721a4c06be2a2ebff980
Opcode Fuzzy Hash: 77b3e33a6f5132d0789f4973ca5980c7032235896e2b77d186fa7528dd25f978
Instruction Fuzzy Hash: A681E522908A4649F236AF36E4D037EF650AF553D4FC44337EA5E265E4DFBCA481CA20

Function 00007FF7D4C15F84 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15FFD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1604D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C16095
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C160CD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C16140

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 492b45dcdfc681ab09788500166ca94a443063352cf3c2ab544e14c454973447
Instruction ID: 92ac88961c73f9a3132b28951bb37f5a975e1d9bd53b19076480a0e120dc69f2
Opcode Fuzzy Hash: 492b45dcdfc681ab09788500166ca94a443063352cf3c2ab544e14c454973447
Instruction Fuzzy Hash: 15514126A09B8686E752AF26D4D027DBBB5AF05BC4FD98033C68D47342DE2D9445C335

Function 00007FF7D4C30068 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7D4C30090
_set_statfp.LIBCMT ref: 00007FF7D4C300AB
_set_statfp.LIBCMT ref: 00007FF7D4C300C7
_set_statfp.LIBCMT ref: 00007FF7D4C30103

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b5f862fb55466f104c7638c26c27eae1ccad5020b215a080a91550ad010d465e
Instruction ID: c11c3ac2ba6d1996ceced64d3dac93e27e628ac72ba4413f0326df0ed18ab561
Opcode Fuzzy Hash: b5f862fb55466f104c7638c26c27eae1ccad5020b215a080a91550ad010d465e
Instruction Fuzzy Hash: D911C823E4CE0301F6583B6BD5D93BDA5406F543F8FC50637E96E162EE8E9CA8825130

Function 00007FF7D4C1E430 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7D4C13B53,?,?,00000000,00007FF7D4C13DEE,?,?,?,?,8000000000000000,00007FF7D4C13D7A), ref: 00007FF7D4C1E44F
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C13B53,?,?,00000000,00007FF7D4C13DEE,?,?,?,?,8000000000000000,00007FF7D4C13D7A), ref: 00007FF7D4C1E46E
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C13B53,?,?,00000000,00007FF7D4C13DEE,?,?,?,?,8000000000000000,00007FF7D4C13D7A), ref: 00007FF7D4C1E496
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C13B53,?,?,00000000,00007FF7D4C13DEE,?,?,?,?,8000000000000000,00007FF7D4C13D7A), ref: 00007FF7D4C1E4A7
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C13B53,?,?,00000000,00007FF7D4C13DEE,?,?,?,?,8000000000000000,00007FF7D4C13D7A), ref: 00007FF7D4C1E4B8

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c1f80a57214fa9314f74c4b30dc64759b56f05021f72730d0f25618e90a88899
Instruction ID: 72a908a2053d1954108f05864f8de20322b3ad72d547d6dfb06753eaf57d8ab9
Opcode Fuzzy Hash: c1f80a57214fa9314f74c4b30dc64759b56f05021f72730d0f25618e90a88899
Instruction Fuzzy Hash: 8F112920E0869241FA58BF67E9D117DE1626F847E0FC44277E82E866DADE2CB4028231

Function 00007FF7D4C1E2C4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7D4C1E2D5
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E2F4
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E31C
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E32D
FlsSetValue.KERNEL32 ref: 00007FF7D4C1E33E

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 664d4be6e4d57da178c0bd4b1e2dd36a93d6030a558b2ea56983ac91fc98f45f
Instruction ID: 44f8473113772871c706740bba08839c4a8583dafcd4f09e13aa21b9f56b2f41
Opcode Fuzzy Hash: 664d4be6e4d57da178c0bd4b1e2dd36a93d6030a558b2ea56983ac91fc98f45f
Instruction Fuzzy Hash: EF11D620E0929742F9697E27D8E257DD1616F453F0FD80737E93E8A2C6ED2CB4414232

Function 00007FF7D4C1D7D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1DA79

Part of subcall function 00007FF7D4C2B5F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2B615

Strings

UTF-16LEUNICODE, xrefs: 00007FF7D4C1DA1D
ccs, xrefs: 00007FF7D4C1D9C5
UTF-8, xrefs: 00007FF7D4C1D9FC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 9786d68c7eed2349fa8e9c8b660a2a1167aaa83090c5916e364db7622d5a1be9
Instruction ID: f7393d57823a12fd56918b6d8b19e1a6694f59fd3367dd66919ff6645b6f12a9
Opcode Fuzzy Hash: 9786d68c7eed2349fa8e9c8b660a2a1167aaa83090c5916e364db7622d5a1be9
Instruction Fuzzy Hash: A0818162D0C2C289F7A5AE2AD2D423CEBB09B127C4FD59037CA0E56295EE1DB9418771

Function 00007FF7D4C08894 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7D4C08904
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7D4C0894F

Strings

RCC, xrefs: 00007FF7D4C08920
MOC, xrefs: 00007FF7D4C08918

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 4570207b4165d0635ac4a3fd3d64531da63560077cbea117cab5ba90e919dedc
Instruction ID: 2a4da838184eb913dc8bba6e57356e25b1b75c2ba1f8f8d912d5155d6bce155c
Opcode Fuzzy Hash: 4570207b4165d0635ac4a3fd3d64531da63560077cbea117cab5ba90e919dedc
Instruction Fuzzy Hash: CB919373A087858AE710EF66D8842ADBBA0FB447C8F94813BEA8D27B55DF38D155C710

Function 00007FF7D4BC5F70 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC61BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC61C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BC61CC

Strings

{"msg":", xrefs: 00007FF7D4BC6081

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: {"msg":"
API String ID: 3668304517-2882747944
Opcode ID: 5d06d9a251fd8b4a576a19a10e83e4d40e5508396f1b958b033d9f2b6b30e06f
Instruction ID: 0f7fd957ede4c592726ce623e5b493f204327ca4929b794ba277291cb51ba649
Opcode Fuzzy Hash: 5d06d9a251fd8b4a576a19a10e83e4d40e5508396f1b958b033d9f2b6b30e06f
Instruction Fuzzy Hash: AA51D322B15A415AFB10AF36D0C43ADA361AB557E8FC45732DD6C26BDADF38D5418320

Function 00007FF7D4C06EE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7D4C06F0B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7D4C06FA2
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF7D4C0569A), ref: 00007FF7D4C06FFC

Strings

csm, xrefs: 00007FF7D4C06F89

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 96d482e54c2ff74a9578f97a2d3b0353fcb5dd65390cdded8450e2fed95d9ab2
Instruction ID: 056eb2ee56384ee2a509f398836c05b40dfd5cf627b1cc856eb78b9617fab061
Opcode Fuzzy Hash: 96d482e54c2ff74a9578f97a2d3b0353fcb5dd65390cdded8450e2fed95d9ab2
Instruction Fuzzy Hash: 3151A132B1A6028ADF58AF56D488A7CA391EB44BD8FD44237EA4E53784DF7DE8418710

Function 00007FF7D4C08624 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7D4C08683
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7D4C086CF

Strings

MOC, xrefs: 00007FF7D4C08697
RCC, xrefs: 00007FF7D4C0869F

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 2b5b42315b3b38cd90a5c931a26b3be2eb898fc97ebece708dba4641e3ddee3e
Instruction ID: d61648b03fd9aeaf1b87cb618ff40f44d50951e36372c344f12cbb18d392ce83
Opcode Fuzzy Hash: 2b5b42315b3b38cd90a5c931a26b3be2eb898fc97ebece708dba4641e3ddee3e
Instruction Fuzzy Hash: 33615F72908B8586DA70AF16E4843AEB7A0FB857D4F848226EB9C17755DF7CD190CB20

Function 00007FF7D4C08E14 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7D4C08E3C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7D4C08F24

Strings

csm, xrefs: 00007FF7D4C08E5E
csm, xrefs: 00007FF7D4C08F76

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 56963d72e84833e31defc41a0a330777e341b24c38b4c4f77a0b573189b86a8c
Instruction ID: 38c192684dec20675e723d9c5034ea5cafed4ef84204ba4dfefb77e3e63d7c5a
Opcode Fuzzy Hash: 56963d72e84833e31defc41a0a330777e341b24c38b4c4f77a0b573189b86a8c
Instruction Fuzzy Hash: 5851843290864286EB74AF22D48836CB6A1EB54BD4FD48137EB9C67AD5CF3CE450C721

Function 00007FF7D4BD5FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD6073
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BD60BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD6178

Strings

bad locale name, xrefs: 00007FF7D4BD6191

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 3931c185ac249372042b0835e728ec539ad978b651a92cbfb8180ec839c4395c
Instruction ID: 16a9b6eca58d4889f5ecc461041a10b7c91d217a5d2f6d06f99a8d16bf6ae726
Opcode Fuzzy Hash: 3931c185ac249372042b0835e728ec539ad978b651a92cbfb8180ec839c4395c
Instruction Fuzzy Hash: 0E51AF32A0AB418AEB10EFB1D4903AC63B0EF54748F885136DE4E23A99DF389165D324

Function 00007FF7D4BD3770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BD37DA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BD3822
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7D4BD38B2

Strings

bad locale name, xrefs: 00007FF7D4BD38D5

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 8a1433ced35edaf2e3bf14674eb29a9f84b432830e307e1ef4c60def5f2e697f
Instruction ID: ecd2bec0e1269d258f4ce1c6c850fbe5b24012802d2b1b818ea9e8a3b7b9595e
Opcode Fuzzy Hash: 8a1433ced35edaf2e3bf14674eb29a9f84b432830e307e1ef4c60def5f2e697f
Instruction Fuzzy Hash: B4417E32B0AA41C9EB10EFB2D4903ECA3B4EF54748FC84476DA4E26A56CF38D516D324

Function 00007FF7D4BF37A8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

_Getvals.LIBCPMT ref: 00007FF7D4BF3826

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FF7D4BF385F
$+xv, xrefs: 00007FF7D4BF38CF
$+xv, xrefs: 00007FF7D4BF3858

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Getvals
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 1336808981-3573081731
Opcode ID: 6c2677962067f2fa1c951a5da5b2b474ecb5c2e7cdb0c6e2cf76ea76a8af39f9
Instruction ID: 024500069426637fff85ffb69fa1b8a8de62e402f932b803aa00d6548d713065
Opcode Fuzzy Hash: 6c2677962067f2fa1c951a5da5b2b474ecb5c2e7cdb0c6e2cf76ea76a8af39f9
Instruction Fuzzy Hash: 5541AC72A09B918BE724EF22D18036DBBE0FB65B81FC55266CB4D43A41DB2DF465C700

Function 00007FF7D4C24684 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7D4C2470B
WriteFile.KERNEL32 ref: 00007FF7D4C249D2
WriteFile.KERNEL32 ref: 00007FF7D4C24A1B
GetLastError.KERNEL32 ref: 00007FF7D4C24ADC

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 767b7117d63aae9f51616854b4116fa608bdc1094623500c77e6c8594bac8a16
Instruction ID: 02dba8fcb16449fddec463fedb4622fbcd92c772a66736f38b336d305857c893
Opcode Fuzzy Hash: 767b7117d63aae9f51616854b4116fa608bdc1094623500c77e6c8594bac8a16
Instruction Fuzzy Hash: 72D12432B08A818AE710DF7AD4801ACBBB5F7067D8B944233DE5D67B99DE78D006C314

Function 00007FF7D4C25060 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7D4C25000), ref: 00007FF7D4C25183
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7D4C25000), ref: 00007FF7D4C2520D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: b24a8eab074577c162c6cdbd7e1523746b621e7fdef98cc78988dc972daca678
Instruction ID: 78c93339601db94c5217d86dd9bf62302557ffe8468f55f619648afdb97f62d2
Opcode Fuzzy Hash: b24a8eab074577c162c6cdbd7e1523746b621e7fdef98cc78988dc972daca678
Instruction Fuzzy Hash: F591BF62A1865285EB50AF66D4C06BEBBA0FB44BCCFC41137DE0E67694DFB8E441C720

Function 00007FF7D4C2BA34 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2BA75
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2BAF5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C2BB49
_get_daylight.LIBCMT ref: 00007FF7D4C2BBA1

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 6ee7f3f5d77d3d1bc48d53be37883cc5b81d2d73ff0743d23d12e10b1a6c0d1e
Instruction ID: b1f94240de6f041942a95f6a9915c8ce36f45eb8beb4dc75c74cc8d8f16d44cc
Opcode Fuzzy Hash: 6ee7f3f5d77d3d1bc48d53be37883cc5b81d2d73ff0743d23d12e10b1a6c0d1e
Instruction Fuzzy Hash: F551D232E0C6038AF7686D2AD0C537DF590EB40794FD94437DA4D462EAEEACEA409631

Function 00007FF7D4C114DC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7D4C1150F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7D4C11571
GetLastError.KERNEL32 ref: 00007FF7D4C11602
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,00007FF7D4C11414), ref: 00007FF7D4C1164E

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 3b67d254175e1356448e30113c7945dcc594d42a4af4fb0ebecbdf82148d1320
Instruction ID: 52ac6c1ac5c73c8ea12805c1973b348fe06d6af483dc24dd7b83eee692f87c36
Opcode Fuzzy Hash: 3b67d254175e1356448e30113c7945dcc594d42a4af4fb0ebecbdf82148d1320
Instruction Fuzzy Hash: E6517E62A086418AFB50EF72D4903BDA3B1EB48B98F95803BDE0E47688DF3CD4418760

Function 00007FF7D4C15E28 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15EA1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15F06
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15F42
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C15F73

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa8d8d6ef9abf4a7f6b39118007aba560a03b250cad3e0274fea527eecee2a0e
Instruction ID: 7adf9e509855244fa57645afcd8cee700d513875e22ee23edf96f08c7cd81ac7
Opcode Fuzzy Hash: aa8d8d6ef9abf4a7f6b39118007aba560a03b250cad3e0274fea527eecee2a0e
Instruction Fuzzy Hash: 1B415036908BC685E762EF26D4A027DBBA4AF05B84FC88073D68C07746DE3D9405C732

Function 00007FF7D4C11388 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C113B5
CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4BBA348), ref: 00007FF7D4C113F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4BBA348), ref: 00007FF7D4C11429

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: e4876973aa477c234093ca3bb4f84cb558b2507fe2f53346e19c8feeadb19f6c
Instruction ID: 1c7dfea047b74cc8db389c5113c1cbbe0e2104e01ac793540514e69c5b6e6584
Opcode Fuzzy Hash: e4876973aa477c234093ca3bb4f84cb558b2507fe2f53346e19c8feeadb19f6c
Instruction Fuzzy Hash: 44417222D1878283E750AF22D59036DA270FB997E4F909337D69C03AD5DF6CA5A18724

Function 00007FF7D4BC1E50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

invalid stoull argument, xrefs: 00007FF7D4BC21B8

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: invalid stoull argument
API String ID: 0-2058699613
Opcode ID: eaed5e95d4f30143368ef6ed9d0a8950138a867b4e377591b662461e9a27bce8
Instruction ID: fc9bb3cec9b66564cb810171ad73b33ce4445f27ca054c14e81c723bf9fb0e6a
Opcode Fuzzy Hash: eaed5e95d4f30143368ef6ed9d0a8950138a867b4e377591b662461e9a27bce8
Instruction Fuzzy Hash: C171C232A09B8582DB10EF16E4C42AEB3A4FB95784FD19037EA8E57664DF3CE545CB10

Function 00007FF7D4C0904C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7D4C09076

Strings

csm, xrefs: 00007FF7D4C0920A
csm, xrefs: 00007FF7D4C0909B

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 0aab2139d8ff1db06bd9a7db1baed0bb2163b038a6bcbeb200c170c991ea75bc
Instruction ID: 144d968d7eca96bbb41f991bdfb1d0027678c0c3ff7eaaa8190452d369763326
Opcode Fuzzy Hash: 0aab2139d8ff1db06bd9a7db1baed0bb2163b038a6bcbeb200c170c991ea75bc
Instruction Fuzzy Hash: FB71A372A0868286DB60AF16D4887BDFBA0FB15BC8FD48137DA8C27A95CF2CD5518750

Function 00007FF7D4BD04F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BD0682
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BD0688

Strings

ios_base::failbit set, xrefs: 00007FF7D4BD04F0

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 73155330-3924258884
Opcode ID: 9c02fc629e10953d4ed5b5a927573ce6e66b272ca667a73eda632291441204c6
Instruction ID: 32e531ded3299c18b17b0de7fee79aecf12a2107e4e3d013dcf5b697609003e7
Opcode Fuzzy Hash: 9c02fc629e10953d4ed5b5a927573ce6e66b272ca667a73eda632291441204c6
Instruction Fuzzy Hash: CD41BF61B0A64285EE14AF12D48416DE365AB54BF8FD84732EEBE077D5DF3CE0528314

Function 00007FF7D4BB9F10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00007FF7D4BB9F6E
FindNextFileW.KERNEL32 ref: 00007FF7D4BBA048

Strings

?, xrefs: 00007FF7D4BBA0B2

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: FileFindNext
String ID: ?
API String ID: 2029273394-1684325040
Opcode ID: 0b0d1ef25a6ea251f3bac5d6ad2d25f3f707807f81456704ba133931aaa77369
Instruction ID: 5d630567f9b16f9baf1d7006b87670e95255af0641d07086e391f9de0314c77e
Opcode Fuzzy Hash: 0b0d1ef25a6ea251f3bac5d6ad2d25f3f707807f81456704ba133931aaa77369
Instruction Fuzzy Hash: A351E372A0AA4186E7909F26D58437CBBE1FB58B88FD48037DA4D4B294DF3DE492C714

Function 00007FF7D4C096E4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7D4C0978E
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7D4C097BA

Strings

csm, xrefs: 00007FF7D4C098BA

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: f861e7d98ba89d51eb38520f4733ed51dad1eec037d35169d73173b26955cc4e
Instruction ID: 657f05fd4280678797036b0c11dc3fc2a1c0f6bc0de7045e6f0ca865779dbd7e
Opcode Fuzzy Hash: f861e7d98ba89d51eb38520f4733ed51dad1eec037d35169d73173b26955cc4e
Instruction Fuzzy Hash: 89516D36A1978286DA60FF16E48426DB7A4F789BD4F840136DF8D17B95CF38D450CB10

Function 00007FF7D4BF38F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_Getvals.LIBCPMT ref: 00007FF7D4BF3A51

Strings

true, xrefs: 00007FF7D4BF39A5
false, xrefs: 00007FF7D4BF398F

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Getvals
String ID: false$true
API String ID: 1336808981-2658103896
Opcode ID: 4d8fda1b01b9643ae2a486ea9dc5a8a8fd1bc9e164a5f98692e17afe343b8da4
Instruction ID: 6cf92b20dc63dbf3dc39f96e6d64c4098f25ba5ee366777a72e96e18de85e1d7
Opcode Fuzzy Hash: 4d8fda1b01b9643ae2a486ea9dc5a8a8fd1bc9e164a5f98692e17afe343b8da4
Instruction Fuzzy Hash: 53418C22B09B8199E710DF71E4801EC73B1FB98788B845237EE4E27A59EF38D556C354

Function 00007FF7D4C24D30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7D4C24E47
GetLastError.KERNEL32 ref: 00007FF7D4C24E69

Strings

U, xrefs: 00007FF7D4C24DF3

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1132b2b49b48c2597eacc499dc815d14bcebaaae66ec285487d91b8d70e04cea
Instruction ID: 5c7b1a64299c329a0a99ccdd2f4237791fba9bd1e25c857ce3e68e858be1e787
Opcode Fuzzy Hash: 1132b2b49b48c2597eacc499dc815d14bcebaaae66ec285487d91b8d70e04cea
Instruction Fuzzy Hash: EA418F22618A4192EB60EF26E4843ADB660FB95BC4FC44133EE4D97794EF7CD441C754

Function 00007FF7D4C30D48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7D4C30DBF
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FF7D4C30E1B

Strings

Bad dynamic_cast!, xrefs: 00007FF7D4C30E8A

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: FileFindHeaderInstanceTargetType
String ID: Bad dynamic_cast!
API String ID: 746355257-2956939130
Opcode ID: 61c36b307e33985b0d8f6c98740969c9a90600ed5136c011a00d70231ba89d9f
Instruction ID: c9994b30d2da0c991531134d80917452dc59fee191fe4c5fa5d26388082c89f3
Opcode Fuzzy Hash: 61c36b307e33985b0d8f6c98740969c9a90600ed5136c011a00d70231ba89d9f
Instruction Fuzzy Hash: 71315E23718A8686EA60EF57E4846AEA3A0BB44FC5F908537DE8D43B58DF3CE145C710

Function 00007FF7D4BCD450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D4BCD582
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7D4BCD588

Strings

ios_base::badbit set, xrefs: 00007FF7D4BCD450

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set
API String ID: 73155330-3882152299
Opcode ID: 8d7ede1257be8a6d326046e293ce6e78ea5ce23a2a85ad897d997926aed4ceee
Instruction ID: 36fe989c0c36dc0d69c284cb19331b166663207aea6ff960d2d3eddaa6730037
Opcode Fuzzy Hash: 8d7ede1257be8a6d326046e293ce6e78ea5ce23a2a85ad897d997926aed4ceee
Instruction Fuzzy Hash: AA31C026B0778551E924EF2BD1C827DE2559B54BE4FD40632DE6D07BC4EE6CE4928320

Function 00007FF7D4BCF490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

V2luaHR0cC5kbGw=, xrefs: 00007FF7D4BCF495

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: V2luaHR0cC5kbGw=
API String ID: 0-322140799
Opcode ID: cef76e8e8240fbdba4cbd0c9edfa7cee544b0aca40b0040f7b36dab85f5469c0
Instruction ID: 3fbeaf0fa770739c7b137644ce871d1fa74791f32513370a496ad67ecc28af32
Opcode Fuzzy Hash: cef76e8e8240fbdba4cbd0c9edfa7cee544b0aca40b0040f7b36dab85f5469c0
Instruction Fuzzy Hash: E621C122E0A74245FE25AF66E0C43BCA6909F24BA4FE44732DB7C067C2DF2CE4918314

Function 00007FF7D4BC6760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

stoi argument out of range, xrefs: 00007FF7D4BC6B1A
invalid stoi argument, xrefs: 00007FF7D4BC6B0D

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID:
String ID: invalid stoi argument$stoi argument out of range
API String ID: 0-1606216832
Opcode ID: 7459996af044bcc1df2c0d35d30503d29db3ad35883df7ef00a7cf41bae90e41
Instruction ID: 0efab0d277eab0f3fe112b1771c7ed00f215015d559f781aed0a439ad961fb71
Opcode Fuzzy Hash: 7459996af044bcc1df2c0d35d30503d29db3ad35883df7ef00a7cf41bae90e41
Instruction Fuzzy Hash: FF219222B19B4198F700EFB2D8857EC73B5AB18788FD94437EE4C27645EE38A419C354

Function 00007FF7D4C230F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7D4C2314C
_set_errno_from_matherr.LIBCMT ref: 00007FF7D4C231B9

Strings

exp, xrefs: 00007FF7D4C23127

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: d7c5f8fd6198134743ea40bd6589e46bc0623e8d67f78ee984f86d8a58bb9fa2
Instruction ID: 31b6e2e12cc56063d732d5a8b0589665fa45141df7548b04deed376717ef6d39
Opcode Fuzzy Hash: d7c5f8fd6198134743ea40bd6589e46bc0623e8d67f78ee984f86d8a58bb9fa2
Instruction Fuzzy Hash: 54213936F056158EE740EF79D4802AD73B0EB48388B801537EA0D96B5ADE38E5418B64

Function 00007FF7D4BB30F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7D4BB3107
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7D4BB3146

Strings

bad locale name, xrefs: 00007FF7D4BB315A

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: d2642994a7d4360568344dba662e43fc99c418791ae7fedf961662c9b87a45e1
Instruction ID: 625383535a6a6a384769f735bc17d76f12cb6736ce7eae933a681e1768a7b416
Opcode Fuzzy Hash: d2642994a7d4360568344dba662e43fc99c418791ae7fedf961662c9b87a45e1
Instruction Fuzzy Hash: 8101862350AB8189C755EFB5E88015CB7F5FB68B84B98513ACB8C8371AEF38C4A0C354

Function 00007FF7D4C06E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7D4BDFC72), ref: 00007FF7D4C06E64
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7D4BDFC72), ref: 00007FF7D4C06EA5

Strings

csm, xrefs: 00007FF7D4C06E92

Memory Dump Source

Source File: 00000000.00000002.3204733828.00007FF7D4BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BB0000, based on PE: true

Associated: 00000000.00000002.3204716756.00007FF7D4BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204797263.00007FF7D4C36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204819665.00007FF7D4C50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204834749.00007FF7D4C51000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C52000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204851669.00007FF7D4C55000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3204902935.00007FF7D4C57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bb0000_forest.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: e0bdc04f18cc49368113b74b752c60fcff594d11a7e9e9945e316941cafad2da
Instruction ID: c6854ac1d2361e54eae6a95062a542771b68cbdf9bbbbb7ed767da9b1ce0a262
Opcode Fuzzy Hash: e0bdc04f18cc49368113b74b752c60fcff594d11a7e9e9945e316941cafad2da
Instruction Fuzzy Hash: 51112B32618B4182EB619F16E48426DB7E5FB88BD4F984236EA9C17758DF3CD551CB00

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report forest.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSVC.lnk

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Windows Analysis Report
forest.exe

Function 00007FF7D4BB5040 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 404
COMMON

Function 00007FF7D4BC7B00 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161
COMMON

Function 00007FF7D4BB46D0 Relevance: 10.8, APIs: 7, Instructions: 273
COMMON

Function 00007FF7D4BB5EF0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 166
COMMON

Function 00007FF7D4BC66F0 Relevance: 21.0, APIs: 1, Strings: 11, Instructions: 30
COMMON

Function 00007FF7D4BB6660 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 189
serviceCOMMON

Function 00007FF7D4C1E8F4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Function 00007FF7D4C0519C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF7D4BB1DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8
libraryCOMMON

Function 00007FF7D4C2218C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FF7D4C199F0 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Function 00007FF7D4C04E80 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Function 00007FF7D4C1D5F8 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE